Mercurial > hg > nginx

annotate src/event/ngx_event_quic.c @ 8207:cc8d211cb45c quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Initial parsing of STREAM frames.
author Vladimir Homutov <vl@nginx.com>
date Wed, 11 Mar 2020 15:41:35 +0300
parents 8d6ac639feac
children 4ae9ac69ab93
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2 /*
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
3 * Copyright (C) Nginx, Inc.
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
4 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
5
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
6
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7 #include <ngx_config.h>
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 #include <ngx_core.h>
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
9
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
10
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
11 #define quic_version 0xff000018
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
13 #define NGX_AES_128_GCM_SHA256 0x1301
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
14 #define NGX_AES_256_GCM_SHA384 0x1302
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
15 #define NGX_CHACHA20_POLY1305_SHA256 0x1303
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
16
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
17 #define NGX_QUIC_IV_LEN 12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
18
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
19 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
20 #define ngx_quic_cipher_t EVP_AEAD
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
21 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
22 #define ngx_quic_cipher_t EVP_CIPHER
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
23 #endif
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
24
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
25
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
26 #if (NGX_HAVE_NONALIGNED)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
27
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
28 #define ngx_quic_parse_uint16(p) ntohs(*(uint16_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
29 #define ngx_quic_parse_uint32(p) ntohl(*(uint32_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
30
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
31 #define ngx_quic_write_uint16 ngx_quic_write_uint16_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
32 #define ngx_quic_write_uint32 ngx_quic_write_uint32_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
33
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
34 #else
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
35
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
36 #define ngx_quic_parse_uint16(p) ((p)[0] << 8 | (p)[1])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
37 #define ngx_quic_parse_uint32(p) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
38 ((uint32_t) (p)[0] << 24 | (p)[1] << 16 | (p)[2] << 8 | (p)[3])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
39
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
40 #define ngx_quic_write_uint16(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
41 ((p)[0] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
42 (p)[1] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
43 (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
44
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
45 #define ngx_quic_write_uint32(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
46 ((p)[0] = (u_char) ((s) >> 24), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
47 (p)[1] = (u_char) ((s) >> 16), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
48 (p)[2] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
49 (p)[3] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
50 (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
51
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
52 #endif
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
53
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
54
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
55 #define ngx_quic_write_uint16_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
56 (*(uint16_t *) (p) = htons((uint16_t) (s)), (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
57
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
58 #define ngx_quic_write_uint32_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
59 (*(uint32_t *) (p) = htonl((uint32_t) (s)), (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
60
8191
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
61 #define ngx_quic_varint_len(value) \
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
62 ((value) <= 63 ? 1 : (value) <= 16383 ? 2 : (value) <= 1073741823 ? 4 : 8)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
63
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
64
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
65 #if (NGX_DEBUG)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
66
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
67 #define ngx_quic_hexdump(log, fmt, data, len, ...) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
68 do { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
69 ngx_int_t m; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
70 u_char buf[2048]; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
71 \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
72 if (log->log_level & NGX_LOG_DEBUG_EVENT) { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
73 m = ngx_hex_dump(buf, (u_char *) data, ngx_min(len, 1024)) - buf; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
74 ngx_log_debug(NGX_LOG_DEBUG_EVENT, log, 0, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
75 "%s: " fmt " %*s%s, len: %uz", \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
76 __FUNCTION__, __VA_ARGS__, m, buf, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
77 len < 2048 ? "" : "...", len); \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
78 } \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
79 } while (0)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
80
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
81 #else
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
82
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
83 #define ngx_quic_hexdump(log, fmt, data, len, ...)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
84
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
85 #endif
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
86
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
87 #define ngx_quic_hexdump0(log, fmt, data, len) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
88 ngx_quic_hexdump(log, fmt "%s", data, len, "") \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
89
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
90
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
91 /* 17.2. Long Header Packets */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
92
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
93 #define NGX_QUIC_PKT_LONG 0x80
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
94
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
95 #define NGX_QUIC_PKT_INITIAL 0xc0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
96 #define NGX_QUIC_PKT_HANDSHAKE 0xe0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
97
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
98 /* 12.4. Frames and Frame Types */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
99 #define NGX_QUIC_FT_PADDING 0x00
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
100 #define NGX_QUIC_FT_PING 0x01
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
101 #define NGX_QUIC_FT_ACK 0x02
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
102 #define NGX_QUIC_FT_ACK_ECN 0x03
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
103 #define NGX_QUIC_FT_RESET_STREAM 0x04
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
104 #define NGX_QUIC_FT_STOP_SENDING 0x05
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
105 #define NGX_QUIC_FT_CRYPTO 0x06
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
106 #define NGX_QUIC_FT_NEW_TOKEN 0x07
8207
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
107 #define NGX_QUIC_FT_STREAM 0x08
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
108 #define NGX_QUIC_FT_STREAM1 0x09
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
109 #define NGX_QUIC_FT_STREAM2 0x0A
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
110 #define NGX_QUIC_FT_STREAM3 0x0B
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
111 #define NGX_QUIC_FT_STREAM4 0x0C
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
112 #define NGX_QUIC_FT_STREAM5 0x0D
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
113 #define NGX_QUIC_FT_STREAM6 0x0E
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
114 #define NGX_QUIC_FT_STREAM7 0x0F
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
115 #define NGX_QUIC_FT_MAX_DATA 0x10
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
116 #define NGX_QUIC_FT_MAX_STREAM_DATA 0x11
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
117 #define NGX_QUIC_FT_MAX_STREAMS 0x12
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
118 #define NGX_QUIC_FT_MAX_STREAMS2 0x13 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
119 #define NGX_QUIC_FT_DATA_BLOCKED 0x14
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
120 #define NGX_QUIC_FT_STREAM_DATA_BLOCKED 0x15
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
121 #define NGX_QUIC_FT_STREAMS_BLOCKED 0x16
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
122 #define NGX_QUIC_FT_STREAMS_BLOCKED2 0x17 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
123 #define NGX_QUIC_FT_NEW_CONNECTION_ID 0x18
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
124 #define NGX_QUIC_FT_RETIRE_CONNECTION_ID 0x19
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
125 #define NGX_QUIC_FT_PATH_CHALLENGE 0x1a
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
126 #define NGX_QUIC_FT_PATH_RESPONSE 0x1b
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
127 #define NGX_QUIC_FT_CONNECTION_CLOSE 0x1c
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
128 #define NGX_QUIC_FT_CONNECTION_CLOSE2 0x1d // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
129 #define NGX_QUIC_FT_HANDSHAKE_DONE 0x1e
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
130
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
131
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
132 /* TODO: real states, these are stubs */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
133 typedef enum {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
134 NGX_QUIC_ST_INITIAL,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
135 NGX_QUIC_ST_HANDSHAKE,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
136 NGX_QUIC_ST_APP_DATA
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
137 } ngx_quic_state_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
138
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
139
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
140 typedef struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
141 ngx_str_t secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
142 ngx_str_t key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
143 ngx_str_t iv;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
144 ngx_str_t hp;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
145 } ngx_quic_secret_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
146
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
147 typedef struct {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
148 const ngx_quic_cipher_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
149 const EVP_CIPHER *hp;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
150 const EVP_MD *d;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
151 } ngx_quic_ciphers_t;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
152
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
153 typedef enum ssl_encryption_level_t ngx_quic_level_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
154
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
155 typedef struct ngx_quic_frame_s ngx_quic_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
156
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
157 typedef struct {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
158 ngx_uint_t pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
159
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
160 // input
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
161 uint64_t largest;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
162 uint64_t delay;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
163 uint64_t range_count;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
164 uint64_t first_range;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
165 uint64_t ranges[20];
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
166 /* ecn counts */
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
167 } ngx_quic_ack_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
168
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
169 typedef struct {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
170 size_t offset;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
171 size_t len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
172 u_char *data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
173 } ngx_quic_crypto_frame_t;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
174
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
175
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
176 typedef struct {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
177 uint64_t seqnum;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
178 uint64_t retire;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
179 uint64_t len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
180 u_char cid[20];
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
181 u_char srt[16];
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
182 } ngx_quic_ncid_t;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
183
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
184
8207
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
185 typedef struct {
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
186 uint64_t stream_id;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
187 uint64_t offset;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
188 uint64_t length;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
189 u_char *data;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
190 } ngx_quic_stream_frame_t;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
191
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
192
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
193 struct ngx_quic_frame_s {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
194 ngx_uint_t type;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
195 ngx_quic_level_t level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
196 ngx_quic_frame_t *next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
197 union {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
198 ngx_quic_crypto_frame_t crypto;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
199 ngx_quic_ack_frame_t ack;
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
200 ngx_quic_ncid_t ncid;
8207
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
201 ngx_quic_stream_frame_t stream;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
202 // more frames
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
203 } u;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
204
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
205 u_char info[128]; // for debug purposes
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
206 };
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
207
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
208
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
209 struct ngx_quic_connection_s {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
210
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
211 ngx_quic_state_t state;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
212 ngx_ssl_t *ssl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
213
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
214 ngx_quic_frame_t *frames;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
215
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
216 ngx_str_t scid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
217 ngx_str_t dcid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
218 ngx_str_t token;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
219
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
220 /* current packet numbers for each namespace */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
221 ngx_uint_t initial_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
222 ngx_uint_t handshake_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
223 ngx_uint_t appdata_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
224
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
225 ngx_quic_secret_t client_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
226 ngx_quic_secret_t client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
227 ngx_quic_secret_t client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
228 ngx_quic_secret_t server_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
229 ngx_quic_secret_t server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
230 ngx_quic_secret_t server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
231 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
232
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
233
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
234 typedef struct {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
235 ngx_quic_secret_t *secret;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
236 ngx_uint_t type;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
237 ngx_uint_t *number;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
238 ngx_uint_t flags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
239 uint32_t version;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
240 ngx_str_t token;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
241 ngx_quic_level_t level;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
242
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
243 /* filled in by parser */
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
244 ngx_buf_t *raw; /* udp datagram from wire */
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
245
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
246 u_char *data; /* quic packet */
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
247 size_t len;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
248
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
249 /* cleartext fields */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
250 ngx_str_t dcid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
251 ngx_str_t scid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
252
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
253 uint64_t pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
254
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
