Mercurial > hg > nginx

annotate src/event/ngx_event_quic.c @ 8204:9e0c30e1f7fb quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Compatibility with BoringSSL revised QUIC encryption secret APIs. See for details: https://boringssl.googlesource.com/boringssl/+/1e85905%5E!/
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 11 Mar 2020 21:53:02 +0300
parents ec0c44aa2881
children a5423632d67b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2 /*
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
3 * Copyright (C) Nginx, Inc.
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
4 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
5
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
6
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7 #include <ngx_config.h>
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 #include <ngx_core.h>
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
9
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
10
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
11 #define quic_version 0xff000018
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
13 #define NGX_AES_128_GCM_SHA256 0x1301
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
14 #define NGX_AES_256_GCM_SHA384 0x1302
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
15 #define NGX_CHACHA20_POLY1305_SHA256 0x1303
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
16
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
17 #define NGX_QUIC_IV_LEN 12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
18
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
19 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
20 #define ngx_quic_cipher_t EVP_AEAD
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
21 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
22 #define ngx_quic_cipher_t EVP_CIPHER
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
23 #endif
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
24
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
25
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
26 #if (NGX_HAVE_NONALIGNED)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
27
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
28 #define ngx_quic_parse_uint16(p) ntohs(*(uint16_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
29 #define ngx_quic_parse_uint32(p) ntohl(*(uint32_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
30
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
31 #define ngx_quic_write_uint16 ngx_quic_write_uint16_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
32 #define ngx_quic_write_uint32 ngx_quic_write_uint32_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
33
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
34 #else
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
35
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
36 #define ngx_quic_parse_uint16(p) ((p)[0] << 8 | (p)[1])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
37 #define ngx_quic_parse_uint32(p) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
38 ((uint32_t) (p)[0] << 24 | (p)[1] << 16 | (p)[2] << 8 | (p)[3])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
39
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
40 #define ngx_quic_write_uint16(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
41 ((p)[0] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
42 (p)[1] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
43 (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
44
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
45 #define ngx_quic_write_uint32(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
46 ((p)[0] = (u_char) ((s) >> 24), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
47 (p)[1] = (u_char) ((s) >> 16), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
48 (p)[2] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
49 (p)[3] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
50 (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
51
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
52 #endif
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
53
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
54
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
55 #define ngx_quic_write_uint16_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
56 (*(uint16_t *) (p) = htons((uint16_t) (s)), (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
57
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
58 #define ngx_quic_write_uint32_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
59 (*(uint32_t *) (p) = htonl((uint32_t) (s)), (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
60
8191
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
61 #define ngx_quic_varint_len(value) \
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
62 ((value) <= 63 ? 1 : (value) <= 16383 ? 2 : (value) <= 1073741823 ? 4 : 8)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
63
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
64
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
65 #if (NGX_DEBUG)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
66
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
67 #define ngx_quic_hexdump(log, fmt, data, len, ...) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
68 do { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
69 ngx_int_t m; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
70 u_char buf[2048]; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
71 \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
72 if (log->log_level & NGX_LOG_DEBUG_EVENT) { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
73 m = ngx_hex_dump(buf, (u_char *) data, ngx_min(len, 1024)) - buf; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
74 ngx_log_debug(NGX_LOG_DEBUG_EVENT, log, 0, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
75 "%s: " fmt " %*s%s, len: %uz", \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
76 __FUNCTION__, __VA_ARGS__, m, buf, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
77 len < 2048 ? "" : "...", len); \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
78 } \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
79 } while (0)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
80
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
81 #else
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
82
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
83 #define ngx_quic_hexdump(log, fmt, data, len, ...)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
84
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
85 #endif
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
86
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
87 #define ngx_quic_hexdump0(log, fmt, data, len) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
88 ngx_quic_hexdump(log, fmt "%s", data, len, "") \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
89
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
90
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
91 /* 17.2. Long Header Packets */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
92
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
93 #define NGX_QUIC_PKT_LONG 0x80
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
94
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
95 #define NGX_QUIC_PKT_INITIAL 0xc0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
96 #define NGX_QUIC_PKT_HANDSHAKE 0xe0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
97
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
98 /* 12.4. Frames and Frame Types */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
99 #define NGX_QUIC_FT_PADDING 0x00
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
100 #define NGX_QUIC_FT_PING 0x01
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
101 #define NGX_QUIC_FT_ACK 0x02
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
102 #define NGX_QUIC_FT_ACK_ECN 0x03
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
103 #define NGX_QUIC_FT_RESET_STREAM 0x04
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
104 #define NGX_QUIC_FT_STOP_SENDING 0x05
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
105 #define NGX_QUIC_FT_CRYPTO 0x06
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
106 #define NGX_QUIC_FT_NEW_TOKEN 0x07
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
107 #define NGX_QUIC_FT_STREAM 0x08 // - 0x0f
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
108 #define NGX_QUIC_FT_MAX_DATA 0x10
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
109 #define NGX_QUIC_FT_MAX_STREAM_DATA 0x11
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
110 #define NGX_QUIC_FT_MAX_STREAMS 0x12
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
111 #define NGX_QUIC_FT_MAX_STREAMS2 0x13 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
112 #define NGX_QUIC_FT_DATA_BLOCKED 0x14
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
113 #define NGX_QUIC_FT_STREAM_DATA_BLOCKED 0x15
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
114 #define NGX_QUIC_FT_STREAMS_BLOCKED 0x16
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
