Mercurial > hg > nginx

annotate src/event/ngx_event_quic.c @ 8185:6a76d9657772 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC handshake final bits. Added handling of client Finished, both feeding and acknowledgement. This includes sending NST in 1-RTT triggered by a handshake process.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 03 Mar 2020 17:25:02 +0300
parents ec1f84996990
children 0a2683df5f11
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2 /*
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
3 * Copyright (C) Nginx, Inc.
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
4 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
5
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
6
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7 #include <ngx_config.h>
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 #include <ngx_core.h>
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
9
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
10
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
11 #define quic_version 0xff000018
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
12
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
13
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
14 #if (NGX_HAVE_NONALIGNED)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
15
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
16 #define ngx_quic_parse_uint16(p) ntohs(*(uint16_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
17 #define ngx_quic_parse_uint32(p) ntohl(*(uint32_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
18
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
19 #define ngx_quic_write_uint16 ngx_quic_write_uint16_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
20 #define ngx_quic_write_uint32 ngx_quic_write_uint32_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
21
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
22 #else
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
23
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
24 #define ngx_quic_parse_uint16(p) ((p)[0] << 8 | (p)[1])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
25 #define ngx_quic_parse_uint32(p) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
26 ((uint32_t) (p)[0] << 24 | (p)[1] << 16 | (p)[2] << 8 | (p)[3])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
27
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
28 #define ngx_quic_write_uint16(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
29 ((p)[0] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
30 (p)[1] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
31 (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
32
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
33 #define ngx_quic_write_uint32(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
34 ((p)[0] = (u_char) ((s) >> 24), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
35 (p)[1] = (u_char) ((s) >> 16), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
36 (p)[2] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
37 (p)[3] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
38 (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
39
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
40 #endif
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
41
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
42
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
43 #define ngx_quic_write_uint16_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
44 (*(uint16_t *) (p) = htons((uint16_t) (s)), (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
45
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
46 #define ngx_quic_write_uint32_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
47 (*(uint32_t *) (p) = htonl((uint32_t) (s)), (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
48
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
49
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
50
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
51 #if (NGX_DEBUG)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
52
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
53 #define ngx_quic_hexdump(log, fmt, data, len, ...) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
54 do { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
55 ngx_int_t m; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
56 u_char buf[2048]; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
57 \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
58 if (log->log_level & NGX_LOG_DEBUG_EVENT) { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
59 m = ngx_hex_dump(buf, (u_char *) data, ngx_min(len, 1024)) - buf; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
60 ngx_log_debug(NGX_LOG_DEBUG_EVENT, log, 0, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
61 "%s: " fmt " %*s%s, len: %uz", \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
62 __FUNCTION__, __VA_ARGS__, m, buf, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
63 len < 2048 ? "" : "...", len); \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
64 } \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
65 } while (0)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
66
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
67 #else
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
68
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
69 #define ngx_quic_hexdump(log, fmt, data, len, ...)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
70
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
71 #endif
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
72
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
73 #define ngx_quic_hexdump0(log, fmt, data, len) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
74 ngx_quic_hexdump(log, fmt "%s", data, len, "") \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
75
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
76
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
77 /* 17.2. Long Header Packets */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
78
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
79 #define NGX_QUIC_PKT_LONG 0x80
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
80
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
81 #define NGX_QUIC_PKT_INITIAL 0xc0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
82 #define NGX_QUIC_PKT_HANDSHAKE 0xe0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
83
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
84 /* 12.4. Frames and Frame Types */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
85 #define NGX_QUIC_FT_PADDING 0x00
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
86 #define NGX_QUIC_FT_PING 0x01
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
87 #define NGX_QUIC_FT_ACK 0x02
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
88 #define NGX_QUIC_FT_ACK_ECN 0x03
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
89 #define NGX_QUIC_FT_RESET_STREAM 0x04
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
90 #define NGX_QUIC_FT_STOP_SENDING 0x05
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
91 #define NGX_QUIC_FT_CRYPTO 0x06
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
92 #define NGX_QUIC_FT_NEW_TOKEN 0x07
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
93 #define NGX_QUIC_FT_STREAM 0x08 // - 0x0f
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
94 #define NGX_QUIC_FT_MAX_DATA 0x10
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
95 #define NGX_QUIC_FT_MAX_STREAM_DATA 0x11
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
96 #define NGX_QUIC_FT_MAX_STREAMS 0x12
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
97 #define NGX_QUIC_FT_MAX_STREAMS2 0x13 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
98 #define NGX_QUIC_FT_DATA_BLOCKED 0x14
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
99 #define NGX_QUIC_FT_STREAM_DATA_BLOCKED 0x15
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
100 #define NGX_QUIC_FT_STREAMS_BLOCKED 0x16
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
101 #define NGX_QUIC_FT_STREAMS_BLOCKED2 0x17 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
102 #define NGX_QUIC_FT_NEW_CONNECTION_ID 0x18
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
103 #define NGX_QUIC_FT_RETIRE_CONNECTION_ID 0x19
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
104 #define NGX_QUIC_FT_PATH_CHALLENGE 0x1a
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
105 #define NGX_QUIC_FT_PATH_RESPONSE 0x1b
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
106 #define NGX_QUIC_FT_CONNECTION_CLOSE 0x1c
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
107 #define NGX_QUIC_FT_CONNECTION_CLOSE2 0x1d // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
108 #define NGX_QUIC_FT_HANDSHAKE_DONE 0x1e
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
109
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
110
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
111 /* TODO: real states, these are stubs */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
112 typedef enum {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
113 NGX_QUIC_ST_INITIAL,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
114 NGX_QUIC_ST_HANDSHAKE,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
115 NGX_QUIC_ST_APP_DATA
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
116 } ngx_quic_state_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
117
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
118
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
119 typedef struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
120 ngx_str_t secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
121 ngx_str_t key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
122 ngx_str_t iv;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
123 ngx_str_t hp;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
124 } ngx_quic_secret_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
125
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
126
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
127 struct ngx_quic_connection_s {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
128
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
129 ngx_quic_state_t state;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
130 ngx_ssl_t *ssl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
131
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
132 ngx_str_t out; // stub for some kind of output queue
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
133
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
134 ngx_str_t scid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
135 ngx_str_t dcid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
136 ngx_str_t token;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
137
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
138 /* current packet numbers for each namespace */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
139 ngx_uint_t initial_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
140 ngx_uint_t handshake_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
141 ngx_uint_t appdata_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
142
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
143 ngx_quic_secret_t client_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
144 ngx_quic_secret_t client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
145 ngx_quic_secret_t client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
146 ngx_quic_secret_t server_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
147 ngx_quic_secret_t server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
148 ngx_quic_secret_t server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
149 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
150
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
151
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
152 typedef enum ssl_encryption_level_t ngx_quic_level_t;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
153
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
154 typedef struct {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
155 ngx_quic_secret_t *secret;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
156 ngx_uint_t type;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
157 ngx_uint_t *number;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
158 ngx_uint_t flags;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
159 ngx_uint_t version;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
160 ngx_str_t *token;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
161 ngx_quic_level_t level;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
162 } ngx_quic_header_t;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
163
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
164
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
165 static ngx_int_t ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
166 ngx_buf_t *b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
167 static ngx_int_t ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
168
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
169 static int ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
170 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
171 const uint8_t *write_secret, size_t secret_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
172 static int ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
173 enum ssl_encryption_level_t level, const uint8_t *data, size_t len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
174 static ngx_int_t ngx_quic_create_long_packet(ngx_connection_t *c,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
175 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
176 ngx_str_t *res);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
177 static ngx_int_t ngx_quic_create_short_packet(ngx_connection_t *c,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
178 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
179 ngx_str_t *res);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
180 static int ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
181 static int ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
182 enum ssl_encryption_level_t level, uint8_t alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
183
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
184 static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