255 ngx_str_t payload; /* decrypted payload */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
256
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
257 } ngx_quic_header_t;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
258
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
259
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
260 static ngx_int_t ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl,
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
261 ngx_quic_header_t *pkt);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
262
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
263 static ngx_int_t ngx_quic_handshake_input(ngx_connection_t *c,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
264 ngx_quic_header_t *pkt);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
265 static ngx_int_t ngx_quic_app_input(ngx_connection_t *c,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
266 ngx_quic_header_t *pkt);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
267
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
268
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
269 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
270 static int ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
271 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
272 const uint8_t *secret, size_t secret_len);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
273 static int ngx_quic_set_write_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
274 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
275 const uint8_t *secret, size_t secret_len);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
276 #else
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
277 static int ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
278 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
279 const uint8_t *write_secret, size_t secret_len);
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
280 #endif
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
281 static int ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
282 enum ssl_encryption_level_t level, const uint8_t *data, size_t len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
283 static ngx_int_t ngx_quic_create_long_packet(ngx_connection_t *c,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
284 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
285 ngx_str_t *res);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
286 static ngx_int_t ngx_quic_create_short_packet(ngx_connection_t *c,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
287 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
288 ngx_str_t *res);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
289 static int ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
290 static int ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
291 enum ssl_encryption_level_t level, uint8_t alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
292
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
293 static ngx_int_t ngx_quic_process_long_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
294 ngx_quic_header_t *pkt);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
295 static ngx_int_t ngx_quic_process_short_header(ngx_connection_t *c,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
296 ngx_quic_header_t *pkt);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
297 static ngx_int_t ngx_quic_process_initial_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
298 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
299 static ngx_int_t ngx_quic_process_handshake_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
300 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
301 static ngx_int_t ngx_quic_initial_secret(ngx_connection_t *c);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
302 static ngx_int_t ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
303
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
304 static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
305 static uint64_t ngx_quic_parse_int(u_char **pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
306 static void ngx_quic_build_int(u_char **pos, uint64_t value);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
307
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
308 static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
309 const EVP_MD *digest, const u_char *secret, size_t secret_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
310 const u_char *salt, size_t salt_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
311 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
312 const EVP_MD *digest, const u_char *prk, size_t prk_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
313 const u_char *info, size_t info_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
314
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
315 static ngx_int_t ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
316 ngx_str_t *out, ngx_str_t *label, const uint8_t *prk, size_t prk_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
317
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
318 static ngx_int_t ngx_quic_tls_open(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
319 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
320 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
321 static ngx_int_t ngx_quic_tls_seal(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
322 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
323 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
324
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
325 static ngx_int_t ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
326 ngx_quic_secret_t *s, u_char *out, u_char *in);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
327
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
328 static ngx_int_t ngx_quic_ciphers(ngx_connection_t *c,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
329 ngx_quic_ciphers_t *ciphers, enum ssl_encryption_level_t level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
330
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
331 static SSL_QUIC_METHOD quic_method = {
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
332 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
333 ngx_quic_set_read_secret,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
334 ngx_quic_set_write_secret,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
335 #else
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
336 ngx_quic_set_encryption_secrets,
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
337 #endif
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
338 ngx_quic_add_handshake_data,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
339 ngx_quic_flush_flight,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
340 ngx_quic_send_alert,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
341 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
342
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
343
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
344 void
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
345 ngx_quic_init_ssl_methods(SSL_CTX* ctx)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
346 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
347 SSL_CTX_set_quic_method(ctx, &quic_method);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
348 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
349
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
350
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
351 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
352 ngx_quic_input(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
353 {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
354 u_char *p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
355 ngx_quic_header_t pkt;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
356
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
357 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
358
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
359 pkt.raw = b;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
360 pkt.data = b->start;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
361 pkt.len = b->last - b->start;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
362
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
363 if (c->quic == NULL) {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
364 return ngx_quic_new_connection(c, ssl, &pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
365 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
366
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
367 p = b->start;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
368
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
369 do {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
370 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
371 pkt.raw = b;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
372 pkt.data = p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
373 pkt.len = b->last - p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
374
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
375 if (p[0] & NGX_QUIC_PKT_LONG) {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
376 // TODO: check current state
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
377 if (ngx_quic_handshake_input(c, &pkt) != NGX_OK) {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
378 return NGX_ERROR;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
379 }
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
380 } else {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
381
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
382 if (ngx_quic_app_input(c, &pkt) != NGX_OK) {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
383 return NGX_ERROR;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
384 }
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
385 }
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
386
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
387 /* b->pos is at header end, adjust by actual packet length */
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
388 p = b->pos + pkt.len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
389 b->pos = p; /* reset b->pos to the next packet start */
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
390
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
391 } while (p < b->last);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
392
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
393 return NGX_OK;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
394 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
395
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
396 static ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
397 ngx_quic_send_packet(ngx_connection_t *c, ngx_quic_connection_t *qc,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
398 ngx_quic_level_t level, ngx_str_t *payload)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
399 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
400 ngx_str_t res;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
401 ngx_quic_header_t pkt;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
402
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
403 static ngx_str_t initial_token = ngx_null_string;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
404
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
405 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
406 ngx_quic_hexdump0(c->log, "payload", payload->data, payload->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
407
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
408 pkt.level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
409
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
410 if (level == ssl_encryption_initial) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
411 pkt.number = &qc->initial_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
412 pkt.flags = NGX_QUIC_PKT_INITIAL;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
413 pkt.secret = &qc->server_in;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
414 pkt.token = initial_token;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
415
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
416 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
417 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
418 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
419 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
420 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
421 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
422
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
423 } else if (level == ssl_encryption_handshake) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
424 pkt.number = &qc->handshake_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
425 pkt.flags = NGX_QUIC_PKT_HANDSHAKE;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
426 pkt.secret = &qc->server_hs;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
427
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
428 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
429 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
430 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
431 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
432 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
433 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
434
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
435 } else {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
436 pkt.number = &qc->appdata_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
437 pkt.secret = &qc->server_ad;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
438
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
439 if (ngx_quic_create_short_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
440 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
441 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
442 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
443 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
444 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
445 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
446
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
447 ngx_quic_hexdump0(c->log, "packet to send", res.data, res.len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
448
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
449 c->send(c, res.data, res.len); // TODO: err handling
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
450
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
451 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
452 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
453
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
454
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
455 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
456 ngx_quic_create_ack(u_char *p, ngx_quic_ack_frame_t *ack)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
457 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
458 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
459 return 5; /* minimal ACK */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
460 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
461
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
462 ngx_quic_build_int(&p, NGX_QUIC_FT_ACK);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
463 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
464 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
465 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
466 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
467
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
468 return 5;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
469 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
470
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
471
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
472 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
473 ngx_quic_create_crypto(u_char *p, ngx_quic_crypto_frame_t *crypto)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
474 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
475 u_char *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
476
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
477 if (p == NULL) {
8192
fb0879c65650 Fixed ngx_quic_varint_len misuse in the previous change.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8191
diff changeset
478 return 2 + ngx_quic_varint_len(crypto->len) + crypto->len;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
479 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
480
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
481 start = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
482
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
483 ngx_quic_build_int(&p, NGX_QUIC_FT_CRYPTO);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
484 ngx_quic_build_int(&p, crypto->offset);
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
485 ngx_quic_build_int(&p, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
486 p = ngx_cpymem(p, crypto->data, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
487
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
488 return p - start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
489 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
490
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
491 size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
492 ngx_quic_frame_len(ngx_quic_frame_t *frame)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
493 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
494 switch (frame->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
495 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
496 return ngx_quic_create_ack(NULL, &frame->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
497 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
498 return ngx_quic_create_crypto(NULL, &frame->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
499 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
500 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
501 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
502 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
503 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
504
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
505
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
506 /* pack a group of frames [start; end) into memory p and send as single packet */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
507 ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
508 ngx_quic_frames_send(ngx_connection_t *c, ngx_quic_frame_t *start,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
509 ngx_quic_frame_t *end, size_t total)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
510 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
511 u_char *p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
512 ngx_str_t out;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
513 ngx_quic_frame_t *f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
514
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
515 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
516 "sending frames %p...%p", start, end);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
517
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
518 p = ngx_pnalloc(c->pool, total);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