115 #define NGX_QUIC_FT_STREAMS_BLOCKED2 0x17 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
116 #define NGX_QUIC_FT_NEW_CONNECTION_ID 0x18
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
117 #define NGX_QUIC_FT_RETIRE_CONNECTION_ID 0x19
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
118 #define NGX_QUIC_FT_PATH_CHALLENGE 0x1a
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
119 #define NGX_QUIC_FT_PATH_RESPONSE 0x1b
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
120 #define NGX_QUIC_FT_CONNECTION_CLOSE 0x1c
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
121 #define NGX_QUIC_FT_CONNECTION_CLOSE2 0x1d // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
122 #define NGX_QUIC_FT_HANDSHAKE_DONE 0x1e
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
123
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
124
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
125 /* TODO: real states, these are stubs */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
126 typedef enum {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
127 NGX_QUIC_ST_INITIAL,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
128 NGX_QUIC_ST_HANDSHAKE,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
129 NGX_QUIC_ST_APP_DATA
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
130 } ngx_quic_state_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
131
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
132
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
133 typedef struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
134 ngx_str_t secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
135 ngx_str_t key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
136 ngx_str_t iv;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
137 ngx_str_t hp;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
138 } ngx_quic_secret_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
139
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
140 typedef struct {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
141 const ngx_quic_cipher_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
142 const EVP_CIPHER *hp;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
143 const EVP_MD *d;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
144 } ngx_quic_ciphers_t;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
145
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
146 typedef enum ssl_encryption_level_t ngx_quic_level_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
147
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
148 typedef struct ngx_quic_frame_s ngx_quic_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
149
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
150 typedef struct {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
151 ngx_uint_t pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
152
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
153 // input
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
154 uint64_t largest;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
155 uint64_t delay;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
156 uint64_t range_count;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
157 uint64_t first_range;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
158 uint64_t ranges[20];
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
159 /* ecn counts */
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
160 } ngx_quic_ack_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
161
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
162 typedef struct {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
163 size_t offset;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
164 size_t len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
165 u_char *data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
166 } ngx_quic_crypto_frame_t;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
167
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
168
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
169 struct ngx_quic_frame_s {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
170 ngx_uint_t type;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
171 ngx_quic_level_t level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
172 ngx_quic_frame_t *next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
173 union {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
174 ngx_quic_crypto_frame_t crypto;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
175 ngx_quic_ack_frame_t ack;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
176 // more frames
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
177 } u;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
178
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
179 u_char info[128]; // for debug purposes
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
180 };
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
181
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
182
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
183 struct ngx_quic_connection_s {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
184
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
185 ngx_quic_state_t state;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
186 ngx_ssl_t *ssl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
187
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
188 ngx_quic_frame_t *frames;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
189
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
190 ngx_str_t scid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
191 ngx_str_t dcid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
192 ngx_str_t token;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
193
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
194 /* current packet numbers for each namespace */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
195 ngx_uint_t initial_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
196 ngx_uint_t handshake_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
197 ngx_uint_t appdata_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
198
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
199 ngx_quic_secret_t client_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
200 ngx_quic_secret_t client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
201 ngx_quic_secret_t client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
202 ngx_quic_secret_t server_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
203 ngx_quic_secret_t server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
204 ngx_quic_secret_t server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
205 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
206
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
207
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
208 typedef struct {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
209 ngx_quic_secret_t *secret;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
210 ngx_uint_t type;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
211 ngx_uint_t *number;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
212 ngx_uint_t flags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
213 uint32_t version;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
214 ngx_str_t token;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
215 ngx_quic_level_t level;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
216
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
217 /* filled in by parser */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
218 ngx_str_t buf; /* quic packet from wire */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
219 u_char *pos; /* current parser position */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
220
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
221 /* cleartext fields */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
222 ngx_str_t dcid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
223 ngx_str_t scid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
224
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
225 uint64_t pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
226
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
227 ngx_str_t payload; /* decrypted payload */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
228
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
229 } ngx_quic_header_t;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
230
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
231
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
232 static ngx_int_t ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
233 ngx_buf_t *b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
234 static ngx_int_t ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *b);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
235 static ngx_int_t ngx_quic_app_input(ngx_connection_t *c, ngx_buf_t *b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
236
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
237 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
