OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
(...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
214 // or reject the connection. If the connection is to be accepted, |out| is | 214 // or reject the connection. If the connection is to be accepted, |out| is |
215 // set to the contents of the ServerHello, |out_params| is completed and | 215 // set to the contents of the ServerHello, |out_params| is completed and |
216 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and | 216 // QUIC_NO_ERROR is returned. Otherwise |out| is set to be a REJ message and |
217 // an error code is returned. | 217 // an error code is returned. |
218 // | 218 // |
219 // validate_chlo_result: Output from the asynchronous call to | 219 // validate_chlo_result: Output from the asynchronous call to |
220 // ValidateClientHello. Contains the client hello message and | 220 // ValidateClientHello. Contains the client hello message and |
221 // information about it. | 221 // information about it. |
222 // connection_id: the ConnectionId for the connection, which is used in key | 222 // connection_id: the ConnectionId for the connection, which is used in key |
223 // derivation. | 223 // derivation. |
| 224 // server_ip: the IP address and port of the server. The IP address may be |
| 225 // used for certificate selection. |
224 // client_address: the IP address and port of the client. The IP address is | 226 // client_address: the IP address and port of the client. The IP address is |
225 // used to generate and validate source-address tokens. | 227 // used to generate and validate source-address tokens. |
226 // version: version of the QUIC protocol in use for this connection | 228 // version: version of the QUIC protocol in use for this connection |
227 // supported_versions: versions of the QUIC protocol that this server | 229 // supported_versions: versions of the QUIC protocol that this server |
228 // supports. | 230 // supports. |
229 // initial_flow_control_window: size of initial flow control window this | 231 // initial_flow_control_window: size of initial flow control window this |
230 // server uses for new streams. | 232 // server uses for new streams. |
231 // clock: used to validate client nonces and ephemeral keys. | 233 // clock: used to validate client nonces and ephemeral keys. |
232 // rand: an entropy source | 234 // rand: an entropy source |
233 // params: the state of the handshake. This may be updated with a server | 235 // params: the state of the handshake. This may be updated with a server |
234 // nonce when we send a rejection. After a successful handshake, this will | 236 // nonce when we send a rejection. After a successful handshake, this will |
235 // contain the state of the connection. | 237 // contain the state of the connection. |
236 // out: the resulting handshake message (either REJ or SHLO) | 238 // out: the resulting handshake message (either REJ or SHLO) |
237 // error_details: used to store a string describing any error. | 239 // error_details: used to store a string describing any error. |
238 QuicErrorCode ProcessClientHello( | 240 QuicErrorCode ProcessClientHello( |
239 const ValidateClientHelloResultCallback::Result& validate_chlo_result, | 241 const ValidateClientHelloResultCallback::Result& validate_chlo_result, |
240 QuicConnectionId connection_id, | 242 QuicConnectionId connection_id, |
241 IPEndPoint client_address, | 243 const IPEndPoint& server_ip, |
| 244 const IPEndPoint& client_address, |
242 QuicVersion version, | 245 QuicVersion version, |
243 const QuicVersionVector& supported_versions, | 246 const QuicVersionVector& supported_versions, |
244 const QuicClock* clock, | 247 const QuicClock* clock, |
245 QuicRandom* rand, | 248 QuicRandom* rand, |
246 QuicCryptoNegotiatedParameters* params, | 249 QuicCryptoNegotiatedParameters* params, |
247 CryptoHandshakeMessage* out, | 250 CryptoHandshakeMessage* out, |
248 std::string* error_details) const; | 251 std::string* error_details) const; |
249 | 252 |
250 // BuildServerConfigUpdateMessage sets |out| to be a SCUP message containing | 253 // BuildServerConfigUpdateMessage sets |out| to be a SCUP message containing |
251 // the current primary config, an up to date source-address token, and cert | 254 // the current primary config, an up to date source-address token, and cert |
252 // chain and proof in the case of secure QUIC. Returns true if successfully | 255 // chain and proof in the case of secure QUIC. Returns true if successfully |
253 // filled |out|. | 256 // filled |out|. |
254 // | 257 // |