519 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
520 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
521 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
522
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
523 out.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
524
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
525 for (f = start; f != end; f = f->next) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
526
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
527 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "frame: %s", f->info);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
528
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
529 switch (f->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
530 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
531 p += ngx_quic_create_ack(p, &f->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
532 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
533
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
534 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
535 p += ngx_quic_create_crypto(p, &f->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
536 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
537
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
538 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
539 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
540 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
541 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
542 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
543
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
544 out.len = p - out.data;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
545
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
546 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
547 "packet ready: %ui bytes at level %d",
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
548 out.len, start->level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
549
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
550 // IOVEC/sendmsg_chain ?
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
551 if (ngx_quic_send_packet(c, c->quic, start->level, &out) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
552 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
553 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
554
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
555 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
556 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
557
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
558
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
559 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
560 ngx_quic_output(ngx_connection_t *c)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
561 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
562 size_t len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
563 ngx_uint_t lvl;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
564 ngx_quic_frame_t *f, *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
565 ngx_quic_connection_t *qc;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
566
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
567 qc = c->quic;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
568
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
569 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
570 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
571 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
572
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
573 lvl = qc->frames->level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
574 start = qc->frames;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
575 f = start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
576
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
577 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
578 len = 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
579
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
580 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
581 /* process same-level group of frames */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
582
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
583 len += ngx_quic_frame_len(f);// TODO: handle overflow, max size
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
584
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
585 f = f->next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
586 } while (f && f->level == lvl);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
587
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
588
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
589 if (ngx_quic_frames_send(c, start, f, len) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
590 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
591 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
592
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
593 if (f == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
594 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
595 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
596
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
597 lvl = f->level; // TODO: must not decrease (ever, also between calls)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
598 start = f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
599
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
600 } while (1);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
601
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
602 qc->frames = NULL;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
603
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
604 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
605 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
606
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
607
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
608 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
609
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
610 static int
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
611 ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
612 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
613 const uint8_t *secret, size_t secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
614 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
615 ngx_int_t key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
616 ngx_uint_t i;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
617 ngx_connection_t *c;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
618 ngx_quic_secret_t *client;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
619 ngx_quic_ciphers_t ciphers;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
620
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
621 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
622
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
623 ngx_quic_hexdump(c->log, "level:%d read", secret, secret_len, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
624
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
625 key_len = ngx_quic_ciphers(c, &ciphers, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
626
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
627 if (key_len == NGX_ERROR) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
628 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
629 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
630 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
631
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
632 switch (level) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
633
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
634 case ssl_encryption_handshake:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
635 client = &c->quic->client_hs;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
636 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
637
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
638 case ssl_encryption_application:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
639 client = &c->quic->client_ad;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
640 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
641
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
642 default:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
643 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
644 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
645
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
646 client->key.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
647 client->iv.len = NGX_QUIC_IV_LEN;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
648 client->hp.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
649
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
650 struct {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
651 ngx_str_t label;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
652 ngx_str_t *key;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
653 const uint8_t *secret;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
654 } seq[] = {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
655 { ngx_string("tls13 quic key"), &client->key, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
656 { ngx_string("tls13 quic iv"), &client->iv, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
657 { ngx_string("tls13 quic hp"), &client->hp, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
658 };
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
659
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
660 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
661
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
662 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
663 seq[i].secret, secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
664 != NGX_OK)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
665 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
666 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
667 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
668 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
669
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
670 return 1;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
671 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
672
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
673
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
674 static int
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
675 ngx_quic_set_write_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
676 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
677 const uint8_t *secret, size_t secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
678 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
679 ngx_int_t key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
680 ngx_uint_t i;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
681 ngx_connection_t *c;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
682 ngx_quic_secret_t *server;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
683 ngx_quic_ciphers_t ciphers;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
684
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
685 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
686
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
687 ngx_quic_hexdump(c->log, "level:%d write", secret, secret_len, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
688
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
689 key_len = ngx_quic_ciphers(c, &ciphers, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
690
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
691 if (key_len == NGX_ERROR) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
692 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
693 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
694 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
695
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
696 switch (level) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
697
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
698 case ssl_encryption_handshake:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
699 server = &c->quic->server_hs;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
700 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
701
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
702 case ssl_encryption_application:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
703 server = &c->quic->server_ad;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
704 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
705
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
706 default:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
707 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
708 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
709
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
710 server->key.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
711 server->iv.len = NGX_QUIC_IV_LEN;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
712 server->hp.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
713
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
714 struct {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
715 ngx_str_t label;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
716 ngx_str_t *key;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
717 const uint8_t *secret;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
718 } seq[] = {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
719 { ngx_string("tls13 quic key"), &server->key, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
720 { ngx_string("tls13 quic iv"), &server->iv, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
721 { ngx_string("tls13 quic hp"), &server->hp, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
722 };
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
723
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
724 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
725
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
726 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
727 seq[i].secret, secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
728 != NGX_OK)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
729 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
730 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
731 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
732 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
733
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
734 return 1;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
735 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
736
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
737 #else
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
738
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
739 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
740 ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
741 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
742 const uint8_t *write_secret, size_t secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
743 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
744 ngx_int_t key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
745 ngx_uint_t i;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
746 ngx_connection_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
747 ngx_quic_secret_t *client, *server;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
748 ngx_quic_ciphers_t ciphers;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
749
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
750 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
751
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
752 ngx_quic_hexdump(c->log, "level:%d read", read_secret, secret_len, level);
8196
d447168ed13f Fixed write secret logging in set_encryption_secrets callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8195
diff changeset
753 ngx_quic_hexdump(c->log, "level:%d write", write_secret, secret_len, level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
754
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
755 key_len = ngx_quic_ciphers(c, &ciphers, level);
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
756
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
757 if (key_len == NGX_ERROR) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
758 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
759 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
760 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
761
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
762 switch (level) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
763
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
764 case ssl_encryption_handshake:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
765 client = &c->quic->client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
766 server = &c->quic->server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
767
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
768 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
769
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
770 case ssl_encryption_application:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
771 client = &c->quic->client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
772 server = &c->quic->server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
773
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
774 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
775
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
776 default:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
777 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
778 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
779
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
780 client->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
781 server->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
782
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
783 client->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
784 server->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
785
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
786 client->hp.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
787 server->hp.len = key_len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
788
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
789 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
790 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
791 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
792 const uint8_t *secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
793 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
794 { ngx_string("tls13 quic key"), &client->key, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
795 { ngx_string("tls13 quic iv"), &client->iv, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
796 { ngx_string("tls13 quic hp"), &client->hp, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
797 { ngx_string("tls13 quic key"), &server->key, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
798 { ngx_string("tls13 quic iv"), &server->iv, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
799 { ngx_string("tls13 quic hp"), &server->hp, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
800 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
801
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