238 static int ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
239 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
240 const uint8_t *secret, size_t secret_len);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
241 static int ngx_quic_set_write_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
242 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
243 const uint8_t *secret, size_t secret_len);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
244 #else
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
245 static int ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
246 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
247 const uint8_t *write_secret, size_t secret_len);
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
248 #endif
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
249 static int ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
250 enum ssl_encryption_level_t level, const uint8_t *data, size_t len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
251 static ngx_int_t ngx_quic_create_long_packet(ngx_connection_t *c,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
252 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
253 ngx_str_t *res);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
254 static ngx_int_t ngx_quic_create_short_packet(ngx_connection_t *c,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
255 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
256 ngx_str_t *res);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
257 static int ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
258 static int ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
259 enum ssl_encryption_level_t level, uint8_t alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
260
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
261 static ngx_int_t ngx_quic_process_long_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
262 ngx_quic_header_t *pkt);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
263 static ngx_int_t ngx_quic_process_short_header(ngx_connection_t *c,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
264 ngx_quic_header_t *pkt);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
265 static ngx_int_t ngx_quic_process_initial_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
266 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
267 static ngx_int_t ngx_quic_process_handshake_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
268 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
269 static ngx_int_t ngx_quic_initial_secret(ngx_connection_t *c);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
270 static ngx_int_t ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
271
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
272 static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
273 static uint64_t ngx_quic_parse_int(u_char **pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
274 static void ngx_quic_build_int(u_char **pos, uint64_t value);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
275
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
276 static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
277 const EVP_MD *digest, const u_char *secret, size_t secret_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
278 const u_char *salt, size_t salt_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
279 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
280 const EVP_MD *digest, const u_char *prk, size_t prk_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
281 const u_char *info, size_t info_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
282
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
283 static ngx_int_t ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
284 ngx_str_t *out, ngx_str_t *label, const uint8_t *prk, size_t prk_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
285
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
286 static ngx_int_t ngx_quic_tls_open(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
287 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
288 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
289 static ngx_int_t ngx_quic_tls_seal(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
290 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
291 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
292
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
293 static ngx_int_t ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
294 ngx_quic_secret_t *s, u_char *out, u_char *in);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
295
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
296 static ngx_int_t ngx_quic_ciphers(ngx_connection_t *c,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
297 ngx_quic_ciphers_t *ciphers, enum ssl_encryption_level_t level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
298
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
299 static SSL_QUIC_METHOD quic_method = {
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
300 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
301 ngx_quic_set_read_secret,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
302 ngx_quic_set_write_secret,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
303 #else
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
304 ngx_quic_set_encryption_secrets,
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
305 #endif
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
306 ngx_quic_add_handshake_data,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
307 ngx_quic_flush_flight,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
308 ngx_quic_send_alert,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
309 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
310
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
311
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
312 void
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
313 ngx_quic_init_ssl_methods(SSL_CTX* ctx)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
314 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
315 SSL_CTX_set_quic_method(ctx, &quic_method);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
316 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
317
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
318
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
319 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
320 ngx_quic_input(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
321 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
322 if (c->quic == NULL) {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
323 return ngx_quic_new_connection(c, ssl, b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
324 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
325
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
326 if (b->start[0] & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
327 // TODO: check current state
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
328 return ngx_quic_handshake_input(c, b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
329 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
330
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
331 return ngx_quic_app_input(c, b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
332 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
333
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
334 static ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
335 ngx_quic_send_packet(ngx_connection_t *c, ngx_quic_connection_t *qc,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
336 ngx_quic_level_t level, ngx_str_t *payload)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
337 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
338 ngx_str_t res;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
339 ngx_quic_header_t pkt;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
340
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
341 static ngx_str_t initial_token = ngx_null_string;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
342
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
343 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
344 ngx_quic_hexdump0(c->log, "payload", payload->data, payload->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
345
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
346 pkt.level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
347
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
348 if (level == ssl_encryption_initial) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
349 pkt.number = &qc->initial_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
350 pkt.flags = NGX_QUIC_PKT_INITIAL;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
351 pkt.secret = &qc->server_in;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
352 pkt.token = initial_token;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
353
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
354 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
355 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
356 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
