2022-05-06 16:49:46 +00:00
|
|
|
/* Copyright (c) 2017 - 2022 LiteSpeed Technologies Inc. See LICENSE. */
|
2019-09-11 15:27:58 +00:00
|
|
|
#ifndef LSQUIC_HANDSHAKE_H
|
|
|
|
#define LSQUIC_HANDSHAKE_H 1
|
2017-09-22 21:00:03 +00:00
|
|
|
|
|
|
|
#define aes128_key_len 16
|
|
|
|
#define aes128_iv_len 4
|
2019-09-11 15:27:58 +00:00
|
|
|
#define STK_LENGTH 60
|
|
|
|
#define SCID_LENGTH 16
|
2017-09-22 21:00:03 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
struct lsquic_server_config;
|
|
|
|
struct sockaddr;
|
|
|
|
struct lsquic_str;
|
|
|
|
struct lsquic_packet_in;
|
|
|
|
struct lsquic_cid;
|
2019-12-11 14:38:58 +00:00
|
|
|
struct lsquic_enc_session;
|
2020-10-01 12:53:35 +00:00
|
|
|
struct lsquic_engine_public;
|
2017-09-22 21:00:03 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
/* client side, certs and hashs
|
|
|
|
*/
|
|
|
|
typedef struct cert_hash_item_st
|
Latest changes
- [API Change] Sendfile-like functionality is gone. The stream no
longer opens files and deals with file descriptors. (Among other
things, this makes the code more portable.) Three writing functions
are provided:
lsquic_stream_write
lsquic_stream_writev
lsquic_stream_writef (NEW)
lsquic_stream_writef() is given an abstract reader that has function
pointers for size() and read() functions which the user can implement.
This is the most flexible way. lsquic_stream_write() and
lsquic_stream_writev() are now both implemented as wrappers around
lsquic_stream_writef().
- [OPTIMIZATION] When writing to stream, be it within or without the
on_write() callback, place data directly into packet buffer,
bypassing auxiliary data structures. This reduces amount of memory
required, for the amount of data that can be written is limited
by the congestion window.
To support writes outside the on_write() callback, we keep N
outgoing packet buffers per connection which can be written to
by any stream. One half of these are reserved for the highest
priority stream(s), the other half for all other streams. This way,
low-priority streams cannot write instead of high-priority streams
and, on the other hand, low-priority streams get a chance to send
their packets out.
The algorithm is as follows:
- When user writes to stream outside of the callback:
- If this is the highest priority stream, place it onto the
reserved N/2 queue or fail.
(The actual size of this queue is dynamic -- MAX(N/2, CWND) --
rather than N/2, allowing high-priority streams to write as
much as can be sent.)
- If the stream is not the highest priority, try to place the
data onto the reserved N/2 queue or fail.
- When tick occurs *and* more packets can be scheduled:
- Transfer packets from the high N/2 queue to the scheduled
queue.
- If more scheduling is allowed:
- Call on_write callbacks for highest-priority streams,
placing resulting packets directly onto the scheduled queue.
- If more scheduling is allowed:
- Transfer packets from the low N/2 queue to the scheduled
queue.
- If more scheduling is allowed:
- Call on_write callbacks for non-highest-priority streams,
placing resulting packets directly onto the scheduled queue
The number N is currently 20, but it could be varied based on
resource usage.
- If stream is created due to incoming headers, make headers readable
from on_new.
- Outgoing packets are no longer marked non-writeable to prevent placing
more than one STREAM frame from the same stream into a single packet.
This property is maintained via code flow and an explicit check.
Packets for stream data are allocated using a special function.
- STREAM frame elision is cheaper, as we only perform it if a reset
stream has outgoing packets referencing it.
- lsquic_packet_out_t is smaller, as stream_rec elements are now
inside a union.