802 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
803
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
804 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
805 seq[i].secret, secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
806 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
807 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
808 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
809 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
810 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
811
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
812 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
813 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
814
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
815 #endif
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
816
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
817
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
818 static ngx_int_t
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
819 ngx_quic_create_long_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
820 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
821 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
822 u_char *p, *pnp, *nonce, *sample, *packet;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
823 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
824 ngx_quic_ciphers_t ciphers;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
825 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
826 u_char mask[16];
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
827
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
828 qc = c->quic;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
829
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
830 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
831
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
832 ad.data = ngx_alloc(346 /*max header*/, c->log);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
833 if (ad.data == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
834 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
835 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
836
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
837 p = ad.data;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
838
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
839 *p++ = pkt->flags;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
840
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
841 p = ngx_quic_write_uint32(p, quic_version);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
842
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
843 *p++ = qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
844 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
845
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
846 *p++ = qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
847 p = ngx_cpymem(p, qc->dcid.data, qc->dcid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
848
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
849 if (pkt->level == ssl_encryption_initial) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
850 ngx_quic_build_int(&p, pkt->token.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
851 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
852
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
853 ngx_quic_build_int(&p, out.len + 1); // length (inc. pnl)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
854 pnp = p;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
855
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
856 *p++ = (*pkt->number)++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
857
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
858 ad.len = p - ad.data;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
859
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
860 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
861
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
862 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
863 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
864 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
865
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
866 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
867 if (pkt->level == ssl_encryption_handshake) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
868 nonce[11] ^= (*pkt->number - 1);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
869 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
870
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
871 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
872 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
873
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
874 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
875 != NGX_OK)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
876 {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
877 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
878 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
879
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
880 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
881 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
882 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
883 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
884
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
885 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
886 ngx_quic_hexdump0(c->log, "mask", mask, 16);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
887 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
888
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
889 // header protection, pnl = 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
890 ad.data[0] ^= mask[0] & 0x0f;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
891 *pnp ^= mask[1];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
892
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
893 packet = ngx_alloc(ad.len + out.len, c->log);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
894 if (packet == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
895 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
896 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
897
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
898 p = ngx_cpymem(packet, ad.data, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
899 p = ngx_cpymem(p, out.data, out.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
900
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
901 res->data = packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
902 res->len = p - packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
903
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
904 return NGX_OK;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
905 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
906
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
907
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
908 static ngx_int_t
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
909 ngx_quic_create_short_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
910 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
911 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
912 u_char *p, *pnp, *nonce, *sample, *packet;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
913 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
914 ngx_quic_ciphers_t ciphers;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
915 ngx_quic_connection_t *qc;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
916 u_char mask[16];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
917
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
918 qc = c->quic;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
919
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
920 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
921
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
922 ad.data = ngx_alloc(25 /*max header*/, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
923 if (ad.data == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
924 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
925 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
926
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
927 p = ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
928
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
929 *p++ = 0x40;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
930
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
931 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
932
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
933 pnp = p;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
934
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
935 *p++ = (*pkt->number)++;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
936
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
937 ad.len = p - ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
938
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
939 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
940
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
941 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
942 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
943 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
944
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
945 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8200
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
946 if (pkt->level == ssl_encryption_handshake
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
947 || pkt->level == ssl_encryption_application)
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
948 {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
949 nonce[11] ^= (*pkt->number - 1);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
950 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
951
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
952 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
953 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
954
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
955 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
956 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
957 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
958 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
959 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
960
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
961 ngx_quic_hexdump0(c->log, "out", out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
962
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
963 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
964 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
965 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
966 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
967
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
968 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
969 ngx_quic_hexdump0(c->log, "mask", mask, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
970 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
971
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
972 // header protection, pnl = 0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
973 ad.data[0] ^= mask[0] & 0x1f;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
974 *pnp ^= mask[1];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
975
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
976 packet = ngx_alloc(ad.len + out.len, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
977 if (packet == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
978 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
979 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
980
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
981 p = ngx_cpymem(packet, ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
982 p = ngx_cpymem(p, out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
983
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
984 ngx_quic_hexdump0(c->log, "packet", packet, p - packet);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
985
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
986 res->data = packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
987 res->len = p - packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
988
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
989 return NGX_OK;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
990 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
991
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
992
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
993 static void
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
994 ngx_quic_queue_frame(ngx_quic_connection_t *qc, ngx_quic_frame_t *frame)
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
995 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
996 ngx_quic_frame_t *f;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
997
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
998 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
999 qc->frames = frame;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1000 return;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1001 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1002
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1003 for (f = qc->frames; f->next; f = f->next) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1004 if (f->next->level > frame->level) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1005 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1006 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1007 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1008
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1009 frame->next = f->next;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1010 f->next = frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1011 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1012
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1013
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1014 static int
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1015 ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1016 enum ssl_encryption_level_t level, const uint8_t *data, size_t len)
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1017 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1018 u_char *p;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1019 ngx_quic_frame_t *frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1020 ngx_connection_t *c;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1021 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1022
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1023 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1024 qc = c->quic;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1025
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1026 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1027 "ngx_quic_add_handshake_data");
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1028
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1029 frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1030 if (frame == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1031 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1032 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1033
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1034 p = ngx_pnalloc(c->pool, len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1035 if (p == NULL) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1036 return 0;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1037 }
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1038
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1039 ngx_memcpy(p, data, len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1040
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1041 frame->level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1042 frame->type = NGX_QUIC_FT_CRYPTO;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1043 frame->u.crypto.len = len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1044 frame->u.crypto.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1045
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1046 ngx_sprintf(frame->info, "crypto, generated by SSL len=%ui level=%d", len, level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1047
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
1048 ngx_quic_queue_frame(qc, frame);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1049
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1050 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1051 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1052
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1053
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1054 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1055 ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1056 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1057 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1058
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1059 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1060
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1061 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_quic_flush_flight()");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1062
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1063 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1064 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1065
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1066
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1067 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1068 ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1069 uint8_t alert)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1070 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1071 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1072
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1073 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1074
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1075 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1076 "ngx_quic_send_alert(), lvl=%d, alert=%d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1077 (int) level, (int) alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1078
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1079 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1080 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1081
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1082
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1083 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1084 ngx_quic_process_short_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1085 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1086 u_char *p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1087
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1088 p = pkt->data;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1089
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1090 ngx_quic_hexdump0(c->log, "short input", pkt->data, pkt->len);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1091
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1092 if ((p[0] & NGX_QUIC_PKT_LONG)) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1093 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a short packet");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1094 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1095 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1096