357 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
358 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
359 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
360
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
361 } else if (level == ssl_encryption_handshake) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
362 pkt.number = &qc->handshake_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
363 pkt.flags = NGX_QUIC_PKT_HANDSHAKE;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
364 pkt.secret = &qc->server_hs;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
365
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
366 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
367 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
368 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
369 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
370 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
371 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
372
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
373 } else {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
374 pkt.number = &qc->appdata_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
375 pkt.secret = &qc->server_ad;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
376
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
377 if (ngx_quic_create_short_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
378 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
379 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
380 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
381 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
382 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
383 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
384
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
385 ngx_quic_hexdump0(c->log, "packet to send", res.data, res.len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
386
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
387 c->send(c, res.data, res.len); // TODO: err handling
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
388
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
389 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
390 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
391
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
392
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
393 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
394 ngx_quic_create_ack(u_char *p, ngx_quic_ack_frame_t *ack)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
395 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
396 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
397 return 5; /* minimal ACK */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
398 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
399
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
400 ngx_quic_build_int(&p, NGX_QUIC_FT_ACK);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
401 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
402 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
403 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
404 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
405
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
406 return 5;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
407 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
408
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
409
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
410 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
411 ngx_quic_create_crypto(u_char *p, ngx_quic_crypto_frame_t *crypto)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
412 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
413 u_char *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
414
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
415 if (p == NULL) {
8192
fb0879c65650 Fixed ngx_quic_varint_len misuse in the previous change.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8191
diff changeset
416 return 2 + ngx_quic_varint_len(crypto->len) + crypto->len;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
417 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
418
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
419 start = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
420
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
421 ngx_quic_build_int(&p, NGX_QUIC_FT_CRYPTO);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
422 ngx_quic_build_int(&p, crypto->offset);
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
423 ngx_quic_build_int(&p, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
424 p = ngx_cpymem(p, crypto->data, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
425
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
426 return p - start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
427 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
428
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
429 size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
430 ngx_quic_frame_len(ngx_quic_frame_t *frame)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
431 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
432 switch (frame->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
433 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
434 return ngx_quic_create_ack(NULL, &frame->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
435 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
436 return ngx_quic_create_crypto(NULL, &frame->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
437 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
438 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
439 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
440 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
441 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
442
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
443
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
444 /* pack a group of frames [start; end) into memory p and send as single packet */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
445 ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
446 ngx_quic_frames_send(ngx_connection_t *c, ngx_quic_frame_t *start,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
447 ngx_quic_frame_t *end, size_t total)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
448 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
449 u_char *p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
450 ngx_str_t out;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
451 ngx_quic_frame_t *f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
452
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
453 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
454 "sending frames %p...%p", start, end);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
455
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
456 p = ngx_pnalloc(c->pool, total);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
457 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
458 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
459 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
460
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
461 out.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
462
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
463 for (f = start; f != end; f = f->next) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
464
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
465 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "frame: %s", f->info);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
466
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
467 switch (f->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
468 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
469 p += ngx_quic_create_ack(p, &f->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
470 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
471
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
472 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
473 p += ngx_quic_create_crypto(p, &f->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
474 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
475
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
476 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
477 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
478 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
479 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
480 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
481
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
482 out.len = p - out.data;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
483
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
484 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
485 "packet ready: %ui bytes at level %d",
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
486 out.len, start->level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
487
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
488 // IOVEC/sendmsg_chain ?
