OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
6 #define NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
7 | 7 |
8 #include <cstddef> | 8 #include <cstddef> |
9 #include <cstdint> | 9 #include <cstdint> |
10 #include <map> | 10 #include <map> |
11 #include <memory> | 11 #include <memory> |
12 #include <string> | 12 #include <string> |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/macros.h" | 15 #include "base/macros.h" |
16 #include "base/strings/string_piece.h" | |
17 #include "net/quic/core/crypto/crypto_handshake.h" | 16 #include "net/quic/core/crypto/crypto_handshake.h" |
18 #include "net/quic/core/crypto/crypto_handshake_message.h" | 17 #include "net/quic/core/crypto/crypto_handshake_message.h" |
19 #include "net/quic/core/crypto/crypto_protocol.h" | 18 #include "net/quic/core/crypto/crypto_protocol.h" |
20 #include "net/quic/core/crypto/crypto_secret_boxer.h" | 19 #include "net/quic/core/crypto/crypto_secret_boxer.h" |
21 #include "net/quic/core/crypto/proof_source.h" | 20 #include "net/quic/core/crypto/proof_source.h" |
22 #include "net/quic/core/crypto/quic_compressed_certs_cache.h" | 21 #include "net/quic/core/crypto/quic_compressed_certs_cache.h" |
23 #include "net/quic/core/crypto/quic_crypto_proof.h" | 22 #include "net/quic/core/crypto/quic_crypto_proof.h" |
24 #include "net/quic/core/proto/cached_network_parameters.pb.h" | 23 #include "net/quic/core/proto/cached_network_parameters.pb.h" |
25 #include "net/quic/core/proto/source_address_token.pb.h" | 24 #include "net/quic/core/proto/source_address_token.pb.h" |
26 #include "net/quic/core/quic_time.h" | 25 #include "net/quic/core/quic_time.h" |
27 #include "net/quic/platform/api/quic_export.h" | 26 #include "net/quic/platform/api/quic_export.h" |
28 #include "net/quic/platform/api/quic_mutex.h" | 27 #include "net/quic/platform/api/quic_mutex.h" |
29 #include "net/quic/platform/api/quic_reference_counted.h" | 28 #include "net/quic/platform/api/quic_reference_counted.h" |
30 #include "net/quic/platform/api/quic_socket_address.h" | 29 #include "net/quic/platform/api/quic_socket_address.h" |
| 30 #include "net/quic/platform/api/quic_string_piece.h" |
31 | 31 |
32 namespace net { | 32 namespace net { |
33 | 33 |
34 class CryptoHandshakeMessage; | 34 class CryptoHandshakeMessage; |
35 class EphemeralKeySource; | 35 class EphemeralKeySource; |
36 class KeyExchange; | 36 class KeyExchange; |
37 class ProofSource; | 37 class ProofSource; |
38 class QuicClock; | 38 class QuicClock; |
39 class QuicRandom; | 39 class QuicRandom; |
40 class QuicServerConfigProtobuf; | 40 class QuicServerConfigProtobuf; |
41 struct QuicSignedServerConfig; | 41 struct QuicSignedServerConfig; |
42 | 42 |
43 // ClientHelloInfo contains information about a client hello message that is | 43 // ClientHelloInfo contains information about a client hello message that is |
44 // only kept for as long as it's being processed. | 44 // only kept for as long as it's being processed. |
45 struct ClientHelloInfo { | 45 struct ClientHelloInfo { |
46 ClientHelloInfo(const QuicIpAddress& in_client_ip, QuicWallTime in_now); | 46 ClientHelloInfo(const QuicIpAddress& in_client_ip, QuicWallTime in_now); |
47 ClientHelloInfo(const ClientHelloInfo& other); | 47 ClientHelloInfo(const ClientHelloInfo& other); |
48 ~ClientHelloInfo(); | 48 ~ClientHelloInfo(); |
49 | 49 |
50 // Inputs to EvaluateClientHello. | 50 // Inputs to EvaluateClientHello. |
51 const QuicIpAddress client_ip; | 51 const QuicIpAddress client_ip; |
52 const QuicWallTime now; | 52 const QuicWallTime now; |
53 | 53 |
54 // Outputs from EvaluateClientHello. | 54 // Outputs from EvaluateClientHello. |
55 bool valid_source_address_token; | 55 bool valid_source_address_token; |
56 base::StringPiece sni; | 56 QuicStringPiece sni; |
57 base::StringPiece client_nonce; | 57 QuicStringPiece client_nonce; |
58 base::StringPiece server_nonce; | 58 QuicStringPiece server_nonce; |
59 base::StringPiece user_agent_id; | 59 QuicStringPiece user_agent_id; |
60 SourceAddressTokens source_address_tokens; | 60 SourceAddressTokens source_address_tokens; |
61 | 61 |
62 // Errors from EvaluateClientHello. | 62 // Errors from EvaluateClientHello. |
63 std::vector<uint32_t> reject_reasons; | 63 std::vector<uint32_t> reject_reasons; |
64 static_assert(sizeof(QuicTag) == sizeof(uint32_t), "header out of sync"); | 64 static_assert(sizeof(QuicTag) == sizeof(uint32_t), "header out of sync"); |