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1097 pkt->flags = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1098
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1099 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1100 "quic flags:%xi", pkt->flags);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1101
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1102 if (ngx_memcmp(p, c->quic->dcid.data, c->quic->dcid.len) != 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1103 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1104 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1105 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1106
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1107 pkt->dcid.len = c->quic->dcid.len;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1108 pkt->dcid.data = p;
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1109 p += pkt->dcid.len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1110
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1111 pkt->raw->pos = p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1112
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1113 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1114 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1115
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1116
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1117 static ngx_int_t
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1118 ngx_quic_process_long_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1119 {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1120 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1121
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1122 p = pkt->data;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1123
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1124 ngx_quic_hexdump0(c->log, "long input", pkt->data, pkt->len);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1125
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1126 if (!(p[0] & NGX_QUIC_PKT_LONG)) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1127 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a long packet");
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1128 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1129 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1130
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1131 pkt->flags = *p++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1132
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1133 pkt->version = ngx_quic_parse_uint32(p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1134 p += sizeof(uint32_t);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1135
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1136 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1137 "quic flags:%xi version:%xD", pkt->flags, pkt->version);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1138
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1139 if (pkt->version != quic_version) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1140 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unsupported quic version");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1141 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1142 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1143
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1144 pkt->dcid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1145 pkt->dcid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1146 p += pkt->dcid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1147
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1148 pkt->scid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1149 pkt->scid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1150 p += pkt->scid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1151
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1152 pkt->raw->pos = p;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1153
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1154 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1155 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1156
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1157
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1158 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1159 ngx_quic_process_initial_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1160 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1161 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1162 ngx_int_t plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1163
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1164 p = pkt->raw->pos;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1165
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1166 pkt->token.len = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1167 pkt->token.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1168
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1169 p += pkt->token.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1170
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1171 plen = ngx_quic_parse_int(&p);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1172
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1173 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1174 "quic packet length: %d", plen);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1175
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1176 if (plen > pkt->data + pkt->len - p) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1177 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1178 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1179 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1180
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1181 pkt->raw->pos = p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1182 pkt->len = plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1183
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1184 ngx_quic_hexdump0(c->log, "DCID", pkt->dcid.data, pkt->dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1185 ngx_quic_hexdump0(c->log, "SCID", pkt->scid.data, pkt->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1186 ngx_quic_hexdump0(c->log, "token", pkt->token.data, pkt->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1187
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1188 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1189 "quic packet length: %d", plen);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1190
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1191 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1192 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1194 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1195 ngx_quic_process_handshake_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1196 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1197 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1198 ngx_int_t plen;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1199
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1200 p = pkt->raw->pos;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1201
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1202 plen = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1203
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1204 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1205 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1206
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1207 if (plen > pkt->data + pkt->len - p) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1208 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated handshake packet");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1209 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1210 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1211
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1212 pkt->raw->pos = p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1213 pkt->len = plen;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1214
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1215 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1216 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1217
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1218 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1219 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1220
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1221
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1222 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1223 ngx_quic_initial_secret(ngx_connection_t *c)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1224 {
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1225 size_t is_len;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1226 uint8_t is[SHA256_DIGEST_LENGTH];
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1227 ngx_uint_t i;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1228 const EVP_MD *digest;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1229 const EVP_CIPHER *cipher;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1230 ngx_quic_connection_t *qc;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1231
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1232 static const uint8_t salt[20] =
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1233 "\xc3\xee\xf7\x12\xc7\x2e\xbb\x5a\x11\xa7"
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1234 "\xd2\x43\x2b\xb4\x63\x65\xbe\xf9\xf5\x02";
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1235
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1236 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1237
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1238 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1239 digest = EVP_sha256();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1240
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1241 qc = c->quic;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1242
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1243 if (ngx_hkdf_extract(is, &is_len, digest, qc->dcid.data, qc->dcid.len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1244 salt, sizeof(salt))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1245 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1246 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1247 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1248 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1249
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1250 ngx_str_t iss = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1251 .data = is,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1252 .len = is_len
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1253 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1254
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1255 ngx_quic_hexdump0(c->log, "salt", salt, sizeof(salt));
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1256 ngx_quic_hexdump0(c->log, "initial secret", is, is_len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1257
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1258 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1259 qc->client_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1260 qc->server_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1261
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1262 qc->client_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1263 qc->server_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1264
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1265 qc->client_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1266 qc->server_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1267
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1268 qc->client_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1269 qc->server_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1270
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1271 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1272 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1273 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1274 ngx_str_t *prk;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1275 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1276
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1277 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1278 { ngx_string("tls13 client in"), &qc->client_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1279 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1280 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1281 &qc->client_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1282 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1283 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1284 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1285 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1286 &qc->client_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1287 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1288 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1289 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1290 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1291 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1292 &qc->client_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1293 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1294 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1295 { ngx_string("tls13 server in"), &qc->server_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1296 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1297 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1298 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1299 &qc->server_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1300 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1301 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1302 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1303 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1304 &qc->server_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1305 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1306 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1307 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1308 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1309 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1310 &qc->server_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1311 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1312 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1313
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1314 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1315
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1316 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1317
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1318 if (ngx_quic_hkdf_expand(c, digest, seq[i].key, &seq[i].label,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1319 seq[i].prk->data, seq[i].prk->len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1320 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1321 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1322 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1323 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1324 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1325
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1326 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1327 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1328
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1329
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1330 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1331 ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1332 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1333 u_char clearflags, *p, *sample;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1334 uint8_t *nonce;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1335 uint64_t pn;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1336 ngx_int_t pnl, rc;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1337 ngx_str_t in, ad;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1338 ngx_quic_ciphers_t ciphers;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1339 uint8_t mask[16];
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1340
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1341 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1342 return NGX_ERROR;
8198
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1343 }
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1344
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1345 p = pkt->raw->pos;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1346
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1347 /* draft-ietf-quic-tls-23#section-5.4.2:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1348 * the Packet Number field is assumed to be 4 bytes long
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1349 * draft-ietf-quic-tls-23#section-5.4.[34]:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1350 * AES-Based and ChaCha20-Based header protections sample 16 bytes
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1351 */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1352
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1353 sample = p + 4;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1354
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1355 ngx_quic_hexdump0(c->log, "sample", sample, 16);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1356
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1357 /* header protection */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1358
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1359 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1360 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1361 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1362
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1363 if (pkt->flags & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1364 clearflags = pkt->flags ^ (mask[0] & 0x0f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1365
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1366 } else {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1367 clearflags = pkt->flags ^ (mask[0] & 0x1f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1368 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1369
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1370 pnl = (clearflags & 0x03) + 1;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1371 pn = ngx_quic_parse_pn(&p, pnl, &mask[1]);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1372
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1373 pkt->pn = pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1374
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1375 ngx_quic_hexdump0(c->log, "mask", mask, 5);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1376 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1377 "quic clear flags: %xi", clearflags);
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1378 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1379 "quic packet number: %uL, len: %xi", pn, pnl);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1380