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
489 if (ngx_quic_send_packet(c, c->quic, start->level, &out) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
490 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
491 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
492
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
493 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
494 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
495
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
496
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
497 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
498 ngx_quic_output(ngx_connection_t *c)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
499 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
500 size_t len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
501 ngx_uint_t lvl;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
502 ngx_quic_frame_t *f, *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
503 ngx_quic_connection_t *qc;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
504
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
505 qc = c->quic;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
506
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
507 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
508 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
509 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
510
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
511 lvl = qc->frames->level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
512 start = qc->frames;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
513 f = start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
514
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
515 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
516 len = 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
517
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
518 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
519 /* process same-level group of frames */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
520
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
521 len += ngx_quic_frame_len(f);// TODO: handle overflow, max size
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
522
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
523 f = f->next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
524 } while (f && f->level == lvl);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
525
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
526
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
527 if (ngx_quic_frames_send(c, start, f, len) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
528 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
529 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
530
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
531 if (f == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
532 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
533 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
534
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
535 lvl = f->level; // TODO: must not decrease (ever, also between calls)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
536 start = f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
537
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
538 } while (1);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
539
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
540 qc->frames = NULL;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
541
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
542 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
543 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
544
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
545
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
546 #if BORINGSSL_API_VERSION >= 10
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
547
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
548 static int
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
549 ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
550 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
551 const uint8_t *secret, size_t secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
552 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
553 ngx_int_t key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
554 ngx_uint_t i;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
555 ngx_connection_t *c;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
556 ngx_quic_secret_t *client;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
557 ngx_quic_ciphers_t ciphers;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
558
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
559 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
560
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
561 ngx_quic_hexdump(c->log, "level:%d read", secret, secret_len, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
562
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
563 key_len = ngx_quic_ciphers(c, &ciphers, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
564
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
565 if (key_len == NGX_ERROR) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
566 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
567 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
568 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
569
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
570 switch (level) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
571
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
572 case ssl_encryption_handshake:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
573 client = &c->quic->client_hs;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
574 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
575
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
576 case ssl_encryption_application:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
577 client = &c->quic->client_ad;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
578 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
579
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
580 default:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
581 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
582 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
583
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
584 client->key.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
585 client->iv.len = NGX_QUIC_IV_LEN;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
586 client->hp.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
587
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
588 struct {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
589 ngx_str_t label;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
590 ngx_str_t *key;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
591 const uint8_t *secret;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
592 } seq[] = {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
593 { ngx_string("tls13 quic key"), &client->key, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
594 { ngx_string("tls13 quic iv"), &client->iv, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
595 { ngx_string("tls13 quic hp"), &client->hp, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
596 };
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
597
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
598 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
599
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
600 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
601 seq[i].secret, secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
602 != NGX_OK)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
603 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
604 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
605 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
606 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
607
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
608 return 1;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
609 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
610
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
611
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
612 static int
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
613 ngx_quic_set_write_secret(ngx_ssl_conn_t *ssl_conn,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
614 enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
615 const uint8_t *secret, size_t secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
616 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
617 ngx_int_t key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
618 ngx_uint_t i;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
619 ngx_connection_t *c;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
620 ngx_quic_secret_t *server;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
621 ngx_quic_ciphers_t ciphers;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
622
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
623 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
624
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
625 ngx_quic_hexdump(c->log, "level:%d write", secret, secret_len, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
626
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
627 key_len = ngx_quic_ciphers(c, &ciphers, level);
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
628
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
629 if (key_len == NGX_ERROR) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
630 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
631 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
632 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
633
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
634 switch (level) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
635
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
636 case ssl_encryption_handshake:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
637 server = &c->quic->server_hs;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
638 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
639
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
640 case ssl_encryption_application:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
641 server = &c->quic->server_ad;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
642 break;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
643
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
644 default:
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
645 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
646 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
647
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
648 server->key.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
649 server->iv.len = NGX_QUIC_IV_LEN;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
650 server->hp.len = key_len;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
651
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
652 struct {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
653 ngx_str_t label;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
654 ngx_str_t *key;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
655 const uint8_t *secret;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
656 } seq[] = {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
657 { ngx_string("tls13 quic key"), &server->key, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
658 { ngx_string("tls13 quic iv"), &server->iv, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
659 { ngx_string("tls13 quic hp"), &server->hp, secret },
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
660 };
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
661
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
662 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
663
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
664 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
665 seq[i].secret, secret_len)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
666 != NGX_OK)
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
667 {
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
668 return 0;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
669 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
670 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
671
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
672 return 1;
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
673 }
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
674
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
675 #else
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
676
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
677 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
678 ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
679 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
680 const uint8_t *write_secret, size_t secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
681 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
682 ngx_int_t key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
683 ngx_uint_t i;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
684 ngx_connection_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
685 ngx_quic_secret_t *client, *server;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
686 ngx_quic_ciphers_t ciphers;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
687
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
688 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
689
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
690 ngx_quic_hexdump(c->log, "level:%d read", read_secret, secret_len, level);
8196