2017-10-31 13:35:58 +00:00
|
|
|
{
|
2019-09-11 15:27:58 +00:00
|
|
|
struct lsquic_str* domain; /*with port, such as "xyz.com:8088" as the key */
|
|
|
|
struct lsquic_str* crts;
|
|
|
|
struct lsquic_str* hashs;
|
|
|
|
struct lsquic_hash_elem hash_el;
|
|
|
|
int count;
|
|
|
|
} cert_hash_item_t;
|
|
|
|
|
|
|
|
#ifndef NDEBUG
|
|
|
|
enum hsk_failure_reason
|
2020-03-12 12:41:53 +00:00
|
|
|
lsquic_verify_stk0(const struct lsquic_enc_session *,
|
2019-12-11 14:38:58 +00:00
|
|
|
struct lsquic_server_config *, const struct sockaddr *ip_addr, uint64_t tm,
|
2019-09-11 15:27:58 +00:00
|
|
|
struct lsquic_str *stk,
|
|
|
|
unsigned secs_since_stk_generated);
|
|
|
|
enum hsk_failure_reason
|
2020-03-12 12:41:53 +00:00
|
|
|
lsquic_verify_stk(void *, const struct sockaddr *ip_addr,
|
2019-09-11 15:27:58 +00:00
|
|
|
uint64_t tm, struct lsquic_str *stk);
|
|
|
|
struct cert_hash_item_st* c_find_certs(const struct lsquic_str *domain);
|
|
|
|
#endif
|
Latest changes
- [API Change] Sendfile-like functionality is gone. The stream no
longer opens files and deals with file descriptors. (Among other
things, this makes the code more portable.) Three writing functions
are provided:
lsquic_stream_write
lsquic_stream_writev
lsquic_stream_writef (NEW)
lsquic_stream_writef() is given an abstract reader that has function
pointers for size() and read() functions which the user can implement.
This is the most flexible way. lsquic_stream_write() and
lsquic_stream_writev() are now both implemented as wrappers around
lsquic_stream_writef().
- [OPTIMIZATION] When writing to stream, be it within or without the
on_write() callback, place data directly into packet buffer,
bypassing auxiliary data structures. This reduces amount of memory
required, for the amount of data that can be written is limited
by the congestion window.
To support writes outside the on_write() callback, we keep N
outgoing packet buffers per connection which can be written to
by any stream. One half of these are reserved for the highest
priority stream(s), the other half for all other streams. This way,
low-priority streams cannot write instead of high-priority streams
and, on the other hand, low-priority streams get a chance to send
their packets out.
The algorithm is as follows:
- When user writes to stream outside of the callback:
- If this is the highest priority stream, place it onto the
reserved N/2 queue or fail.
(The actual size of this queue is dynamic -- MAX(N/2, CWND) --
rather than N/2, allowing high-priority streams to write as
much as can be sent.)
- If the stream is not the highest priority, try to place the
data onto the reserved N/2 queue or fail.
- When tick occurs *and* more packets can be scheduled:
- Transfer packets from the high N/2 queue to the scheduled
queue.
- If more scheduling is allowed:
- Call on_write callbacks for highest-priority streams,
placing resulting packets directly onto the scheduled queue.
- If more scheduling is allowed:
- Transfer packets from the low N/2 queue to the scheduled
queue.
- If more scheduling is allowed:
- Call on_write callbacks for non-highest-priority streams,
placing resulting packets directly onto the scheduled queue
The number N is currently 20, but it could be varied based on
resource usage.
- If stream is created due to incoming headers, make headers readable
from on_new.
- Outgoing packets are no longer marked non-writeable to prevent placing
more than one STREAM frame from the same stream into a single packet.
This property is maintained via code flow and an explicit check.
Packets for stream data are allocated using a special function.
- STREAM frame elision is cheaper, as we only perform it if a reset
stream has outgoing packets referencing it.
- lsquic_packet_out_t is smaller, as stream_rec elements are now
inside a union.