185 static uint64_t ngx_quic_parse_int(u_char **pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
186 static void ngx_quic_build_int(u_char **pos, uint64_t value);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
187
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
188 static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
189 const EVP_MD *digest, const u_char *secret, size_t secret_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
190 const u_char *salt, size_t salt_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
191 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
192 const EVP_MD *digest, const u_char *prk, size_t prk_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
193 const u_char *info, size_t info_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
194
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
195 static ngx_int_t ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
196 ngx_str_t *out, ngx_str_t *label, const uint8_t *prk, size_t prk_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
197
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
198 static ngx_int_t ngx_quic_tls_open(ngx_connection_t *c,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
199 const EVP_CIPHER *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
200 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
201 static ngx_int_t ngx_quic_tls_seal(ngx_connection_t *c,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
202 const EVP_CIPHER *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
203 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
204
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
205 static ngx_int_t ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
206 ngx_quic_secret_t *s, u_char *out, u_char *in);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
207
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
208
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
209 static SSL_QUIC_METHOD quic_method = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
210 ngx_quic_set_encryption_secrets,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
211 ngx_quic_add_handshake_data,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
212 ngx_quic_flush_flight,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
213 ngx_quic_send_alert,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
214 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
215
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
216
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
217 void
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
218 ngx_quic_init_ssl_methods(SSL_CTX* ctx)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
219 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
220 SSL_CTX_set_quic_method(ctx, &quic_method);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
221 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
222
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
223
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
224 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
225 ngx_quic_input(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
226 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
227 if (c->quic == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
228 return ngx_quic_new_connection(c, ssl, b); //TODO: change state by results
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
229 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
230
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
231 switch (c->quic->state) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
232 case NGX_QUIC_ST_INITIAL:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
233 case NGX_QUIC_ST_HANDSHAKE:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
234 return ngx_quic_handshake_input(c, b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
235 default:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
236 /* application data */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
237 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
238 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
239
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
240 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
241 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
242
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
243
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
244 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
245 ngx_quic_output(ngx_connection_t *c)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
246 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
247 /* stub for processing output queue */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
248
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
249 if (c->quic->out.data) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
250 c->send(c, c->quic->out.data, c->quic->out.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
251 c->quic->out.data = NULL;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
252 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
253
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
254 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
255 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
256
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
257
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
258 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
259 ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
260 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
261 const uint8_t *write_secret, size_t secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
262 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
263 u_char *name;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
264 ngx_uint_t i;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
265 const EVP_MD *digest;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
266 const EVP_CIPHER *cipher;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
267 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
268 ngx_quic_secret_t *client, *server;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
269
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
270 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
271
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
272 //ngx_ssl_handshake_log(c); // TODO: enable again
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
273
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
274 ngx_quic_hexdump(c->log, "level:%d read", read_secret, secret_len, level);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
275 ngx_quic_hexdump(c->log, "level:%d read", write_secret, secret_len, level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
276
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
277 name = (u_char *) SSL_get_cipher(ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
278
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
279 if (ngx_strcasecmp(name, (u_char *) "TLS_AES_128_GCM_SHA256") == 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
280 || ngx_strcasecmp(name, (u_char *) "(NONE)") == 0)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
281 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
282 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
283 digest = EVP_sha256();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
284
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
285 } else if (ngx_strcasecmp(name, (u_char *) "TLS_AES_256_GCM_SHA384") == 0) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
286 cipher = EVP_aes_256_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
287 digest = EVP_sha384();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
288
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
289 } else {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
290 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
291 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
292 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
293
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
294 switch (level) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
295
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
296 case ssl_encryption_handshake:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
297 client = &c->quic->client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
298 server = &c->quic->server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
299
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
300 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
301
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
302 case ssl_encryption_application:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
303 client = &c->quic->client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
304 server = &c->quic->server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
305
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
306 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
307
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
308 default:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
309 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
310 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
311
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
312 client->key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
313 server->key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
314
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
315 client->iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
316 server->iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
317
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
318 client->hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
319 server->hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
320
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
321 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
322 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
323 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
324 const uint8_t *secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
325 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
326 { ngx_string("tls13 quic key"), &client->key, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
327 { ngx_string("tls13 quic iv"), &client->iv, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
328 { ngx_string("tls13 quic hp"), &client->hp, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
329 { ngx_string("tls13 quic key"), &server->key, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
330 { ngx_string("tls13 quic iv"), &server->iv, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
331 { ngx_string("tls13 quic hp"), &server->hp, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
332 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
333
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
334 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
335
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
336 if (ngx_quic_hkdf_expand(c, digest, seq[i].key, &seq[i].label,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
337 seq[i].secret, secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
338 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
339 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
340 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
341 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
342 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
343
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
344 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
345 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
346
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
347
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
348 static ngx_int_t
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
349 ngx_quic_create_long_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
350 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
351 {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
352 u_char *p, *pnp, *name, *nonce, *sample, *packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
353 ngx_str_t ad, out;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
354 const EVP_CIPHER *cipher;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
355 ngx_quic_connection_t *qc;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
356
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
357 u_char mask[16];
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
358
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
359 qc = c->quic;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
360
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
361 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
362
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
363 ad.data = ngx_alloc(346 /*max header*/, c->log);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
364 if (ad.data == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
365 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
366 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
367
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
368 p = ad.data;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
369
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
370 *p++ = pkt->flags;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
371
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
372 p = ngx_quic_write_uint32(p, quic_version);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
373
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
374 *p++ = qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
375 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
376
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
377 *p++ = qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
378 p = ngx_cpymem(p, qc->dcid.data, qc->dcid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
379
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
380 if (pkt->token) { // if pkt->flags & initial ?
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
381 ngx_quic_build_int(&p, pkt->token->len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
382 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
383
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
384 ngx_quic_build_int(&p, out.len + 1); // length (inc. pnl)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
385 pnp = p;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
386
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
