| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 6 #define NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 7 | 7 |
| 8 #include <cstddef> | 8 #include <cstddef> |
| 9 #include <cstdint> | 9 #include <cstdint> |
| 10 #include <map> | 10 #include <map> |
| 11 #include <memory> | 11 #include <memory> |
| 12 #include <string> | 12 #include <string> |
| 13 #include <vector> | 13 #include <vector> |
| 14 | 14 |
| 15 #include "base/macros.h" | 15 #include "base/macros.h" |
| 16 #include "base/strings/string_piece.h" | |
| 17 #include "net/quic/core/crypto/crypto_handshake.h" | 16 #include "net/quic/core/crypto/crypto_handshake.h" |
| 18 #include "net/quic/core/crypto/crypto_handshake_message.h" | 17 #include "net/quic/core/crypto/crypto_handshake_message.h" |
| 19 #include "net/quic/core/crypto/crypto_protocol.h" | 18 #include "net/quic/core/crypto/crypto_protocol.h" |
| 20 #include "net/quic/core/crypto/crypto_secret_boxer.h" | 19 #include "net/quic/core/crypto/crypto_secret_boxer.h" |
| 21 #include "net/quic/core/crypto/proof_source.h" | 20 #include "net/quic/core/crypto/proof_source.h" |
| 22 #include "net/quic/core/crypto/quic_compressed_certs_cache.h" | 21 #include "net/quic/core/crypto/quic_compressed_certs_cache.h" |
| 23 #include "net/quic/core/crypto/quic_crypto_proof.h" | 22 #include "net/quic/core/crypto/quic_crypto_proof.h" |
| 24 #include "net/quic/core/proto/cached_network_parameters.pb.h" | 23 #include "net/quic/core/proto/cached_network_parameters.pb.h" |
| 25 #include "net/quic/core/proto/source_address_token.pb.h" | 24 #include "net/quic/core/proto/source_address_token.pb.h" |
| 26 #include "net/quic/core/quic_time.h" | 25 #include "net/quic/core/quic_time.h" |
| 27 #include "net/quic/platform/api/quic_export.h" | 26 #include "net/quic/platform/api/quic_export.h" |
| 28 #include "net/quic/platform/api/quic_mutex.h" | 27 #include "net/quic/platform/api/quic_mutex.h" |
| 29 #include "net/quic/platform/api/quic_reference_counted.h" | 28 #include "net/quic/platform/api/quic_reference_counted.h" |
| 30 #include "net/quic/platform/api/quic_socket_address.h" | 29 #include "net/quic/platform/api/quic_socket_address.h" |
| 30 #include "net/quic/platform/api/quic_string_piece.h" |
| 31 | 31 |
| 32 namespace net { | 32 namespace net { |
| 33 | 33 |
| 34 class CryptoHandshakeMessage; | 34 class CryptoHandshakeMessage; |
| 35 class EphemeralKeySource; | 35 class EphemeralKeySource; |
| 36 class KeyExchange; | 36 class KeyExchange; |
| 37 class ProofSource; | 37 class ProofSource; |
| 38 class QuicClock; | 38 class QuicClock; |
| 39 class QuicRandom; | 39 class QuicRandom; |
| 40 class QuicServerConfigProtobuf; | 40 class QuicServerConfigProtobuf; |
| 41 struct QuicSignedServerConfig; | 41 struct QuicSignedServerConfig; |
| 42 | 42 |
| 43 // ClientHelloInfo contains information about a client hello message that is | 43 // ClientHelloInfo contains information about a client hello message that is |
| 44 // only kept for as long as it's being processed. | 44 // only kept for as long as it's being processed. |
| 45 struct ClientHelloInfo { | 45 struct ClientHelloInfo { |
| 46 ClientHelloInfo(const QuicIpAddress& in_client_ip, QuicWallTime in_now); | 46 ClientHelloInfo(const QuicIpAddress& in_client_ip, QuicWallTime in_now); |
| 47 ClientHelloInfo(const ClientHelloInfo& other); | 47 ClientHelloInfo(const ClientHelloInfo& other); |
| 48 ~ClientHelloInfo(); | 48 ~ClientHelloInfo(); |
| 49 | 49 |
| 50 // Inputs to EvaluateClientHello. | 50 // Inputs to EvaluateClientHello. |
| 51 const QuicIpAddress client_ip; | 51 const QuicIpAddress client_ip; |
| 52 const QuicWallTime now; | 52 const QuicWallTime now; |
| 53 | 53 |
| 54 // Outputs from EvaluateClientHello. | 54 // Outputs from EvaluateClientHello. |
| 55 bool valid_source_address_token; | 55 bool valid_source_address_token; |
| 56 base::StringPiece sni; | 56 QuicStringPiece sni; |
| 57 base::StringPiece client_nonce; | 57 QuicStringPiece client_nonce; |
| 58 base::StringPiece server_nonce; | 58 QuicStringPiece server_nonce; |
| 59 base::StringPiece user_agent_id; | 59 QuicStringPiece user_agent_id; |
| 60 SourceAddressTokens source_address_tokens; | 60 SourceAddressTokens source_address_tokens; |
| 61 | 61 |
| 62 // Errors from EvaluateClientHello. | 62 // Errors from EvaluateClientHello. |
| 63 std::vector<uint32_t> reject_reasons; | 63 std::vector<uint32_t> reject_reasons; |
| 64 static_assert(sizeof(QuicTag) == sizeof(uint32_t), "header out of sync"); | 64 static_assert(sizeof(QuicTag) == sizeof(uint32_t), "header out of sync"); |