d447168ed13f Fixed write secret logging in set_encryption_secrets callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8195
diff changeset
691 ngx_quic_hexdump(c->log, "level:%d write", write_secret, secret_len, level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
692
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
693 key_len = ngx_quic_ciphers(c, &ciphers, level);
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
694
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
695 if (key_len == NGX_ERROR) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
696 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
697 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
698 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
699
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
700 switch (level) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
701
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
702 case ssl_encryption_handshake:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
703 client = &c->quic->client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
704 server = &c->quic->server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
705
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
706 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
707
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
708 case ssl_encryption_application:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
709 client = &c->quic->client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
710 server = &c->quic->server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
711
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
712 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
713
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
714 default:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
715 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
716 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
717
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
718 client->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
719 server->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
720
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
721 client->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
722 server->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
723
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
724 client->hp.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
725 server->hp.len = key_len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
726
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
727 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
728 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
729 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
730 const uint8_t *secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
731 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
732 { ngx_string("tls13 quic key"), &client->key, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
733 { ngx_string("tls13 quic iv"), &client->iv, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
734 { ngx_string("tls13 quic hp"), &client->hp, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
735 { ngx_string("tls13 quic key"), &server->key, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
736 { ngx_string("tls13 quic iv"), &server->iv, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
737 { ngx_string("tls13 quic hp"), &server->hp, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
738 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
739
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
740 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
741
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
742 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
743 seq[i].secret, secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
744 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
745 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
746 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
747 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
748 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
749
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
750 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
751 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
752
8204
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
753 #endif
9e0c30e1f7fb Compatibility with BoringSSL revised QUIC encryption secret APIs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8203
diff changeset
754
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
755
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
756 static ngx_int_t
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
757 ngx_quic_create_long_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
758 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
759 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
760 u_char *p, *pnp, *nonce, *sample, *packet;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
761 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
762 ngx_quic_ciphers_t ciphers;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
763 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
764 u_char mask[16];
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
765
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
766 qc = c->quic;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
767
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
768 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
769
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
770 ad.data = ngx_alloc(346 /*max header*/, c->log);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
771 if (ad.data == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
772 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
773 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
774
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
775 p = ad.data;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
776
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
777 *p++ = pkt->flags;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
778
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
779 p = ngx_quic_write_uint32(p, quic_version);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
780
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
781 *p++ = qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
782 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
783
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
784 *p++ = qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
785 p = ngx_cpymem(p, qc->dcid.data, qc->dcid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
786
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
787 if (pkt->level == ssl_encryption_initial) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
788 ngx_quic_build_int(&p, pkt->token.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
789 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
790
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
791 ngx_quic_build_int(&p, out.len + 1); // length (inc. pnl)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
792 pnp = p;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
793
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
794 *p++ = (*pkt->number)++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
795
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
796 ad.len = p - ad.data;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
797
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
798 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
799
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
800 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
801 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
802 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
803
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
804 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
805 if (pkt->level == ssl_encryption_handshake) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
806 nonce[11] ^= (*pkt->number - 1);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
807 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
808
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
809 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
810 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
811
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
812 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
813 != NGX_OK)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
814 {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
815 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
816 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
817
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
818 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
819 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
820 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
821 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
822
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
823 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
824 ngx_quic_hexdump0(c->log, "mask", mask, 16);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
825 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
826
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
827 // header protection, pnl = 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
828 ad.data[0] ^= mask[0] & 0x0f;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
829 *pnp ^= mask[1];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
830
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
831 packet = ngx_alloc(ad.len + out.len, c->log);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
832 if (packet == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
833 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
834 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
835
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
836 p = ngx_cpymem(packet, ad.data, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
837 p = ngx_cpymem(p, out.data, out.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
838
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
839 res->data = packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
840 res->len = p - packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
841
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
842 return NGX_OK;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
843 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
844
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
845
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
846 static ngx_int_t
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
847 ngx_quic_create_short_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
848 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
849 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
850 u_char *p, *pnp, *nonce, *sample, *packet;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
851 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
852 ngx_quic_ciphers_t ciphers;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
853 ngx_quic_connection_t *qc;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
854 u_char mask[16];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
855
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
856 qc = c->quic;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
857
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
858 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
859
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
860 ad.data = ngx_alloc(25 /*max header*/, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
861 if (ad.data == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
862 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
863 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
864
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
865 p = ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
866
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
867 *p++ = 0x40;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
868
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
869 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
870
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
871 pnp = p;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
872
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
873 *p++ = (*pkt->number)++;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
874
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
875 ad.len = p - ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
876
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
877 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
878
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
879 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
880 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
881 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
882
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
883 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8200
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
884 if (pkt->level == ssl_encryption_handshake
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
885 || pkt->level == ssl_encryption_application)
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
886 {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
887 nonce[11] ^= (*pkt->number - 1);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
888 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
889
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
890 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
891 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
892
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
893 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