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1381 /* packet protection */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1382
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1383 in.data = p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1384
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1385 if (pkt->flags & NGX_QUIC_PKT_LONG) {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1386 in.len = pkt->len - pnl;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1387
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1388 } else {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1389 in.len = pkt->data + pkt->len - p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1390 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1391
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1392 ad.len = p - pkt->data;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1393 ad.data = ngx_pnalloc(c->pool, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1394 if (ad.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1395 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1396 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1397
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1398 ngx_memcpy(ad.data, pkt->data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1399 ad.data[0] = clearflags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1400 ad.data[ad.len - pnl] = (u_char) pn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1401
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1402 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1403 nonce[11] ^= pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1404
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1405 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1406 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1407
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1408 rc = ngx_quic_tls_open(c, ciphers.c, pkt->secret, &pkt->payload,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1409 nonce, &in, &ad);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1410
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1411 ngx_quic_hexdump0(c->log, "packet payload",
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1412 pkt->payload.data, pkt->payload.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1413
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1414 return rc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1415 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1416
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1417
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1418 ssize_t
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1419 ngx_quic_read_frame(ngx_connection_t *c, u_char *start, u_char *end,
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1420 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1421 {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1422 u_char *p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1423
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1424 size_t npad;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1425
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1426 p = start;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1427
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1428 frame->type = *p++; // TODO: check overflow (p < end)
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1429
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1430 switch (frame->type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1431
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1432 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1433 frame->u.crypto.offset = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1434 frame->u.crypto.len = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1435 frame->u.crypto.data = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1436 p += frame->u.crypto.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1437
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1438 ngx_quic_hexdump0(c->log, "CRYPTO frame",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1439 frame->u.crypto.data, frame->u.crypto.len);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1440
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1441 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1442 "quic CRYPTO frame length: %uL off:%uL pp:%p",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1443 frame->u.crypto.len, frame->u.crypto.offset,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1444 frame->u.crypto.data);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1445 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1446
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1447 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1448 npad = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1449 while (p < end && *p == NGX_QUIC_FT_PADDING) { // XXX
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1450 p++; npad++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1451 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1452
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1453 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1454 "PADDING frame length %uL", npad);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1455
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1456 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1457
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1458 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1459 case NGX_QUIC_FT_ACK_ECN:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1460
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1461 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ACK frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1462
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1463 frame->u.ack.largest = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1464 frame->u.ack.delay = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1465 frame->u.ack.range_count =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1466 frame->u.ack.first_range =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1467
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1468 if (frame->u.ack.range_count) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1469 frame->u.ack.ranges[0] = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1470 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1471
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1472 if (frame->type ==NGX_QUIC_FT_ACK_ECN) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1473 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1474 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1475
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1476 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1477
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1478 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1479 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "PING frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1480 p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1481 break;
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1482
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1483 case NGX_QUIC_FT_NEW_CONNECTION_ID:
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1484 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "NCID frame");
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1485
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1486 frame->u.ncid.seqnum = ngx_quic_parse_int(&p);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1487 frame->u.ncid.retire = ngx_quic_parse_int(&p);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1488 frame->u.ncid.len = *p++;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1489 ngx_memcpy(frame->u.ncid.cid, p, frame->u.ncid.len);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1490 p += frame->u.ncid.len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1491
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1492 ngx_memcpy(frame->u.ncid.srt, p, 16);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1493 p += 16;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1494
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1495 break;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1496
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1497 case NGX_QUIC_FT_CONNECTION_CLOSE:
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1498 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "connection close frame => NGX_ERROR");
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1499
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1500 // TODO: parse connection close here
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1501 return NGX_ERROR;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1502 break;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1503
8207
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1504 case NGX_QUIC_FT_STREAM:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1505 case NGX_QUIC_FT_STREAM1:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1506 case NGX_QUIC_FT_STREAM2:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1507 case NGX_QUIC_FT_STREAM3:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1508 case NGX_QUIC_FT_STREAM4:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1509 case NGX_QUIC_FT_STREAM5:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1510 case NGX_QUIC_FT_STREAM6:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1511 case NGX_QUIC_FT_STREAM7:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1512
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1513 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1514 "STREAM frame, type: 0x%xi", frame->type);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1515
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1516 frame->u.stream.stream_id = ngx_quic_parse_int(&p);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1517 if (frame->type & 0x04) {
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1518 frame->u.stream.offset = ngx_quic_parse_int(&p);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1519 } else {
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1520 frame->u.stream.offset = 0;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1521 }
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1522
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1523 if (frame->type & 0x02) {
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1524 frame->u.stream.length = ngx_quic_parse_int(&p);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1525 } else {
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1526 frame->u.stream.length = end - p; /* up to packet end */
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1527 }
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1528
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1529 frame->u.stream.data = p;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1530
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1531 p += frame->u.stream.length;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1532
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1533 break;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1534
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1535 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1536 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1537 "unknown frame type %xi", frame->type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1538 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1539 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1540
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1541 return p - start;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1542 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1543
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1544
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1545 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1546 ngx_quic_handle_crypto_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1547 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1548 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1549 int sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1550 ssize_t n;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1551 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1552
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1553 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1554
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1555 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1556 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1557 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1558 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1559
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1560
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1561 if (!SSL_provide_quic_data(ssl_conn, SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1562 frame->u.crypto.data, frame->u.crypto.len))
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1563 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1564 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1565 "SSL_provide_quic_data() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1566 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1567 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1568
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1569 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1570
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1571 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1572
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1573 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1574 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1575
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1576 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1577 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1578
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1579 if (sslerr == SSL_ERROR_SSL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1580 ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1581 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1582 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1583
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1584 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1585 "quic ssl cipher: %s", SSL_get_cipher(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1586
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1587 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1588 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1589 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1590 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1591
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1592 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1593 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1594
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1595
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1596
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1597 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1598 ngx_quic_init_connection(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1599 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1600 int n, sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1601 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1602 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1603
8205
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1604 static const uint8_t params[] =
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1605 "\x00\x29" /* parameters length: 41 bytes */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1606 "\x00\x0e\x00\x01\x05" /* active connection id limit: 5 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1607 "\x00\x04\x00\x04\x80\x98\x96\x80" /* initial max data = 10000000 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1608 "\x00\x09\x00\x01\x03" /* initial max streams uni: 3 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1609 "\x00\x08\x00\x01\x10" /* initial max streams bidi: 16 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1610 "\x00\x05\x00\x02\x40\xff" /* initial max stream bidi local: 255 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1611 "\x00\x06\x00\x02\x40\xff" /* initial max stream bidi remote: 255 */
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1612 "\x00\x07\x00\x02\x40\xff"; /* initial max stream data uni: 255 */
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1613
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1614 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1615
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1616 if (ngx_ssl_create_connection(qc->ssl, c, NGX_SSL_BUFFER) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1617 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1618 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1619
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1620 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1621
8205
a5423632d67b Added more transport parameters.
Vladimir Homutov <vl@nginx.com>
parents: 8204
diff changeset
1622 if (SSL_set_quic_transport_params(ssl_conn, params, sizeof(params) - 1) == 0) {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1623 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1624 "SSL_set_quic_transport_params() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1625 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1626 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1627
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1628 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1629
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1630 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1631
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1632 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1633 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1634
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1635 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1636 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1637 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1638
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1639 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1640 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1641 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1642 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1643
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1644 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1645 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1646
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1647
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1648 /* process all payload from the current packet and generate ack if required */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1649 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1650 ngx_quic_payload_handler(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1651 {
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1652 u_char *end, *p;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1653 ssize_t len;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1654 ngx_uint_t ack_this;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1655 ngx_quic_frame_t frame, *ack_frame;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1656 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1657