387 *p++ = (*pkt->number)++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
388
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
389 ad.len = p - ad.data;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
390
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
391 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
392
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
393 name = (u_char *) SSL_get_cipher(ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
394
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
395 if (ngx_strcasecmp(name, (u_char *) "TLS_AES_128_GCM_SHA256") == 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
396 || ngx_strcasecmp(name, (u_char *) "(NONE)") == 0)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
397 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
398 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
399
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
400 } else if (ngx_strcasecmp(name, (u_char *) "TLS_AES_256_GCM_SHA384") == 0) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
401 cipher = EVP_aes_256_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
402
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
403 } else {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
404 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
405 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
406
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
407 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
408 if (pkt->level == ssl_encryption_handshake) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
409 nonce[11] ^= (*pkt->number - 1);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
410 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
411
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
412 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
413 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
414
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
415 if (ngx_quic_tls_seal(c, cipher, pkt->secret, &out, nonce, payload, &ad) != NGX_OK) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
416 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
417 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
418
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
419 sample = &out.data[3]; // pnl=0
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
420 if (ngx_quic_tls_hp(c, EVP_aes_128_ecb(), pkt->secret, mask, sample) != NGX_OK) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
421 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
422 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
423
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
424 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
425 ngx_quic_hexdump0(c->log, "mask", mask, 16);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
426 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
427
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
428 // header protection, pnl = 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
429 ad.data[0] ^= mask[0] & 0x0f;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
430 *pnp ^= mask[1];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
431
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
432 packet = ngx_alloc(ad.len + out.len, c->log);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
433 if (packet == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
434 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
435 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
436
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
437 p = ngx_cpymem(packet, ad.data, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
438 p = ngx_cpymem(p, out.data, out.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
439
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
440 res->data = packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
441 res->len = p - packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
442
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
443 return NGX_OK;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
444 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
445
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
446
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
447 static ngx_int_t
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
448 ngx_quic_create_short_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
449 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
450 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
451 u_char *p, *pnp, *name, *nonce, *sample, *packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
452 ngx_str_t ad, out;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
453 const EVP_CIPHER *cipher;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
454 ngx_quic_connection_t *qc;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
455
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
456 u_char mask[16];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
457
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
458 qc = c->quic;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
459
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
460 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
461
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
462 ad.data = ngx_alloc(25 /*max header*/, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
463 if (ad.data == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
464 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
465 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
466
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
467 p = ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
468
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
469 *p++ = 0x40;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
470
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
471 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
472
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
473 pnp = p;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
474
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
475 *p++ = (*pkt->number)++;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
476
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
477 ad.len = p - ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
478
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
479 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
480
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
481 name = (u_char *) SSL_get_cipher(ssl_conn);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
482
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
483 if (ngx_strcasecmp(name, (u_char *) "TLS_AES_128_GCM_SHA256") == 0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
484 || ngx_strcasecmp(name, (u_char *) "(NONE)") == 0)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
485 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
486 cipher = EVP_aes_128_gcm();
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
487
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
488 } else if (ngx_strcasecmp(name, (u_char *) "TLS_AES_256_GCM_SHA384") == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
489 cipher = EVP_aes_256_gcm();
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
490
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
491 } else {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
492 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
493 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
494
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
495 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
496 if (pkt->level == ssl_encryption_handshake) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
497 nonce[11] ^= (*pkt->number - 1);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
498 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
499
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
500 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
501 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
502
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
503 if (ngx_quic_tls_seal(c, cipher, pkt->secret, &out, nonce, payload, &ad)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
504 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
505 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
506 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
507 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
508
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
509 ngx_quic_hexdump0(c->log, "out", out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
510
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
511 sample = &out.data[3]; // pnl=0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
512 if (ngx_quic_tls_hp(c, EVP_aes_128_ecb(), pkt->secret, mask, sample)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
513 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
514 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
515 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
516 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
517
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
518 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
519 ngx_quic_hexdump0(c->log, "mask", mask, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
520 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
521
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
522 // header protection, pnl = 0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
523 ad.data[0] ^= mask[0] & 0x1f;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
524 *pnp ^= mask[1];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
525
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
526 packet = ngx_alloc(ad.len + out.len, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
527 if (packet == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
528 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
529 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
530
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
531 p = ngx_cpymem(packet, ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
532 p = ngx_cpymem(p, out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
533
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
534 ngx_quic_hexdump0(c->log, "packet", packet, p - packet);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
535
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
536 res->data = packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
537 res->len = p - packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
538
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
539 return NGX_OK;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
540 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
541
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
542
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
543 static void
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
544 ngx_quic_create_ack(u_char **p, uint64_t num)
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
545 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
546 ngx_quic_build_int(p, NGX_QUIC_FT_ACK);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
547 ngx_quic_build_int(p, num);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
548 ngx_quic_build_int(p, 0);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
549 ngx_quic_build_int(p, 0);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
550 ngx_quic_build_int(p, num);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
551 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
552
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
553
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
554 static void
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
555 ngx_quic_create_crypto(u_char **p, u_char *data, size_t len)
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
556 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
557 ngx_quic_build_int(p, NGX_QUIC_FT_CRYPTO);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
558 ngx_quic_build_int(p, 0);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
559 ngx_quic_build_int(p, len);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
560 *p = ngx_cpymem(*p, data, len);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
561 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
562
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
563
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
564
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
565 static int
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
566 ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
567 enum ssl_encryption_level_t level, const uint8_t *data, size_t len)
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
568 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
569 u_char *p;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
570 ngx_str_t payload, res;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
571 ngx_connection_t *c;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
572 ngx_quic_header_t pkt;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
573 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
574
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
575 ngx_str_t initial_token = ngx_null_string;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
576
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
577 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
578 qc = c->quic;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
579
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
580 //ngx_ssl_handshake_log(c); // TODO: enable again
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
581
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
582 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
583
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
584 pkt.level = level;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
585
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
586 payload.data = ngx_alloc(4 + len + 5 /*minimal ACK*/, c->log);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
587 if (payload.data == 0) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
588 return 0;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
589 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
590 p = payload.data;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
591
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