65 }; | 65 }; |
66 | 66 |
67 namespace test { | 67 namespace test { |
68 class QuicCryptoServerConfigPeer; | 68 class QuicCryptoServerConfigPeer; |
69 } // namespace test | 69 } // namespace test |
(...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
187 }; | 187 }; |
188 | 188 |
189 // |source_address_token_secret|: secret key material used for encrypting and | 189 // |source_address_token_secret|: secret key material used for encrypting and |
190 // decrypting source address tokens. It can be of any length as it is fed | 190 // decrypting source address tokens. It can be of any length as it is fed |
191 // into a KDF before use. In tests, use TESTING. | 191 // into a KDF before use. In tests, use TESTING. |
192 // |server_nonce_entropy|: an entropy source used to generate the orbit and | 192 // |server_nonce_entropy|: an entropy source used to generate the orbit and |
193 // key for server nonces, which are always local to a given instance of a | 193 // key for server nonces, which are always local to a given instance of a |
194 // server. Not owned. | 194 // server. Not owned. |
195 // |proof_source|: provides certificate chains and signatures. This class | 195 // |proof_source|: provides certificate chains and signatures. This class |
196 // takes ownership of |proof_source|. | 196 // takes ownership of |proof_source|. |
197 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, | 197 QuicCryptoServerConfig(QuicStringPiece source_address_token_secret, |
198 QuicRandom* server_nonce_entropy, | 198 QuicRandom* server_nonce_entropy, |
199 std::unique_ptr<ProofSource> proof_source); | 199 std::unique_ptr<ProofSource> proof_source); |
200 ~QuicCryptoServerConfig(); | 200 ~QuicCryptoServerConfig(); |
201 | 201 |
202 // TESTING is a magic parameter for passing to the constructor in tests. | 202 // TESTING is a magic parameter for passing to the constructor in tests. |
203 static const char TESTING[]; | 203 static const char TESTING[]; |
204 | 204 |
205 // Generates a QuicServerConfigProtobuf protobuf suitable for | 205 // Generates a QuicServerConfigProtobuf protobuf suitable for |
206 // AddConfig and SetConfigs. | 206 // AddConfig and SetConfigs. |
207 static std::unique_ptr<QuicServerConfigProtobuf> GenerateConfig( | 207 static std::unique_ptr<QuicServerConfigProtobuf> GenerateConfig( |
(...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
329 | 329 |
330 // BuildServerConfigUpdateMessage invokes |cb| with a SCUP message containing | 330 // BuildServerConfigUpdateMessage invokes |cb| with a SCUP message containing |
331 // the current primary config, an up to date source-address token, and cert | 331 // the current primary config, an up to date source-address token, and cert |
332 // chain and proof in the case of secure QUIC. Passes true to |cb| if the | 332 // chain and proof in the case of secure QUIC. Passes true to |cb| if the |
333 // message was generated successfully, and false otherwise. This method | 333 // message was generated successfully, and false otherwise. This method |
334 // assumes ownership of |cb|. | 334 // assumes ownership of |cb|. |
335 // | 335 // |
336 // |cached_network_params| is optional, and can be nullptr. | 336 // |cached_network_params| is optional, and can be nullptr. |
337 void BuildServerConfigUpdateMessage( | 337 void BuildServerConfigUpdateMessage( |
338 QuicVersion version, | 338 QuicVersion version, |
339 base::StringPiece chlo_hash, | 339 QuicStringPiece chlo_hash, |
340 const SourceAddressTokens& previous_source_address_tokens, | 340 const SourceAddressTokens& previous_source_address_tokens, |
341 const QuicSocketAddress& server_address, | 341 const QuicSocketAddress& server_address, |
342 const QuicIpAddress& client_ip, | 342 const QuicIpAddress& client_ip, |
343 const QuicClock* clock, | 343 const QuicClock* clock, |
344 QuicRandom* rand, | 344 QuicRandom* rand, |
345 QuicCompressedCertsCache* compressed_certs_cache, | 345 QuicCompressedCertsCache* compressed_certs_cache, |
346 const QuicCryptoNegotiatedParameters& params, | 346 const QuicCryptoNegotiatedParameters& params, |
347 const CachedNetworkParameters* cached_network_params, | 347 const CachedNetworkParameters* cached_network_params, |
348 const QuicTagVector& connection_options, | 348 const QuicTagVector& connection_options, |
349 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; | 349 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; |