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1658 qc = c->quic;
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1659
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1660 p = pkt->payload.data;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1661 end = p + pkt->payload.len;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1662
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1663 ack_this = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1664
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1665 while (p < end) {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1666
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1667 len = ngx_quic_read_frame(c, p, end, &frame);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1668 if (len < 0) {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1669 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1670 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1671
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1672 p += len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1673
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1674 switch (frame.type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1675
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1676 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1677
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1678 // TODO: handle ack
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1679
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1680 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1681 "ACK: { largest=%ui delay=%ui first=%ui count=%ui}",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1682 frame.u.ack.largest,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1683 frame.u.ack.delay,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1684 frame.u.ack.first_range,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1685 frame.u.ack.range_count);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1686
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1687 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1688
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1689 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1690
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1691 if (frame.u.crypto.offset != 0x0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1692 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1693 "crypto frame with non-zero offset");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1694 // TODO: support packet spanning with offsets
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1695 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1696 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1697
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1698 if (ngx_quic_handle_crypto_frame(c, pkt, &frame) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1699 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1700 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1701
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1702 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1703
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1704 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1705
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1706 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1707 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1708
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1709 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1710 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1711 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1712
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1713 case NGX_QUIC_FT_NEW_CONNECTION_ID:
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1714 ack_this = 1;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1715 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1716 "NCID: { seq=%ui retire=%ui len=%ui}",
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1717 frame.u.ncid.seqnum,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1718 frame.u.ncid.retire,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1719 frame.u.ncid.len);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1720 continue;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1721
8207
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1722 case NGX_QUIC_FT_STREAM:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1723 case NGX_QUIC_FT_STREAM1:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1724 case NGX_QUIC_FT_STREAM2:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1725 case NGX_QUIC_FT_STREAM3:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1726 case NGX_QUIC_FT_STREAM4:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1727 case NGX_QUIC_FT_STREAM5:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1728 case NGX_QUIC_FT_STREAM6:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1729 case NGX_QUIC_FT_STREAM7:
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1730
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1731 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1732 "STREAM frame 0x%xi id 0x%xi off 0x%xi len 0x%xi",
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1733 frame.type,
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1734 frame.u.stream.stream_id,
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1735 frame.u.stream.offset,
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1736 frame.u.stream.length);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1737
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1738 ngx_quic_hexdump0(c->log, "STREAM.data",
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1739 frame.u.stream.data, frame.u.stream.length);
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1740 break;
cc8d211cb45c Initial parsing of STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents: 8206
diff changeset
1741
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1742 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1743 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1744 "unexpected frame type 0x%xd in packet", frame.type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1745 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1746 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1747 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1748
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1749 if (p != end) {
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1750 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1751 "trailing garbage in payload: %ui bytes", end - p);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1752 return NGX_ERROR;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1753 }
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1754
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1755
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1756 if (ack_this == 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1757 /* do not ack packets with ACKs and PADDING */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1758 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1759 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1760
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1761 // packet processed, ACK it now if required
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1762 // TODO: if (ack_required) ... - currently just ack each packet
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1763
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1764 ack_frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1765 if (ack_frame == NULL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1766 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1767 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1768
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1769 ack_frame->level = pkt->level;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1770 ack_frame->type = NGX_QUIC_FT_ACK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1771 ack_frame->u.ack.pn = pkt->pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1772
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1773 ngx_sprintf(ack_frame->info, "ACK for PN=%d from frame handler", pkt->pn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1774 ngx_quic_queue_frame(qc, ack_frame);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1775
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1776 return ngx_quic_output(c);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1777 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1778
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1779
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1780 static ngx_int_t
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1781 ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl,
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1782 ngx_quic_header_t *pkt)
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1783 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1784 ngx_quic_connection_t *qc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1785
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1786 if (ngx_buf_size(pkt->raw) < 1200) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1787 ngx_log_error(NGX_LOG_INFO, c->log, 0, "too small UDP datagram");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1788 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1789 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1790
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1791 if (ngx_quic_process_long_header(c, pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1792 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1793 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1794
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1795 if ((pkt->flags & 0xf0) != NGX_QUIC_PKT_INITIAL) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1796 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1797 "invalid initial packet: 0x%xi", pkt->flags);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1798 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1799 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1800
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1801 if (ngx_quic_process_initial_header(c, pkt) != NGX_OK) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1802 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1803 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1804
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1805 qc = ngx_pcalloc(c->pool, sizeof(ngx_quic_connection_t));
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1806 if (qc == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1807 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1808 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1809
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1810 c->quic = qc;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1811 qc->ssl = ssl;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1812
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1813 qc->dcid.len = pkt->dcid.len;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1814 qc->dcid.data = ngx_pnalloc(c->pool, pkt->dcid.len);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1815 if (qc->dcid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1816 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1817 }
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1818 ngx_memcpy(qc->dcid.data, pkt->dcid.data, qc->dcid.len);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1819
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1820 qc->scid.len = pkt->scid.len;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1821 qc->scid.data = ngx_pnalloc(c->pool, qc->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1822 if (qc->scid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1823 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1824 }
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1825 ngx_memcpy(qc->scid.data, pkt->scid.data, qc->scid.len);
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1826
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1827 qc->token.len = pkt->token.len;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1828 qc->token.data = ngx_pnalloc(c->pool, qc->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1829 if (qc->token.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1830 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1831 }
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1832 ngx_memcpy(qc->token.data, pkt->token.data, qc->token.len);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1833
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1834
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1835 if (ngx_quic_initial_secret(c) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1836 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1837 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1838
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1839 pkt->secret = &qc->client_in;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1840 pkt->level = ssl_encryption_initial;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1841
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1842 if (ngx_quic_decrypt(c, pkt) != NGX_OK) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1843 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1844 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1845
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1846 if (ngx_quic_init_connection(c, pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1847 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1848 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1849
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1850 return ngx_quic_payload_handler(c, pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1851 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1852
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1853
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1854 static ngx_int_t
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1855 ngx_quic_handshake_input(ngx_connection_t *c, ngx_quic_header_t *pkt)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1856 {
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1857 ngx_ssl_conn_t *ssl_conn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1858 ngx_quic_connection_t *qc;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1859
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1860 qc = c->quic;
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1861 ssl_conn = c->ssl->connection;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1862
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1863 /* extract cleartext data into pkt */
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1864 if (ngx_quic_process_long_header(c, pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1865 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1866 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1867
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1868 if (pkt->dcid.len != qc->dcid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1869 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1870 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1871 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1872
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1873 if (ngx_memcmp(pkt->dcid.data, qc->dcid.data, qc->dcid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1874 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1875 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1876 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1877
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1878 if (pkt->scid.len != qc->scid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1879 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1880 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1881 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1882
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1883 if (ngx_memcmp(pkt->scid.data, qc->scid.data, qc->scid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1884 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1885 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1886 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1887
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1888 if ((pkt->flags & 0xf0) != NGX_QUIC_PKT_HANDSHAKE) {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1889 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1890 "invalid packet type: 0x%xi", pkt->flags);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1891 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1892 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1893
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1894 if (ngx_quic_process_handshake_header(c, pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1895 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1896 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1897
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1898 pkt->secret = &qc->client_hs;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1899 pkt->level = ssl_encryption_handshake;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1900
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1901 if (ngx_quic_decrypt(c, pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1902 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1903 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1904
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1905 return ngx_quic_payload_handler(c, pkt);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1906 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1907
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1908
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1909 static ngx_int_t
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1910 ngx_quic_app_input(ngx_connection_t *c, ngx_quic_header_t *pkt)
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1911 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1912 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1913
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1914 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1915
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1916 /* TODO: this is a stub, untested */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1917
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1918 if (ngx_quic_process_short_header(c, pkt) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1919 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1920 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1921
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1922 pkt->secret = &qc->client_ad;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1923 pkt->level = ssl_encryption_application;
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1924
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1925 if (ngx_quic_decrypt(c, pkt) != NGX_OK) {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1926 return NGX_ERROR;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1927 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1928
8206
8d6ac639feac Added support of multiple QUIC packets in single datagram.