592 ngx_quic_create_crypto(&p, (u_char *) data, len);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
593
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
594 if (level == ssl_encryption_initial) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
595 ngx_quic_create_ack(&p, 0);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
596
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
597 pkt.number = &qc->initial_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
598 pkt.flags = NGX_QUIC_PKT_INITIAL;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
599 pkt.secret = &qc->server_in;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
600
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
601 pkt.token = &initial_token;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
602
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
603 } else if (level == ssl_encryption_handshake) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
604 pkt.number = &qc->handshake_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
605 pkt.flags = NGX_QUIC_PKT_HANDSHAKE;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
606 pkt.secret = &qc->server_hs;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
607
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
608 pkt.token = NULL;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
609
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
610 } else {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
611 pkt.number = &qc->appdata_pn;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
612 pkt.secret = &qc->server_ad;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
613 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
614
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
615 payload.len = p - payload.data;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
616
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
617 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
618 "ngx_quic_add_handshake_data: clear_len:%uz",
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
619 payload.len);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
620
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
621 if (level == ssl_encryption_application) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
622
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
623 if (ngx_quic_create_short_packet(c, ssl_conn, &pkt, &payload, &res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
624 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
625 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
626 return 0;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
627 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
628
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
629 } else {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
630
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
631 if (ngx_quic_create_long_packet(c, ssl_conn, &pkt, &payload, &res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
632 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
633 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
634 return 0;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
635 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
636 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
637
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
638 // TODO: save state of data to send into qc (push into queue)
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
639 qc->out = res;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
640
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
641 if (ngx_quic_output(c) != NGX_OK) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
642 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
643 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
644
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
645 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
646 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
647
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
648
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
649 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
650 ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
651 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
652 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
653
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
654 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
655
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
656 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_quic_flush_flight()");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
657
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
658 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
659 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
660
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
661
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
662 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
663 ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
664 uint8_t alert)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
665 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
666 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
667
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
668 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
669
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
670 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
671 "ngx_quic_send_alert(), lvl=%d, alert=%d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
672 (int) level, (int) alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
673
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
674 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
675 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
676
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
677
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
678 static ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
679 ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
680 {
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
681 int n, sslerr;
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
682 ngx_quic_connection_t *qc;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
683
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
684 if ((b->pos[0] & 0xf0) != NGX_QUIC_PKT_INITIAL) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
685 ngx_log_error(NGX_LOG_INFO, c->log, 0, "invalid initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
686 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
687 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
688
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
689 if (ngx_buf_size(b) < 1200) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
690 ngx_log_error(NGX_LOG_INFO, c->log, 0, "too small UDP datagram");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
691 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
692 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
693
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
694 ngx_int_t flags = *b->pos++;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
695 uint32_t version = ngx_quic_parse_uint32(b->pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
696 b->pos += sizeof(uint32_t);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
697
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
698 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
699 "quic flags:%xi version:%xD", flags, version);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
700
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
701 if (version != quic_version) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
702 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unsupported quic version");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
703 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
704 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
705
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
706 qc = ngx_pcalloc(c->pool, sizeof(ngx_quic_connection_t));
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
707 if (qc == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
708 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
709 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
710
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
711 c->quic = qc;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
712
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
713 qc->dcid.len = *b->pos++;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
714 qc->dcid.data = ngx_pnalloc(c->pool, qc->dcid.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
715 if (qc->dcid.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
716 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
717 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
718
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
719 ngx_memcpy(qc->dcid.data, b->pos, qc->dcid.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
720 b->pos += qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
721
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
722 qc->scid.len = *b->pos++;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
723 qc->scid.data = ngx_pnalloc(c->pool, qc->scid.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
724 if (qc->scid.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
725 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
726 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
727
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
728 ngx_memcpy(qc->scid.data, b->pos, qc->scid.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
729 b->pos += qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
730
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
731 qc->token.len = ngx_quic_parse_int(&b->pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
732 qc->token.data = ngx_pnalloc(c->pool, qc->token.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
733 if (qc->token.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
734 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
735 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
736
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
737 ngx_memcpy(qc->token.data, b->pos, qc->token.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
738 b->pos += qc->token.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
739
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
740 ngx_int_t plen = ngx_quic_parse_int(&b->pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
741
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
742 if (plen > b->last - b->pos) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
743 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
744 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
745 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
746
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
747 /* draft-ietf-quic-tls-23#section-5.4.2:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
748 * the Packet Number field is assumed to be 4 bytes long
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
749 * draft-ietf-quic-tls-23#section-5.4.[34]:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
750 * AES-Based and ChaCha20-Based header protections sample 16 bytes
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
751 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
752 u_char *sample = b->pos + 4;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
753
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
754 ngx_quic_hexdump0(c->log, "DCID", qc->dcid.data, qc->dcid.len);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
755 ngx_quic_hexdump0(c->log, "SCID", qc->scid.data, qc->scid.len);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
756 ngx_quic_hexdump0(c->log, "token", qc->token.data, qc->token.len);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
757 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
758 "quic packet length: %d", plen);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
759 ngx_quic_hexdump0(c->log, "sample", sample, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
760
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
761
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
762 // initial secret
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
763
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
764 size_t is_len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
765 uint8_t is[SHA256_DIGEST_LENGTH];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
766 ngx_uint_t i;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
767 const EVP_MD *digest;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
768 const EVP_CIPHER *cipher;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
769 static const uint8_t salt[20] =
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
770 "\xc3\xee\xf7\x12\xc7\x2e\xbb\x5a\x11\xa7"
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
771 "\xd2\x43\x2b\xb4\x63\x65\xbe\xf9\xf5\x02";
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
772
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
773 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
774
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
775 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
776 digest = EVP_sha256();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
777
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
778 if (ngx_hkdf_extract(is, &is_len, digest, qc->dcid.data, qc->dcid.len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
779 salt, sizeof(salt))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
780 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
781 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
782 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
783 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
784
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
785 ngx_str_t iss = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
786 .data = is,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
787 .len = is_len
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
788 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
789
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
790 ngx_quic_hexdump0(c->log, "salt", salt, sizeof(salt));
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
791 ngx_quic_hexdump0(c->log, "initial secret", is, is_len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
