| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 5 #ifndef NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 6 #define NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| 7 | 7 |
| 8 #include <stddef.h> | 8 #include <stddef.h> |
| 9 #include <stdint.h> | 9 #include <stdint.h> |
| 10 | 10 |
| (...skipping 192 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 203 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, | 203 QuicCryptoServerConfig(base::StringPiece source_address_token_secret, |
| 204 QuicRandom* server_nonce_entropy, | 204 QuicRandom* server_nonce_entropy, |
| 205 std::unique_ptr<ProofSource> proof_source); | 205 std::unique_ptr<ProofSource> proof_source); |
| 206 ~QuicCryptoServerConfig(); | 206 ~QuicCryptoServerConfig(); |
| 207 | 207 |
| 208 // TESTING is a magic parameter for passing to the constructor in tests. | 208 // TESTING is a magic parameter for passing to the constructor in tests. |
| 209 static const char TESTING[]; | 209 static const char TESTING[]; |
| 210 | 210 |
| 211 // Generates a QuicServerConfigProtobuf protobuf suitable for | 211 // Generates a QuicServerConfigProtobuf protobuf suitable for |
| 212 // AddConfig and SetConfigs. | 212 // AddConfig and SetConfigs. |
| 213 static QuicServerConfigProtobuf* GenerateConfig(QuicRandom* rand, | 213 static std::unique_ptr<QuicServerConfigProtobuf> GenerateConfig( |
| 214 const QuicClock* clock, | 214 QuicRandom* rand, |
| 215 const ConfigOptions& options); | 215 const QuicClock* clock, |
| 216 const ConfigOptions& options); |
| 216 | 217 |
| 217 // AddConfig adds a QuicServerConfigProtobuf to the availible configurations. | 218 // AddConfig adds a QuicServerConfigProtobuf to the available configurations. |
| 218 // It returns the SCFG message from the config if successful. The caller | 219 // It returns the SCFG message from the config if successful. The caller |
| 219 // takes ownership of the CryptoHandshakeMessage. |now| is used in | 220 // takes ownership of the CryptoHandshakeMessage. |now| is used in |
| 220 // conjunction with |protobuf->primary_time()| to determine whether the | 221 // conjunction with |protobuf->primary_time()| to determine whether the |
| 221 // config should be made primary. | 222 // config should be made primary. |
| 222 CryptoHandshakeMessage* AddConfig(QuicServerConfigProtobuf* protobuf, | 223 CryptoHandshakeMessage* AddConfig( |
| 223 QuicWallTime now); | 224 std::unique_ptr<QuicServerConfigProtobuf> protobuf, |
| 225 QuicWallTime now); |
| 224 | 226 |
| 225 // AddDefaultConfig calls DefaultConfig to create a config and then calls | 227 // AddDefaultConfig calls DefaultConfig to create a config and then calls |
| 226 // AddConfig to add it. See the comment for |DefaultConfig| for details of | 228 // AddConfig to add it. See the comment for |DefaultConfig| for details of |
| 227 // the arguments. | 229 // the arguments. |
| 228 CryptoHandshakeMessage* AddDefaultConfig(QuicRandom* rand, | 230 CryptoHandshakeMessage* AddDefaultConfig(QuicRandom* rand, |
| 229 const QuicClock* clock, | 231 const QuicClock* clock, |
| 230 const ConfigOptions& options); | 232 const ConfigOptions& options); |
| 231 | 233 |
| 232 // SetConfigs takes a vector of config protobufs and the current time. | 234 // SetConfigs takes a vector of config protobufs and the current time. |
| 233 // Configs are assumed to be uniquely identified by their server config ID. | 235 // Configs are assumed to be uniquely identified by their server config ID. |
| 234 // Previously unknown configs are added and possibly made the primary config | 236 // Previously unknown configs are added and possibly made the primary config |
| 235 // depending on their |primary_time| and the value of |now|. Configs that are | 237 // depending on their |primary_time| and the value of |now|. Configs that are |
| 236 // known, but are missing from the protobufs are deleted, unless they are | 238 // known, but are missing from the protobufs are deleted, unless they are |
| 237 // currently the primary config. SetConfigs returns false if any errors were | 239 // currently the primary config. SetConfigs returns false if any errors were |
| 238 // encountered and no changes to the QuicCryptoServerConfig will occur. | 240 // encountered and no changes to the QuicCryptoServerConfig will occur. |