| 65 }; | 65 }; |
| 66 | 66 |
| 67 namespace test { | 67 namespace test { |
| 68 class QuicCryptoServerConfigPeer; | 68 class QuicCryptoServerConfigPeer; |
| 69 } // namespace test | 69 } // namespace test |
| (...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 187 }; | 187 }; |
| 188 | 188 |
| 189 // |source_address_token_secret|: secret key material used for encrypting and | 189 // |source_address_token_secret|: secret key material used for encrypting and |
| 190 // decrypting source address tokens. It can be of any length as it is fed | 190 // decrypting source address tokens. It can be of any length as it is fed |
| 191 // into a KDF before use. In tests, use TESTING. | 191 // into a KDF before use. In tests, use TESTING. |
| 192 // |server_nonce_entropy|: an entropy source used to generate the orbit and | 192 // |server_nonce_entropy|: an entropy source used to generate the orbit and |
| 193 // key for server nonces, which are always local to a given instance of a | 193 // key for server nonces, which are always local to a given instance of a |
| 194 // server. Not owned. | 194 // server. Not owned. |
| 195 // |proof_source|: provides certificate chains and signatures. This class | 195 // |proof_source|: provides certificate chains and signatures. This class |
| 196 // takes ownership of |proof_source|. | 196 // takes ownership of |proof_source|. |
| 197 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, | 197 QuicCryptoServerConfig(QuicStringPiece source_address_token_secret, |
| 198 QuicRandom* server_nonce_entropy, | 198 QuicRandom* server_nonce_entropy, |
| 199 std::unique_ptr<ProofSource> proof_source); | 199 std::unique_ptr<ProofSource> proof_source); |
| 200 ~QuicCryptoServerConfig(); | 200 ~QuicCryptoServerConfig(); |
| 201 | 201 |
| 202 // TESTING is a magic parameter for passing to the constructor in tests. | 202 // TESTING is a magic parameter for passing to the constructor in tests. |
| 203 static const char TESTING[]; | 203 static const char TESTING[]; |
| 204 | 204 |
| 205 // Generates a QuicServerConfigProtobuf protobuf suitable for | 205 // Generates a QuicServerConfigProtobuf protobuf suitable for |
| 206 // AddConfig and SetConfigs. | 206 // AddConfig and SetConfigs. |
| 207 static std::unique_ptr<QuicServerConfigProtobuf> GenerateConfig( | 207 static std::unique_ptr<QuicServerConfigProtobuf> GenerateConfig( |
| (...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 329 | 329 |
| 330 // BuildServerConfigUpdateMessage invokes |cb| with a SCUP message containing | 330 // BuildServerConfigUpdateMessage invokes |cb| with a SCUP message containing |
| 331 // the current primary config, an up to date source-address token, and cert | 331 // the current primary config, an up to date source-address token, and cert |
| 332 // chain and proof in the case of secure QUIC. Passes true to |cb| if the | 332 // chain and proof in the case of secure QUIC. Passes true to |cb| if the |
| 333 // message was generated successfully, and false otherwise. This method | 333 // message was generated successfully, and false otherwise. This method |
| 334 // assumes ownership of |cb|. | 334 // assumes ownership of |cb|. |
| 335 // | 335 // |
| 336 // |cached_network_params| is optional, and can be nullptr. | 336 // |cached_network_params| is optional, and can be nullptr. |
| 337 void BuildServerConfigUpdateMessage( | 337 void BuildServerConfigUpdateMessage( |
| 338 QuicVersion version, | 338 QuicVersion version, |
| 339 base::StringPiece chlo_hash, | 339 QuicStringPiece chlo_hash, |
| 340 const SourceAddressTokens& previous_source_address_tokens, | 340 const SourceAddressTokens& previous_source_address_tokens, |
| 341 const QuicSocketAddress& server_address, | 341 const QuicSocketAddress& server_address, |
| 342 const QuicIpAddress& client_ip, | 342 const QuicIpAddress& client_ip, |
| 343 const QuicClock* clock, | 343 const QuicClock* clock, |
| 344 QuicRandom* rand, | 344 QuicRandom* rand, |
| 345 QuicCompressedCertsCache* compressed_certs_cache, | 345 QuicCompressedCertsCache* compressed_certs_cache, |
| 346 const QuicCryptoNegotiatedParameters& params, | 346 const QuicCryptoNegotiatedParameters& params, |
| 347 const CachedNetworkParameters* cached_network_params, | 347 const CachedNetworkParameters* cached_network_params, |
| 348 const QuicTagVector& connection_options, | 348 const QuicTagVector& connection_options, |
| 349 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; | 349 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; |