792
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
793 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
794 qc->client_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
795 qc->server_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
796
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
797 qc->client_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
798 qc->server_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
799
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
800 qc->client_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
801 qc->server_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
802
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
803 qc->client_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
804 qc->server_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
805
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
806 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
807 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
808 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
809 ngx_str_t *prk;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
810 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
811
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
812 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
813 { ngx_string("tls13 client in"), &qc->client_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
814 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
815 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
816 &qc->client_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
817 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
818 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
819 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
820 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
821 &qc->client_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
822 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
823 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
824 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
825 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
826 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
827 &qc->client_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
828 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
829 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
830 { ngx_string("tls13 server in"), &qc->server_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
831 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
832 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
833 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
834 &qc->server_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
835 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
836 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
837 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
838 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
839 &qc->server_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
840 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
841 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
842 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
843 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
844 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
845 &qc->server_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
846 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
847 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
848
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
849 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
850
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
851 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
852
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
853 if (ngx_quic_hkdf_expand(c, digest, seq[i].key, &seq[i].label,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
854 seq[i].prk->data, seq[i].prk->len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
855 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
856 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
857 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
858 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
859 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
860
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
861 // header protection
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
862
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
863 uint8_t mask[16];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
864 if (ngx_quic_tls_hp(c, EVP_aes_128_ecb(), &qc->client_in, mask, sample)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
865 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
866 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
867 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
868 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
869
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
870 u_char clearflags = flags ^ (mask[0] & 0x0f);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
871 ngx_int_t pnl = (clearflags & 0x03) + 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
872 uint64_t pn = ngx_quic_parse_pn(&b->pos, pnl, &mask[1]);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
873
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
874 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
875 ngx_quic_hexdump0(c->log, "mask", mask, 5);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
876 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
877 "quic packet number: %uL, len: %xi", pn, pnl);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
878
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
879 // packet protection
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
880
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
881 ngx_str_t in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
882 in.data = b->pos;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
883 in.len = plen - pnl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
884
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
885 ngx_str_t ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
886 ad.len = b->pos - b->start;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
887 ad.data = ngx_pnalloc(c->pool, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
888 if (ad.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
889 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
890 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
891
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
892 ngx_memcpy(ad.data, b->start, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
893 ad.data[0] = clearflags;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
894 ad.data[ad.len - pnl] = (u_char)pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
895
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
896 uint8_t *nonce = ngx_pstrdup(c->pool, &qc->client_in.iv);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
897 nonce[11] ^= pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
898
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
899 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
900 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
901
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
902 ngx_str_t out;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
903
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
904 if (ngx_quic_tls_open(c, EVP_aes_128_gcm(), &qc->client_in, &out, nonce,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
905 &in, &ad)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
906 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
907 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
908 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
909 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
910
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
911 ngx_quic_hexdump0(c->log, "packet payload", out.data, out.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
912
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
913 if (out.data[0] != 0x06) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
914 ngx_log_error(NGX_LOG_INFO, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
915 "unexpected frame in initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
916 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
917 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
918
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
919 if (out.data[1] != 0x00) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
920 ngx_log_error(NGX_LOG_INFO, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
921 "unexpected CRYPTO offset in initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
922 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
923 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
924
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
925 uint8_t *crypto = &out.data[2];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
926 uint64_t crypto_len = ngx_quic_parse_int(&crypto);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
927
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
928 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
929 "quic initial packet CRYPTO length: %uL pp:%p:%p",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
930 crypto_len, out.data, crypto);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
931
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
932 if (ngx_ssl_create_connection(ssl, c, NGX_SSL_BUFFER) != NGX_OK) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
933 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
934 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
935
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
936 static const uint8_t params[12] = "\x00\x0a\x00\x3a\x00\x01\x00\x00\x09\x00\x01\x03";
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
937
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
938 if (SSL_set_quic_transport_params(c->ssl->connection, params,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
939 sizeof(params)) == 0)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
940 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
941 ngx_log_error(NGX_LOG_INFO, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
942 "SSL_set_quic_transport_params() failed");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
943 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
944 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
945
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
946 n = SSL_do_handshake(c->ssl->connection);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
947
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
948 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
949
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
950 if (n == -1) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
951 sslerr = SSL_get_error(c->ssl->connection, n);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
952
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
953 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
954 sslerr);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
955 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
956
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
957 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
958 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
959 (int) SSL_quic_read_level(c->ssl->connection),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
960 (int) SSL_quic_write_level(c->ssl->connection));
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
961
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
962 if (!SSL_provide_quic_data(c->ssl->connection,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
963 SSL_quic_read_level(c->ssl->connection),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
964 crypto, crypto_len))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
965 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
966 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
967 "SSL_provide_quic_data() failed");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
968 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
969 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
970
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
971 n = SSL_do_handshake(c->ssl->connection);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
972
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
973 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
974
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
975 if (n == -1) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
976 sslerr = SSL_get_error(c->ssl->connection, n);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
977
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
978 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
979 sslerr);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
980
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
981 if (sslerr == SSL_ERROR_SSL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
982 ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
983 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
984 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
985
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
986 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
987 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
988 (int) SSL_quic_read_level(c->ssl->connection),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
989 (int) SSL_quic_write_level(c->ssl->connection));
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
990
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
991 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
992 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
993
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
994
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
995 static ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
996 ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *bb)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
997 {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
998 int sslerr;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
999 ssize_t n;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1000 ngx_str_t out;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1001 const EVP_CIPHER *cipher;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1002 ngx_quic_connection_t *qc;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1003 u_char *p, *b;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1004