2017-10-31 13:35:58 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
#define SNO_LENGTH 56
|
2018-08-15 19:06:31 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
/* EVP_AEAD_CTX from boringssl pre-18d9f28f0df9f95570. */
|
|
|
|
struct old_evp_aead_ctx_st {
|
|
|
|
void *ptr1; /* aead */
|
|
|
|
void *ptr2; /* aead_state */
|
|
|
|
};
|
2019-02-04 13:59:11 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
/* Server need refresh SCFG once a day */
|
|
|
|
/* can not use sizeof() to get the size */
|
|
|
|
typedef struct SCFG_info_st
|
2017-09-22 21:00:03 +00:00
|
|
|
{
|
|
|
|
unsigned char sscid[SCID_LENGTH];
|
2019-09-11 15:27:58 +00:00
|
|
|
unsigned char priv_key[32];
|
|
|
|
unsigned char skt_key[16];
|
|
|
|
uint32_t aead; /* Fixed, ONLY AESG */
|
|
|
|
uint32_t kexs; /* Fixed, ONLY C255 */
|
|
|
|
uint32_t pdmd; /* Fixed, ONLY X509 */
|
|
|
|
uint64_t orbt; /* Fixed, 0 */
|
|
|
|
uint64_t expy;
|
|
|
|
/* Keep the hole for compatibility with older builds of LSWS: */
|
|
|
|
struct old_evp_aead_ctx_st unused
|
|
|
|
#if __GNUC__
|
|
|
|
__attribute__((deprecated))
|
|
|
|
#endif
|
|
|
|
;
|
|
|
|
short scfg_len;
|
|
|
|
} SCFG_info_t;
|
2017-09-22 21:00:03 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
struct SCFG_st
|
2019-02-04 13:59:11 +00:00
|
|
|
{
|
2019-09-11 15:27:58 +00:00
|
|
|
SCFG_info_t info;
|
|
|
|
unsigned char scfg[]; /* whoile buffer */
|
2019-02-04 13:59:11 +00:00
|
|
|
};
|
2019-09-11 15:27:58 +00:00
|
|
|
typedef struct SCFG_st SCFG_t;
|
|
|
|
/* server side need to store STK with expired time */
|
2019-02-04 13:59:11 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
typedef struct lsquic_server_config
|
2017-09-22 21:00:03 +00:00
|
|
|
{
|
2019-09-11 15:27:58 +00:00
|
|
|
SCFG_t *lsc_scfg; /* This part is stored in SHM */
|
|
|
|
EVP_AEAD_CTX lsc_stk_ctx;
|
|
|
|
} lsquic_server_config_t;
|
2017-09-22 21:00:03 +00:00
|
|
|
|
2019-09-11 15:27:58 +00:00
|
|
|
/* Based on enum HandshakeFailureReason in Chromium */
|
|
|
|
enum hsk_failure_reason
|
|
|
|
{
|
|
|
|
HFR_HANDSHAKE_OK = 0,
|
|
|
|
|
|
|
|
/* Invalid client nonce in CHLO: */
|
|
|
|
HFR_CLIENT_NONCE_UNKNOWN = 1, /* Default nonce failure */
|
|
|
|
HFR_CLIENT_NONCE_INVALID = 2, /* Incorrect nonce length */
|
|
|
|
HFR_CLIENT_NONCE_NOT_UNIQ = 3,
|
|
|
|
HFR_CLIENT_NONCE_INVALID_ORBIT = 4,
|
|
|
|
HFR_CLIENT_NONCE_INVALID_TIME = 5,
|
|
|
|
|
|
|
|
/* Invalid server nonce in CHLO: */
|
|
|
|
HFR_SERVER_NONCE_DECRYPTION = 8,
|
|
|
|
HFR_SERVER_NONCE_INVALID = 9,
|
|
|
|
HFR_SERVER_NONCE_NOT_UNIQUE = 10,
|
|
|
|
HFR_SERVER_NONCE_INVALID_TIME = 11,
|
|
|
|
HFR_SERVER_NONCE_REQUIRED = 20,
|
|
|
|
|
|
|
|
HFR_CONFIG_INCHOATE_HELLO = 12, /* Missing SCID tag */
|
|
|
|
HFR_CONFIG_UNKNOWN_CONFIG = 13, /* Could not find server config SCID */
|
|
|
|
HFR_SRC_ADDR_TOKEN_INVALID = 14, /* Missing STK tag */
|
|
|
|
HFR_SRC_ADDR_TOKEN_DECRYPTION = 15,
|
|
|
|
HFR_SRC_ADDR_TOKEN_PARSE = 16,
|
|
|
|
HFR_SRC_ADDR_TOKEN_DIFFERENT_IP_ADDRESS = 17,
|
|
|
|
HFR_SRC_ADDR_TOKEN_CLOCK_SKEW = 18,
|
|
|
|
HFR_SRC_ADDR_TOKEN_EXPIRED = 19,
|
|
|
|
HFR_INVALID_EXPECTED_LEAF_CERTIFICATE = 21,
|
2017-10-09 11:52:09 +00:00
|
|
|
};
|
2017-09-22 21:00:03 +00:00
|
|
|
|
2019-02-25 14:12:20 +00:00
|
|
|
enum lsquic_version
|
2020-07-06 21:35:21 +00:00
|
|
|
lsquic_sess_resume_version (const unsigned char *, size_t);
|
2019-02-25 14:12:20 +00:00
|
|
|
|
2020-10-01 12:53:35 +00:00
|
|
|
int
|
|
|
|
lsquic_init_gquic_crypto (struct lsquic_engine_public *enpub);
|
|
|
|
|
|
|
|
void
|
|
|
|
lsquic_cleanup_gquic_crypto (struct lsquic_engine_public *enpub);
|
|
|
|
|
2017-09-22 21:00:03 +00:00
|
|
|
#endif
|