| 239 bool SetConfigs(const std::vector<QuicServerConfigProtobuf*>& protobufs, | 241 bool SetConfigs( |
| 240 QuicWallTime now); | 242 const std::vector<std::unique_ptr<QuicServerConfigProtobuf>>& protobufs, |
| 243 QuicWallTime now); |
| 241 | 244 |
| 242 // SetSourceAddressTokenKeys sets the keys to be tried, in order, when | 245 // SetSourceAddressTokenKeys sets the keys to be tried, in order, when |
| 243 // decrypting a source address token. Note that these keys are used *without* | 246 // decrypting a source address token. Note that these keys are used *without* |
| 244 // passing them through a KDF, in contradistinction to the | 247 // passing them through a KDF, in contradistinction to the |
| 245 // |source_address_token_secret| argument to the constructor. | 248 // |source_address_token_secret| argument to the constructor. |
| 246 void SetSourceAddressTokenKeys(const std::vector<std::string>& keys); | 249 void SetSourceAddressTokenKeys(const std::vector<std::string>& keys); |
| 247 | 250 |
| 248 // Get the server config ids for all known configs. | 251 // Get the server config ids for all known configs. |
| 249 void GetConfigIds(std::vector<std::string>* scids) const; | 252 void GetConfigIds(std::vector<std::string>* scids) const; |
| 250 | 253 |
| (...skipping 122 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 373 const QuicCryptoNegotiatedParameters& params, | 376 const QuicCryptoNegotiatedParameters& params, |
| 374 const CachedNetworkParameters* cached_network_params, | 377 const CachedNetworkParameters* cached_network_params, |
| 375 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; | 378 std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const; |
| 376 | 379 |
| 377 // SetEphemeralKeySource installs an object that can cache ephemeral keys for | 380 // SetEphemeralKeySource installs an object that can cache ephemeral keys for |
| 378 // a short period of time. This object takes ownership of | 381 // a short period of time. This object takes ownership of |
| 379 // |ephemeral_key_source|. If not set then ephemeral keys will be generated | 382 // |ephemeral_key_source|. If not set then ephemeral keys will be generated |
| 380 // per-connection. | 383 // per-connection. |
| 381 void SetEphemeralKeySource(EphemeralKeySource* ephemeral_key_source); | 384 void SetEphemeralKeySource(EphemeralKeySource* ephemeral_key_source); |
| 382 | 385 |
| 383 // Install an externall created StrikeRegisterClient for use to | 386 // Install an externally created StrikeRegisterClient for use to |
| 384 // interact with the strike register. This object takes ownership | 387 // interact with the strike register. This object takes ownership |
| 385 // of the |strike_register_client|. | 388 // of the |strike_register_client|. |
| 386 void SetStrikeRegisterClient(StrikeRegisterClient* strike_register_client); | 389 void SetStrikeRegisterClient(StrikeRegisterClient* strike_register_client); |
| 387 | 390 |
| 388 // set_replay_protection controls whether replay protection is enabled. If | 391 // set_replay_protection controls whether replay protection is enabled. If |
| 389 // replay protection is disabled then no strike registers are needed and | 392 // replay protection is disabled then no strike registers are needed and |
| 390 // frontends can share an orbit value without a shared strike-register. | 393 // frontends can share an orbit value without a shared strike-register. |
| 391 // However, an attacker can duplicate a handshake and cause a client's | 394 // However, an attacker can duplicate a handshake and cause a client's |
| 392 // request to be processed twice. | 395 // request to be processed twice. |
| 393 void set_replay_protection(bool on); | 396 void set_replay_protection(bool on); |
| (...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 472 std::string serialized; | 475 std::string serialized; |
| 473 // id contains the SCID of this server config. | 476 // id contains the SCID of this server config. |
| 474 std::string id; | 477 std::string id; |
| 475 // orbit contains the orbit value for this config: an opaque identifier | 478 // orbit contains the orbit value for this config: an opaque identifier |
| 476 // used to identify clusters of server frontends. | 479 // used to identify clusters of server frontends. |