894 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
895 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
896 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
897 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
898
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
899 ngx_quic_hexdump0(c->log, "out", out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
900
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
901 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
902 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
903 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
904 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
905
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
906 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
907 ngx_quic_hexdump0(c->log, "mask", mask, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
908 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
909
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
910 // header protection, pnl = 0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
911 ad.data[0] ^= mask[0] & 0x1f;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
912 *pnp ^= mask[1];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
913
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
914 packet = ngx_alloc(ad.len + out.len, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
915 if (packet == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
916 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
917 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
918
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
919 p = ngx_cpymem(packet, ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
920 p = ngx_cpymem(p, out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
921
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
922 ngx_quic_hexdump0(c->log, "packet", packet, p - packet);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
923
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
924 res->data = packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
925 res->len = p - packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
926
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
927 return NGX_OK;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
928 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
929
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
930
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
931 static void
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
932 ngx_quic_queue_frame(ngx_quic_connection_t *qc, ngx_quic_frame_t *frame)
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
933 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
934 ngx_quic_frame_t *f;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
935
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
936 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
937 qc->frames = frame;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
938 return;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
939 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
940
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
941 for (f = qc->frames; f->next; f = f->next) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
942 if (f->next->level > frame->level) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
943 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
944 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
945 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
946
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
947 frame->next = f->next;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
948 f->next = frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
949 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
950
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
951
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
952 static int
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
953 ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
954 enum ssl_encryption_level_t level, const uint8_t *data, size_t len)
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
955 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
956 u_char *p;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
957 ngx_quic_frame_t *frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
958 ngx_connection_t *c;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
959 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
960
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
961 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
962 qc = c->quic;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
963
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
964 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
965 "ngx_quic_add_handshake_data");
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
966
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
967 frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
968 if (frame == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
969 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
970 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
971
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
972 p = ngx_pnalloc(c->pool, len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
973 if (p == NULL) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
974 return 0;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
975 }
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
976
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
977 ngx_memcpy(p, data, len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
978
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
979 frame->level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
980 frame->type = NGX_QUIC_FT_CRYPTO;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
981 frame->u.crypto.len = len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
982 frame->u.crypto.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
983
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
984 ngx_sprintf(frame->info, "crypto, generated by SSL len=%ui level=%d", len, level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
985
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
986 ngx_quic_queue_frame(qc, frame);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
987
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
988 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
989 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
990
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
991
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
992 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
993 ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
994 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
995 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
996
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
997 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
998
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
999 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_quic_flush_flight()");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1000
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1001 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1002 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1003
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1004
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1005 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1006 ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1007 uint8_t alert)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1008 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1009 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1010
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1011 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1012
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1013 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1014 "ngx_quic_send_alert(), lvl=%d, alert=%d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1015 (int) level, (int) alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1016
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1017 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1018 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1019
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1020
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1021 /* TODO: stub for short packet header processing */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1022 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1023 ngx_quic_process_short_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1024 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1025 u_char *p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1026
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1027 p = pkt->buf.data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1028
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1029 ngx_quic_hexdump0(c->log, "input", pkt->buf.data, pkt->buf.len);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1030
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1031 if ((p[0] & NGX_QUIC_PKT_LONG)) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1032 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a short packet");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1033 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1034 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1035
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1036 pkt->flags = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1037
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1038 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1039 "quic flags:%xi", pkt->flags);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1040
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1041 if (ngx_memcmp(p, c->quic->dcid.data, c->quic->dcid.len) != 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1042 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1043 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1044 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1045
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1046 pkt->dcid.data = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1047 p += c->quic->dcid.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1048
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1049 pkt->pos = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1050
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1051 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1052 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1053
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1054
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1055 static ngx_int_t
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1056 ngx_quic_process_long_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1057 {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1058 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1059
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1060 p = pkt->buf.data;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1061
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1062 ngx_quic_hexdump0(c->log, "input", pkt->buf.data, pkt->buf.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1063
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1064 if (!(p[0] & NGX_QUIC_PKT_LONG)) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1065 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a long packet");
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1066 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1067 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1068
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1069 pkt->flags = *p++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1070
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1071 pkt->version = ngx_quic_parse_uint32(p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1072 p += sizeof(uint32_t);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1073
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1074 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1075 "quic flags:%xi version:%xD", pkt->flags, pkt->version);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1076
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1077 if (pkt->version != quic_version) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1078 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unsupported quic version");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1079 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1080 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1081
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1082 pkt->dcid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1083 pkt->dcid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1084 p += pkt->dcid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1085
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1086 pkt->scid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1087 pkt->scid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1088 p += pkt->scid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1089
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1090 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1091
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1092 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1093 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1094
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1095
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1096 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1097 ngx_quic_process_initial_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1098 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1099 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1100 ngx_int_t plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1101