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1005 qc = c->quic;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1006
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1007 n = bb->last - bb->pos;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1008 p = bb->pos;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1009 b = bb->start;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1010
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1011 ngx_quic_hexdump0(c->log, "input", buf, n);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1012
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
1013 if ((p[0] & 0xf0) != NGX_QUIC_PKT_HANDSHAKE) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1014 ngx_log_error(NGX_LOG_INFO, c->log, 0, "invalid packet type");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1015 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1016 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1017
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1018 ngx_int_t flags = *p++;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1019 uint32_t version = ngx_quic_parse_uint32(p);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1020 p += sizeof(uint32_t);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1021
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1022 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1023 "quic flags:%xi version:%xD", flags, version);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1024
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1025 if (version != quic_version) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1026 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unsupported quic version");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1027 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1028 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1029
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1030 if (*p++ != qc->dcid.len) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1031 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1032 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1033 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1034
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1035 if (ngx_memcmp(p, qc->dcid.data, qc->dcid.len) != 0) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1036 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1037 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1038 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1039
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1040 p += qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1041
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1042 if (*p++ != qc->scid.len) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1043 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1044 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1045 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1046
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1047 if (ngx_memcmp(p, qc->scid.data, qc->scid.len) != 0) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1048 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1049 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1050 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1051
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1052 p += qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1053
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1054 ngx_int_t plen = ngx_quic_parse_int(&p);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1055
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1056 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1057 "quic packet length: %d", plen);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1058
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1059 if (plen > b + n - p) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1060 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated handshake packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1061 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1062 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1063
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1064 u_char *sample = p + 4;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1065
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1066 ngx_quic_hexdump0(c->log, "sample", sample, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1067
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1068 // header protection
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1069
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1070 uint8_t mask[16];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1071 if (ngx_quic_tls_hp(c, EVP_aes_128_ecb(), &qc->client_hs, mask, sample)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1072 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1073 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1074 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1075 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1076
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1077 u_char clearflags = flags ^ (mask[0] & 0x0f);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1078 ngx_int_t pnl = (clearflags & 0x03) + 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1079 uint64_t pn = ngx_quic_parse_pn(&p, pnl, &mask[1]);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1080
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1081 ngx_quic_hexdump0(c->log, "mask", mask, 5);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1082 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1083 "quic clear flags: %xi", clearflags);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1084 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1085 "quic packet number: %uL, len: %xi", pn, pnl);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1086
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1087 // packet protection
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1088
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1089 ngx_str_t in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1090 in.data = p;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1091 in.len = plen - pnl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1092
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1093 ngx_str_t ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1094 ad.len = p - b;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1095 ad.data = ngx_pnalloc(c->pool, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1096 if (ad.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1097 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1098 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1099
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1100 ngx_memcpy(ad.data, b, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1101 ad.data[0] = clearflags;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1102 ad.data[ad.len - pnl] = (u_char)pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1103
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1104 uint8_t *nonce = ngx_pstrdup(c->pool, &qc->client_hs.iv);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1105 nonce[11] ^= pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1106
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1107 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1108 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1109
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1110 u_char *name = (u_char *) SSL_get_cipher(c->ssl->connection);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1111 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1112 "quic ssl cipher: %s", name);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1113
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1114 if (ngx_strcasecmp(name, (u_char *) "TLS_AES_128_GCM_SHA256") == 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1115 || ngx_strcasecmp(name, (u_char *) "(NONE)") == 0)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1116 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1117 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1118
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1119 } else if (ngx_strcasecmp(name, (u_char *) "TLS_AES_256_GCM_SHA384") == 0) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1120 cipher = EVP_aes_256_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1121
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1122 } else {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1123 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1124 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1125 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1126
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1127 if (ngx_quic_tls_open(c, cipher, &qc->client_hs, &out, nonce, &in, &ad)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1128 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1129 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1130 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1131 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1132
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1133 ngx_quic_hexdump0(c->log, "packet payload", out.data, out.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1134
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1135 if (out.data[0] != 0x06) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1136 ngx_log_error(NGX_LOG_INFO, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1137 "non-CRYPTO frame in HS packet, skipping");
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1138 return NGX_OK;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1139 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1140
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1141 if (out.data[1] != 0x00) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1142 ngx_log_error(NGX_LOG_INFO, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1143 "not yet supported CRYPTO offset in initial packet");
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1144 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1145 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1146
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1147 uint8_t *crypto = &out.data[2];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1148 uint64_t crypto_len = ngx_quic_parse_int(&crypto);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1149
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1150 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1151 "quic Handshake packet CRYPTO length: %uL pp:%p:%p",
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1152 crypto_len, out.data, crypto);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1153
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1154 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1155 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1156 (int) SSL_quic_read_level(c->ssl->connection),
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1157 (int) SSL_quic_write_level(c->ssl->connection));
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1158
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1159 if (!SSL_provide_quic_data(c->ssl->connection,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1160 SSL_quic_read_level(c->ssl->connection),
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1161 crypto, crypto_len))
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1162 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1163 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1164 "SSL_provide_quic_data() failed");
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1165 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1166 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1167
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1168 n = SSL_do_handshake(c->ssl->connection);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1169
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1170 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1171
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1172 if (n == -1) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1173 sslerr = SSL_get_error(c->ssl->connection, n);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1174
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1175 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1176 sslerr);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1177
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1178 if (sslerr == SSL_ERROR_SSL) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1179 ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1180 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1181 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1182
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1183 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1184 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1185 (int) SSL_quic_read_level(c->ssl->connection),
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1186 (int) SSL_quic_write_level(c->ssl->connection));
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1187
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1188 // ACK Client Finished
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1189
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1190 ngx_str_t payload, res;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1191 ngx_quic_header_t pkt;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1192 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1193
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1194 pkt.level = ssl_encryption_handshake;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1195 pkt.number = &qc->handshake_pn;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1196 pkt.flags = NGX_QUIC_PKT_HANDSHAKE;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1197 pkt.secret = &qc->server_hs;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1198
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1199 payload.data = ngx_alloc(5 /*minimal ACK*/, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1200 if (payload.data == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1201 return 0;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1202 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1203