(...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
459 ~Config() override; | 459 ~Config() override; |
460 | 460 |
461 DISALLOW_COPY_AND_ASSIGN(Config); | 461 DISALLOW_COPY_AND_ASSIGN(Config); |
462 }; | 462 }; |
463 | 463 |
464 typedef std::map<ServerConfigID, QuicReferenceCountedPointer<Config>> | 464 typedef std::map<ServerConfigID, QuicReferenceCountedPointer<Config>> |
465 ConfigMap; | 465 ConfigMap; |
466 | 466 |
467 // Get a ref to the config with a given server config id. | 467 // Get a ref to the config with a given server config id. |
468 QuicReferenceCountedPointer<Config> GetConfigWithScid( | 468 QuicReferenceCountedPointer<Config> GetConfigWithScid( |
469 base::StringPiece requested_scid) const | 469 QuicStringPiece requested_scid) const |
470 SHARED_LOCKS_REQUIRED(configs_lock_); | 470 SHARED_LOCKS_REQUIRED(configs_lock_); |
471 | 471 |
472 // ConfigPrimaryTimeLessThan returns true if a->primary_time < | 472 // ConfigPrimaryTimeLessThan returns true if a->primary_time < |
473 // b->primary_time. | 473 // b->primary_time. |
474 static bool ConfigPrimaryTimeLessThan( | 474 static bool ConfigPrimaryTimeLessThan( |
475 const QuicReferenceCountedPointer<Config>& a, | 475 const QuicReferenceCountedPointer<Config>& a, |
476 const QuicReferenceCountedPointer<Config>& b); | 476 const QuicReferenceCountedPointer<Config>& b); |
477 | 477 |
478 // SelectNewPrimaryConfig reevaluates the primary config based on the | 478 // SelectNewPrimaryConfig reevaluates the primary config based on the |
479 // "primary_time" deadlines contained in each. | 479 // "primary_time" deadlines contained in each. |
(...skipping 108 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
588 QuicRandom* rand, | 588 QuicRandom* rand, |
589 QuicWallTime now, | 589 QuicWallTime now, |
590 const CachedNetworkParameters* cached_network_params) const; | 590 const CachedNetworkParameters* cached_network_params) const; |
591 | 591 |
592 // ParseSourceAddressToken parses the source address tokens contained in | 592 // ParseSourceAddressToken parses the source address tokens contained in |
593 // the encrypted |token|, and populates |tokens| with the parsed tokens. | 593 // the encrypted |token|, and populates |tokens| with the parsed tokens. |
594 // Returns HANDSHAKE_OK if |token| could be parsed, or the reason for the | 594 // Returns HANDSHAKE_OK if |token| could be parsed, or the reason for the |
595 // failure. | 595 // failure. |
596 HandshakeFailureReason ParseSourceAddressToken( | 596 HandshakeFailureReason ParseSourceAddressToken( |
597 const Config& config, | 597 const Config& config, |
598 base::StringPiece token, | 598 QuicStringPiece token, |
599 SourceAddressTokens* tokens) const; | 599 SourceAddressTokens* tokens) const; |
600 | 600 |
601 // ValidateSourceAddressTokens returns HANDSHAKE_OK if the source address | 601 // ValidateSourceAddressTokens returns HANDSHAKE_OK if the source address |
602 // tokens in |tokens| contain a valid and timely token for the IP address | 602 // tokens in |tokens| contain a valid and timely token for the IP address |
603 // |ip| given that the current time is |now|. Otherwise it returns the | 603 // |ip| given that the current time is |now|. Otherwise it returns the |
604 // reason for failure. |cached_network_params| is populated if the valid | 604 // reason for failure. |cached_network_params| is populated if the valid |
605 // token contains a CachedNetworkParameters proto. | 605 // token contains a CachedNetworkParameters proto. |
606 HandshakeFailureReason ValidateSourceAddressTokens( | 606 HandshakeFailureReason ValidateSourceAddressTokens( |
607 const SourceAddressTokens& tokens, | 607 const SourceAddressTokens& tokens, |
608 const QuicIpAddress& ip, | 608 const QuicIpAddress& ip, |
(...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
770 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> config; | 770 QuicReferenceCountedPointer<QuicCryptoServerConfig::Config> config; |
771 std::string primary_scid; | 771 std::string primary_scid; |
772 | 772 |
773 protected: | 773 protected: |
774 ~QuicSignedServerConfig() override; | 774 ~QuicSignedServerConfig() override; |
775 }; | 775 }; |
776 | 776 |
777 } // namespace net | 777 } // namespace net |
778 | 778 |
779 #endif // NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 779 #endif // NET_QUIC_CORE_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
OLD | NEW |