255 // |cached_network_params| is optional, and can be nullptr. | 258 // |cached_network_params| is optional, and can be nullptr. |
256 bool BuildServerConfigUpdateMessage( | 259 bool BuildServerConfigUpdateMessage( |
| 260 const IPEndPoint& server_ip, |
257 const IPEndPoint& client_ip, | 261 const IPEndPoint& client_ip, |
258 const QuicClock* clock, | 262 const QuicClock* clock, |
259 QuicRandom* rand, | 263 QuicRandom* rand, |
260 const QuicCryptoNegotiatedParameters& params, | 264 const QuicCryptoNegotiatedParameters& params, |
261 const CachedNetworkParameters* cached_network_params, | 265 const CachedNetworkParameters* cached_network_params, |
262 CryptoHandshakeMessage* out) const; | 266 CryptoHandshakeMessage* out) const; |
263 | 267 |
264 // SetProofSource installs |proof_source| as the ProofSource for handshakes. | 268 // SetProofSource installs |proof_source| as the ProofSource for handshakes. |
265 // This object takes ownership of |proof_source|. | 269 // This object takes ownership of |proof_source|. |
266 void SetProofSource(ProofSource* proof_source); | 270 void SetProofSource(ProofSource* proof_source); |
(...skipping 146 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
413 // EvaluateClientHello checks |client_hello| for gross errors and determines | 417 // EvaluateClientHello checks |client_hello| for gross errors and determines |
414 // whether it can be shown to be fresh (i.e. not a replay). The results are | 418 // whether it can be shown to be fresh (i.e. not a replay). The results are |
415 // written to |info|. | 419 // written to |info|. |
416 void EvaluateClientHello( | 420 void EvaluateClientHello( |
417 const uint8* primary_orbit, | 421 const uint8* primary_orbit, |
418 scoped_refptr<Config> requested_config, | 422 scoped_refptr<Config> requested_config, |
419 ValidateClientHelloResultCallback::Result* client_hello_state, | 423 ValidateClientHelloResultCallback::Result* client_hello_state, |
420 ValidateClientHelloResultCallback* done_cb) const; | 424 ValidateClientHelloResultCallback* done_cb) const; |
421 | 425 |
422 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. | 426 // BuildRejection sets |out| to be a REJ message in reply to |client_hello|. |
423 void BuildRejection( | 427 void BuildRejection(const IPEndPoint& server_ip, |
424 const Config& config, | 428 const Config& config, |
425 const CryptoHandshakeMessage& client_hello, | 429 const CryptoHandshakeMessage& client_hello, |
426 const ClientHelloInfo& info, | 430 const ClientHelloInfo& info, |
427 const CachedNetworkParameters& cached_network_params, | 431 const CachedNetworkParameters& cached_network_params, |
428 QuicRandom* rand, | 432 QuicRandom* rand, |
429 QuicCryptoNegotiatedParameters *params, | 433 QuicCryptoNegotiatedParameters* params, |
430 CryptoHandshakeMessage* out) const; | 434 CryptoHandshakeMessage* out) const; |
431 | 435 |
432 // ParseConfigProtobuf parses the given config protobuf and returns a | 436 // ParseConfigProtobuf parses the given config protobuf and returns a |
433 // scoped_refptr<Config> if successful. The caller adopts the reference to the | 437 // scoped_refptr<Config> if successful. The caller adopts the reference to the |
434 // Config. On error, ParseConfigProtobuf returns nullptr. | 438 // Config. On error, ParseConfigProtobuf returns nullptr. |
435 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); | 439 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); |
436 | 440 |
437 // NewSourceAddressToken returns a fresh source address token for the given | 441 // NewSourceAddressToken returns a fresh source address token for the given |
438 // IP address. |cached_network_params| is optional, and can be nullptr. | 442 // IP address. |cached_network_params| is optional, and can be nullptr. |
439 std::string NewSourceAddressToken( | 443 std::string NewSourceAddressToken( |
440 const Config& config, | 444 const Config& config, |
(...skipping 90 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
531 uint32 source_address_token_lifetime_secs_; | 535 uint32 source_address_token_lifetime_secs_; |
532 uint32 server_nonce_strike_register_max_entries_; | 536 uint32 server_nonce_strike_register_max_entries_; |
533 uint32 server_nonce_strike_register_window_secs_; | 537 uint32 server_nonce_strike_register_window_secs_; |
534 | 538 |
535 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); | 539 DISALLOW_COPY_AND_ASSIGN(QuicCryptoServerConfig); |
536 }; | 540 }; |
537 | 541 |
538 } // namespace net | 542 } // namespace net |
539 | 543 |
540 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 544 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
OLD | NEW |