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1204 p = payload.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1205 ngx_quic_create_ack(&p, pn);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1206
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1207 payload.len = p - payload.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1208
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1209 if (ngx_quic_create_long_packet(c, c->ssl->connection, &pkt, &payload, &res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1210 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1211 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1212 return 0;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1213 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1214
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1215 qc->out = res;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1216
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1217 if (ngx_quic_output(c) != NGX_OK) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1218 return 0;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1219 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1220
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1221 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1222 }
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1223
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1224
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1225 uint64_t
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1226 ngx_quic_parse_int(u_char **pos)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1227 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1228 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1229 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1230 ngx_uint_t len;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1231
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1232 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1233 len = 1 << ((*p & 0xc0) >> 6);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1234 value = *p++ & 0x3f;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1235
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1236 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1237 value = (value << 8) + *p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1238 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1239
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1240 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1241 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1242 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1243
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1244
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1245 void
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1246 ngx_quic_build_int(u_char **pos, uint64_t value)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1247 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1248 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1249 ngx_uint_t len;//, len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1250
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1251 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1252 len = 0;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1253
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1254 while (value >> ((1 << len) * 8 - 2)) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1255 len++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1256 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1257
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1258 *p = len << 6;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1259
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1260 // len2 =
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1261 len = (1 << len);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1262 len--;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1263 *p |= value >> (len * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1264 p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1265
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1266 while (len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1267 *p++ = value >> ((len-- - 1) * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1268 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1269
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1270 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1271 // return len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1272 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1273
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1274
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1275 static uint64_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1276 ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1277 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1278 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1279 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1280
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1281 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1282 value = *p++ ^ *mask++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1283
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1284 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1285 value = (value << 8) + (*p++ ^ *mask++);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1286 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1287
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1288 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1289 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1290 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1291
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1292
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1293 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1294 ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1295 const u_char *secret, size_t secret_len, const u_char *salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1296 size_t salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1297 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1298 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1299 if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1300 salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1301 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1302 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1303 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1304 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1305 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1306
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1307 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1308
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1309 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1310
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1311 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1312 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1313 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1314
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1315 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1316 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1317 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1318
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1319 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1320 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1321 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1322
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1323 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1324 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1325 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1326
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1327 if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1328 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1329 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1330
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1331 if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1332 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1333 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1334
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1335 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1336
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1337 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1338 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1339
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1340
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1341 static ngx_int_t
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1342 ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest, ngx_str_t *out,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1343 ngx_str_t *label, const uint8_t *prk, size_t prk_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1344 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1345 uint8_t *p;
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1346 size_t info_len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1347 uint8_t info[20];
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1348
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1349 out->data = ngx_pnalloc(c->pool, out->len);
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1350 if (out->data == NULL) {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1351 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1352 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1353
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1354 info_len = 2 + 1 + label->len + 1;
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1355
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1356 info[0] = 0;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1357 info[1] = out->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1358 info[2] = label->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1359 p = ngx_cpymem(&info[3], label->data, label->len);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1360 *p = '\0';
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1361
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1362 if (ngx_hkdf_expand(out->data, out->len, digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1363 prk, prk_len, info, info_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1364 != NGX_OK)
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1365 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1366 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1367 "ngx_hkdf_expand(%V) failed", label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1368 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1369 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1370
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1371 ngx_quic_hexdump(c->log, "%V info", info, info_len, label);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1372 ngx_quic_hexdump(c->log, "%V key", out->data, out->len, label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1373
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1374 return NGX_OK;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1375 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1376
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1377
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1378 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1379 ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1380 const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1381 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1382 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1383 if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1384 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1385 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1386 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1387 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1388 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1389
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1390 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1391
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1392 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1393
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1394 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1395 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1396 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1397
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1398 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1399 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1400 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1401
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1402 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1403 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1404 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1405
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1406 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1407 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1408 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1409
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1410 if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1411 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1412 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1413
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1414 if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1415 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1416 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1417
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1418 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1419
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1420 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1421 }
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1422
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1423
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1424 static ngx_int_t
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1425 ngx_quic_tls_open(ngx_connection_t *c, const EVP_CIPHER *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1426 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1427 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1428 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1429 out->len = in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1430 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1431 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1432 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1433 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1434