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 459 ~Config() override; | 459 ~Config() override; |
| 460 | 460 |
| 461 DISALLOW_COPY_AND_ASSIGN(Config); | 461 DISALLOW_COPY_AND_ASSIGN(Config); |
| 462 }; | 462 }; |
| 463 | 463 |
| 464 typedef std::map<ServerConfigID, QuicReferenceCountedPointer<Config>> | 464 typedef std::map<ServerConfigID, QuicReferenceCountedPointer<Config>> |
| 465 ConfigMap; | 465 ConfigMap; |
| 466 | 466 |
| 467 // Get a ref to the config with a given server config id. | 467 // Get a ref to the config with a given server config id. |
| 468 QuicReferenceCountedPointer<Config> GetConfigWithScid( | 468 QuicReferenceCountedPointer<Config> GetConfigWithScid( |
| 469 base::StringPiece requested_scid) const | 469 QuicStringPiece requested_scid) const |
| 470 SHARED_LOCKS_REQUIRED(configs_lock_); | 470 SHARED_LOCKS_REQUIRED(configs_lock_); |
| 471 | 471 |
| 472 // ConfigPrimaryTimeLessThan returns true if a->primary_time < | 472 // ConfigPrimaryTimeLessThan returns true if a->primary_time < |
| 473 // b->primary_time. | 473 // b->primary_time. |
| 474 static bool ConfigPrimaryTimeLessThan( | 474 static bool ConfigPrimaryTimeLessThan( |
| 475 const QuicReferenceCountedPointer<Config>& a, | 475 const QuicReferenceCountedPointer<Config>& a, |
| 476 const QuicReferenceCountedPointer<Config>& b); | 476 const QuicReferenceCountedPointer<Config>& b); |
| 477 | 477 |
| 478 // SelectNewPrimaryConfig reevaluates the primary config based on the | 478 // SelectNewPrimaryConfig reevaluates the primary config based on the |
| 479 // "primary_time" deadlines contained in each. | 479 // "primary_time" deadlines contained in each. |
| (...skipping 108 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 588 QuicRandom* rand, | 588 QuicRandom* rand, |
| 589 QuicWallTime now, | 589 QuicWallTime now, |
| 590 const CachedNetworkParameters* cached_network_params) const; | 590 const CachedNetworkParameters* cached_network_params) const; |
| 591 | 591 |
| 592 // ParseSourceAddressToken parses the source address tokens contained in | 592 // ParseSourceAddressToken parses the source address tokens contained in |
| 593 // the encrypted |token|, and populates |tokens| with the parsed tokens. | 593 // the encrypted |token|, and populates |tokens| with the parsed tokens. |
| 594 // Returns HANDSHAKE_OK if |token| could be parsed, or the reason for the | 594 // Returns HANDSHAKE_OK if |token| could be parsed, or the reason for the |
| 595 // failure. | 595 // failure. |
| 596 HandshakeFailureReason ParseSourceAddressToken( | 596 HandshakeFailureReason ParseSourceAddressToken( |
| 597 const Config& config, | 597 const Config& config, |
| 598 base::StringPiece token, | 598 QuicStringPiece token, |
| 599 SourceAddressTokens* tokens) const; | 599 SourceAddressTokens* tokens) const; |
| 600 | 600 |
| 601 // ValidateSourceAddressTokens returns HANDSHAKE_OK if the source address | 601 // ValidateSourceAddressTokens returns HANDSHAKE_OK if the source address |
| 602 // tokens in |tokens| contain a valid and timely token for the IP address | 602 // tokens in |tokens| contain a valid and timely token for the IP address |
| 603 // |ip| given that the current time is |now|. Otherwise it returns the | 603 // |ip| given that the current time is |now|. Otherwise it returns the |
| 604 // reason for failure. |cached_network_params| is populated if the valid | 604 // reason for failure. |cached_network_params| is populated if the valid |
| 605 // token contains a CachedNetworkParameters proto. | 605 // token contains a CachedNetworkParameters proto. |
| 606 HandshakeFailureReason ValidateSourceAddressTokens( | 606 HandshakeFailureReason ValidateSourceAddressTokens( |
| 607 const SourceAddressTokens& tokens, | 607 const SourceAddressTokens& tokens, |
| 608 const QuicIpAddress& ip, | 608 const QuicIpAddress& ip, |
| (...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 770 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> config; | 770 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> config; |
| 771 std::string primary_scid; | 771 std::string primary_scid; |
| 772 | 772 |
| 773 protected: | 773 protected: |
| 774 ~QuicSignedServerConfig() override; | 774 ~QuicSignedServerConfig() override; |
| 775 }; | 775 }; |
| 776 | 776 |
| 777 } // namespace net | 777 } // namespace net |
| 778 | 778 |
| 779 #endif // NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 779 #endif // NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| OLD | NEW |