Vladimir Homutov <vl@nginx.com>
parents: 8205
diff changeset
1929 return ngx_quic_payload_handler(c, pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1930 }
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1931
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1932
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1933 uint64_t
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1934 ngx_quic_parse_int(u_char **pos)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1935 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1936 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1937 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1938 ngx_uint_t len;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1939
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1940 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1941 len = 1 << ((*p & 0xc0) >> 6);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1942 value = *p++ & 0x3f;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1943
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1944 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1945 value = (value << 8) + *p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1946 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1947
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1948 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1949 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1950 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1951
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1952
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1953 void
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1954 ngx_quic_build_int(u_char **pos, uint64_t value)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1955 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1956 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1957 ngx_uint_t len;//, len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1958
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1959 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1960 len = 0;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1961
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1962 while (value >> ((1 << len) * 8 - 2)) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1963 len++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1964 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1965
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1966 *p = len << 6;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1967
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1968 // len2 =
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1969 len = (1 << len);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1970 len--;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1971 *p |= value >> (len * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1972 p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1973
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1974 while (len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1975 *p++ = value >> ((len-- - 1) * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1976 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1977
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1978 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1979 // return len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1980 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1981
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1982
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1983 static uint64_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1984 ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1985 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1986 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1987 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1988
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1989 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1990 value = *p++ ^ *mask++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1991
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1992 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1993 value = (value << 8) + (*p++ ^ *mask++);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1994 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1995
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1996 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1997 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1998 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1999
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2000
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2001 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2002 ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2003 const u_char *secret, size_t secret_len, const u_char *salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2004 size_t salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2005 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2006 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2007 if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2008 salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2009 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2010 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2011 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2012 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2013 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2014
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2015 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2016
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2017 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2018
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2019 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2020 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2021 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2022
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2023 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2024 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2025 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2026
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2027 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2028 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2029 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2030
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2031 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2032 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2033 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2034
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2035 if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2036 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2037 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2038
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2039 if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2040 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2041 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2042
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2043 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2044
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2045 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2046 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2047
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2048
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2049 static ngx_int_t
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2050 ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest, ngx_str_t *out,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2051 ngx_str_t *label, const uint8_t *prk, size_t prk_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2052 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2053 uint8_t *p;
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2054 size_t info_len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2055 uint8_t info[20];
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2056
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2057 out->data = ngx_pnalloc(c->pool, out->len);
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2058 if (out->data == NULL) {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2059 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2060 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2061
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2062 info_len = 2 + 1 + label->len + 1;
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2063
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2064 info[0] = 0;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2065 info[1] = out->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2066 info[2] = label->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2067 p = ngx_cpymem(&info[3], label->data, label->len);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2068 *p = '\0';
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2069
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2070 if (ngx_hkdf_expand(out->data, out->len, digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2071 prk, prk_len, info, info_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2072 != NGX_OK)
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2073 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2074 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2075 "ngx_hkdf_expand(%V) failed", label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2076 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2077 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2078
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
2079 ngx_quic_hexdump(c->log, "%V info", info, info_len, label);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
2080 ngx_quic_hexdump(c->log, "%V key", out->data, out->len, label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2081
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2082 return NGX_OK;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2083 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2084
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
2085
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2086 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2087 ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
2088 const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2089 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2090 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2091 if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2092 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2093 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2094 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2095 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2096 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2097
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2098 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2099
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2100 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2101
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2102 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2103 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2104 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2105
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2106 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2107 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2108 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2109
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2110 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2111 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2112 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2113
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2114 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2115 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2116 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2117
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2118 if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2119 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2120 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2121
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2122 if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2123 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2124 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2125
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2126 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2127
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2128 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2129 }
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2130
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2131
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2132 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2133 ngx_quic_tls_open(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2134 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2135 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2136 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2137 out->len = in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2138 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2139 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2140 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2141 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2142
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2143 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2144 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2145
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2146 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2147 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2148 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2149 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2150 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2151 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2152
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2153 if (EVP_AEAD_CTX_open(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2154 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2155 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2156 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2157 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2158 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_open() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2159 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2160 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2161
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2162 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2163 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2164 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2165 u_char *tag;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2166 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2167
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2168 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2169 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2170 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2171 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2172 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2173
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2174 if (EVP_DecryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2175 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2176 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2177 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2178 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2179
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2180 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2181 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2182 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2183 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2184 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2185 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2186 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2187 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2188
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2189 if (EVP_DecryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2190 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2191 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2192 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2193 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2194
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2195 if (EVP_DecryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2196 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2197 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2198 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2199 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2200
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2201 if (EVP_DecryptUpdate(ctx, out->data, &len, in->data,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2202 in->len - EVP_GCM_TLS_TAG_LEN)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2203 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2204 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2205 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2206 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2207 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2208 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2209
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2210 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2211 tag = in->data + in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2212
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2213 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, EVP_GCM_TLS_TAG_LEN, tag)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2214 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2215 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2216 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2217 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2218 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2219 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2220 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2221
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2222 if (EVP_DecryptFinal_ex(ctx, out->data + len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2223 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2224 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2225 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2226 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2227
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2228 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2229
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2230 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2231 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2232
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2233 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2234 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2235
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2236
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2237 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2238 ngx_quic_tls_seal(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2239 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2240 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2241 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2242 out->len = in->len + EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2243 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2244 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2245 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2246 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2247
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2248 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2249 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2250
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2251 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2252 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2253 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2254 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2255 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2256 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2257
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2258 if (EVP_AEAD_CTX_seal(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2259 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2260 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2261 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2262 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2263 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_seal() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2264 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2265 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2266
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2267 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2268 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2269 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2270 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2271
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2272 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2273 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2274 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2275 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2276 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2277
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2278 if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2279 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2280 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2281 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2282 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2283
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2284 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2285 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2286 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2287 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2288 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2289 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2290 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2291 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2292
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2293 if (EVP_EncryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2294 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2295 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2296 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2297 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2298
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2299 if (EVP_EncryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2300 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2301 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2302 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2303 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2304
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2305 if (EVP_EncryptUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2306 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2307 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2308 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2309 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2310
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2311 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2312
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2313 if (EVP_EncryptFinal_ex(ctx, out->data + out->len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2314 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2315 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2316 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2317 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2318
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2319 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2320
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2321 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, EVP_GCM_TLS_TAG_LEN,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2322 out->data + in->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2323 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2324 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2325 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2326 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2327 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_GET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2328 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2329 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2330
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2331 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2332
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2333 out->len += EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2334 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2335
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2336 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2337 }
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2338
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2339
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2340 static ngx_int_t
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2341 ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2342 ngx_quic_secret_t *s, u_char *out, u_char *in)
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2343 {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2344 int outlen;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2345 EVP_CIPHER_CTX *ctx;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2346 u_char zero[5] = {0};
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2347
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2348 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2349 uint32_t counter;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2350
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2351 ngx_memcpy(&counter, in, sizeof(uint32_t));
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2352
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2353 if (cipher == (const EVP_CIPHER *) EVP_aead_chacha20_poly1305()) {
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2354 CRYPTO_chacha_20(out, zero, 5, s->hp.data, &in[4], counter);
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2355 return NGX_OK;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2356 }
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2357 #endif
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2358
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2359 ctx = EVP_CIPHER_CTX_new();
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2360 if (ctx == NULL) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2361 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2362 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2363
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2364 if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, in) != 1) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2365 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2366 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2367 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2368
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2369 if (!EVP_EncryptUpdate(ctx, out, &outlen, zero, 5)) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2370 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2371 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2372 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2373
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2374 if (!EVP_EncryptFinal_ex(ctx, out + 5, &outlen)) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2375 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_Ex() failed");
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2376 goto failed;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2377 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2378
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2379 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2380
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2381 return NGX_OK;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2382
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2383 failed:
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2384
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2385 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2386
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2387 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2388 }
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2389
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2390
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2391 static ngx_int_t
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2392 ngx_quic_ciphers(ngx_connection_t *c, ngx_quic_ciphers_t *ciphers,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2393 enum ssl_encryption_level_t level)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2394 {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2395 ngx_int_t id, len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2396
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2397 if (level == ssl_encryption_initial) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2398 id = NGX_AES_128_GCM_SHA256;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2399
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2400 } else {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2401 id = SSL_CIPHER_get_id(SSL_get_current_cipher(c->ssl->connection))
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2402 & 0xffff;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2403 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2404
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2405 switch (id) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2406
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2407 case NGX_AES_128_GCM_SHA256:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2408 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2409 ciphers->c = EVP_aead_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2410 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2411 ciphers->c = EVP_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2412 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2413 ciphers->hp = EVP_aes_128_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2414 ciphers->d = EVP_sha256();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2415 len = 16;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2416 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2417
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2418 case NGX_AES_256_GCM_SHA384:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2419 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2420 ciphers->c = EVP_aead_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2421 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2422 ciphers->c = EVP_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2423 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2424 ciphers->hp = EVP_aes_256_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2425 ciphers->d = EVP_sha384();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2426 len = 32;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2427 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2428
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2429 case NGX_CHACHA20_POLY1305_SHA256:
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2430 #ifdef OPENSSL_IS_BORINGSSL
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2431 ciphers->c = EVP_aead_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2432 #else
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2433 ciphers->c = EVP_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2434 #endif
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2435 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2436 ciphers->hp = (const EVP_CIPHER *) EVP_aead_chacha20_poly1305();
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2437 #else
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2438 ciphers->hp = EVP_chacha20();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2439 #endif
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2440 ciphers->d = EVP_sha256();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2441 len = 32;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2442 break;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2443
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2444 default:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2445 return NGX_ERROR;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2446 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2447
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2448 return len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2449 }