| 477 unsigned char orbit[kOrbitSize]; | 480 unsigned char orbit[kOrbitSize]; |
| 478 | 481 |
| 479 // key_exchanges contains key exchange objects with the private keys | 482 // key_exchanges contains key exchange objects with the private keys |
| 480 // already loaded. The values correspond, one-to-one, with the tags in | 483 // already loaded. The values correspond, one-to-one, with the tags in |
| 481 // |kexs| from the parent class. | 484 // |kexs| from the parent class. |
| 482 std::vector<KeyExchange*> key_exchanges; | 485 std::vector<std::unique_ptr<KeyExchange>> key_exchanges; |
| 483 | 486 |
| 484 // tag_value_map contains the raw key/value pairs for the config. | 487 // tag_value_map contains the raw key/value pairs for the config. |
| 485 QuicTagValueMap tag_value_map; | 488 QuicTagValueMap tag_value_map; |
| 486 | 489 |
| 487 // channel_id_enabled is true if the config in |serialized| specifies that | 490 // channel_id_enabled is true if the config in |serialized| specifies that |
| 488 // ChannelIDs are supported. | 491 // ChannelIDs are supported. |
| 489 bool channel_id_enabled; | 492 bool channel_id_enabled; |
| 490 | 493 |
| 491 // is_primary is true if this config is the one that we'll give out to | 494 // is_primary is true if this config is the one that we'll give out to |
| 492 // clients as the current one. | 495 // clients as the current one. |
| (...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 627 static std::string CompressChain( | 630 static std::string CompressChain( |
| 628 QuicCompressedCertsCache* compressed_certs_cache, | 631 QuicCompressedCertsCache* compressed_certs_cache, |
| 629 const scoped_refptr<ProofSource::Chain>& chain, | 632 const scoped_refptr<ProofSource::Chain>& chain, |
| 630 const std::string& client_common_set_hashes, | 633 const std::string& client_common_set_hashes, |
| 631 const std::string& client_cached_cert_hashes, | 634 const std::string& client_cached_cert_hashes, |
| 632 const CommonCertSets* common_sets); | 635 const CommonCertSets* common_sets); |
| 633 | 636 |
| 634 // ParseConfigProtobuf parses the given config protobuf and returns a | 637 // ParseConfigProtobuf parses the given config protobuf and returns a |
| 635 // scoped_refptr<Config> if successful. The caller adopts the reference to the | 638 // scoped_refptr<Config> if successful. The caller adopts the reference to the |
| 636 // Config. On error, ParseConfigProtobuf returns nullptr. | 639 // Config. On error, ParseConfigProtobuf returns nullptr. |
| 637 scoped_refptr<Config> ParseConfigProtobuf(QuicServerConfigProtobuf* protobuf); | 640 scoped_refptr<Config> ParseConfigProtobuf( |
| 641 const std::unique_ptr<QuicServerConfigProtobuf>& protobuf); |
| 638 | 642 |
| 639 // NewSourceAddressToken returns a fresh source address token for the given | 643 // NewSourceAddressToken returns a fresh source address token for the given |
| 640 // IP address. |cached_network_params| is optional, and can be nullptr. | 644 // IP address. |cached_network_params| is optional, and can be nullptr. |
| 641 std::string NewSourceAddressToken( | 645 std::string NewSourceAddressToken( |
| 642 const Config& config, | 646 const Config& config, |
| 643 const SourceAddressTokens& previous_tokens, | 647 const SourceAddressTokens& previous_tokens, |
| 644 const IPAddress& ip, | 648 const IPAddress& ip, |
| 645 QuicRandom* rand, | 649 QuicRandom* rand, |
| 646 QuicWallTime now, | 650 QuicWallTime now, |
| 647 const CachedNetworkParameters* cached_network_params) const; | 651 const CachedNetworkParameters* cached_network_params) const; |
| (...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 851 std::string cert_sct; | 855 std::string cert_sct; |
| 852 // The server config that is used for this proof (and the rest of the | 856 // The server config that is used for this proof (and the rest of the |
| 853 // request). | 857 // request). |
| 854 scoped_refptr<QuicCryptoServerConfig::Config> config; | 858 scoped_refptr<QuicCryptoServerConfig::Config> config; |
| 855 std::string primary_scid; | 859 std::string primary_scid; |
| 856 }; | 860 }; |
| 857 | 861 |
| 858 } // namespace net | 862 } // namespace net |
| 859 | 863 |
| 860 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ | 864 #endif // NET_QUIC_CRYPTO_QUIC_CRYPTO_SERVER_CONFIG_H_ |
| OLD | NEW |