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1435 #ifdef OPENSSL_IS_BORINGSSLL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1436 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1437
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1438 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1439 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1440 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1441 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1442 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1443 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1444
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1445 if (EVP_AEAD_CTX_open(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1446 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1447 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1448 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1449 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1450 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_open() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1451 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1452 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1453
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1454 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1455 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1456 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1457 u_char *tag;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1458 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1459
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1460 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1461 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1462 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1463 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1464 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1465
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1466 if (EVP_DecryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1467 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1468 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1469 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1470 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1471
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1472 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1473 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1474 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1475 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1476 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1477 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1478 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1479 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1480
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1481 if (EVP_DecryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1482 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1483 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1484 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1485 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1486
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1487 if (EVP_DecryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1488 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1489 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1490 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1491 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1492
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1493 if (EVP_DecryptUpdate(ctx, out->data, &len, in->data,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1494 in->len - EVP_GCM_TLS_TAG_LEN)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1495 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1496 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1497 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1498 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1499 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1500 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1501
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1502 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1503 tag = in->data + in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1504
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1505 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, EVP_GCM_TLS_TAG_LEN, tag)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1506 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1507 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1508 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1509 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1510 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1511 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1512 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1513
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1514 if (EVP_DecryptFinal_ex(ctx, out->data + len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1515 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1516 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1517 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1518 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1519
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1520 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1521
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1522 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1523 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1524
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1525 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1526 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1527
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1528
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1529 static ngx_int_t
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1530 ngx_quic_tls_seal(ngx_connection_t *c, const EVP_CIPHER *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1531 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1532 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1533 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1534 out->len = in->len + EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1535 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1536 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1537 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1538 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1539
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1540 #ifdef OPENSSL_IS_BORINGSSLL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1541 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1542
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1543 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1544 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1545 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1546 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1547 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1548 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1549
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1550 if (EVP_AEAD_CTX_seal(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1551 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1552 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1553 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1554 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1555 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_seal() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1556 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1557 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1558
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1559 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1560 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1561 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1562 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1563
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1564 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1565 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1566 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1567 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1568 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1569
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1570 if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1571 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1572 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1573 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1574 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1575
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1576 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1577 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1578 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1579 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1580 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1581 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1582 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1583 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1584
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1585 if (EVP_EncryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1586 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1587 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1588 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1589 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1590
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1591 if (EVP_EncryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1592 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1593 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1594 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1595 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1596
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1597 if (EVP_EncryptUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1598 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1599 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1600 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1601 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1602
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1603 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1604
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1605 if (EVP_EncryptFinal_ex(ctx, out->data + out->len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1606 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1607 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1608 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1609 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1610
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1611 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1612
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1613 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, EVP_GCM_TLS_TAG_LEN,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1614 out->data + in->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1615 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1616 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1617 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1618 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1619 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_GET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1620 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1621 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1622
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1623 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1624
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1625 out->len += EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1626 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1627
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1628 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1629 }
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1630
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1631
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1632 static ngx_int_t
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1633 ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1634 ngx_quic_secret_t *s, u_char *out, u_char *in)
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1635 {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1636 int outlen;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1637 EVP_CIPHER_CTX *ctx;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1638
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1639 ctx = EVP_CIPHER_CTX_new();
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1640 if (ctx == NULL) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1641 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1642 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1643
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1644 if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, NULL) != 1) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1645 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1646 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1647 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1648
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1649 if (!EVP_EncryptUpdate(ctx, out, &outlen, in, 16)) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1650 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1651 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1652 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1653
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1654 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1655
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1656 return NGX_OK;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1657
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1658 failed:
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1659
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1660 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1661
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1662 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
1663 }