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1102 p = pkt->pos;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1103
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1104 pkt->token.len = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1105 pkt->token.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1106
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1107 p += pkt->token.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1108
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1109 plen = ngx_quic_parse_int(&p);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1110
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1111 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1112 "quic packet length: %d", plen);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1113
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1114 if (plen > pkt->buf.data + pkt->buf.len - p) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1115 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1116 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1117 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1118
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1119 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1120 pkt->buf.len = plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1121
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1122 ngx_quic_hexdump0(c->log, "DCID", pkt->dcid.data, pkt->dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1123 ngx_quic_hexdump0(c->log, "SCID", pkt->scid.data, pkt->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1124 ngx_quic_hexdump0(c->log, "token", pkt->token.data, pkt->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1125
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1126 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1127 "quic packet length: %d", plen);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1128
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1129 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1130 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1131
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1132 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1133 ngx_quic_process_handshake_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1134 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1135 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1136 ngx_int_t plen;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1137
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1138 p = pkt->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1139
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1140 plen = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1141
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1142 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1143 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1144
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1145 if (plen > pkt->buf.data + pkt->buf.len - p) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1146 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated handshake packet");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1147 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1148 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1149
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1150 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1151 pkt->buf.len = plen;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1152
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1153 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1154 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1155
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1156 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1157 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1158
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1159
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1160 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1161 ngx_quic_initial_secret(ngx_connection_t *c)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1162 {
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1163 size_t is_len;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1164 uint8_t is[SHA256_DIGEST_LENGTH];
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1165 ngx_uint_t i;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1166 const EVP_MD *digest;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1167 const EVP_CIPHER *cipher;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1168 ngx_quic_connection_t *qc;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1169
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1170 static const uint8_t salt[20] =
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1171 "\xc3\xee\xf7\x12\xc7\x2e\xbb\x5a\x11\xa7"
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1172 "\xd2\x43\x2b\xb4\x63\x65\xbe\xf9\xf5\x02";
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1173
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1174 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1175
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1176 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1177 digest = EVP_sha256();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1178
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1179 qc = c->quic;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1180
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1181 if (ngx_hkdf_extract(is, &is_len, digest, qc->dcid.data, qc->dcid.len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1182 salt, sizeof(salt))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1183 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1184 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1185 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1186 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1187
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1188 ngx_str_t iss = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1189 .data = is,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1190 .len = is_len
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1191 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1192
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1193 ngx_quic_hexdump0(c->log, "salt", salt, sizeof(salt));
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1194 ngx_quic_hexdump0(c->log, "initial secret", is, is_len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1195
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1196 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1197 qc->client_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1198 qc->server_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1199
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1200 qc->client_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1201 qc->server_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1202
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1203 qc->client_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1204 qc->server_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1205
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1206 qc->client_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1207 qc->server_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1208
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1209 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1210 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1211 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1212 ngx_str_t *prk;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1213 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1214
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1215 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1216 { ngx_string("tls13 client in"), &qc->client_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1217 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1218 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1219 &qc->client_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1220 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1221 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1222 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1223 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1224 &qc->client_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1225 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1226 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1227 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1228 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1229 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1230 &qc->client_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1231 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1232 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1233 { ngx_string("tls13 server in"), &qc->server_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1234 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1235 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1236 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1237 &qc->server_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1238 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1239 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1240 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1241 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1242 &qc->server_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1243 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1244 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1245 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1246 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1247 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1248 &qc->server_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1249 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1250 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1251
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1252 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1253
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1254 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1255
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1256 if (ngx_quic_hkdf_expand(c, digest, seq[i].key, &seq[i].label,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1257 seq[i].prk->data, seq[i].prk->len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1258 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1259 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1260 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1261 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1262 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1263
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1264 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1265 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1266
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1267
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1268 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1269 ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1270 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1271 u_char clearflags, *p, *sample;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1272 uint8_t *nonce;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1273 uint64_t pn;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1274 ngx_int_t pnl, rc;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1275 ngx_str_t in, ad;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1276 ngx_quic_ciphers_t ciphers;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1277 uint8_t mask[16];
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1278
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1279 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1280 return NGX_ERROR;
8198
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1281 }
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1282
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1283 p = pkt->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1284
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1285 /* draft-ietf-quic-tls-23#section-5.4.2:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1286 * the Packet Number field is assumed to be 4 bytes long
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1287 * draft-ietf-quic-tls-23#section-5.4.[34]:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1288 * AES-Based and ChaCha20-Based header protections sample 16 bytes
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1289 */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1290
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1291 sample = p + 4;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1292
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1293 ngx_quic_hexdump0(c->log, "sample", sample, 16);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1294
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1295 /* header protection */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1296
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1297 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1298 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1299 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1300
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1301 if (pkt->flags & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1302 clearflags = pkt->flags ^ (mask[0] & 0x0f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1303
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1304 } else {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1305 clearflags = pkt->flags ^ (mask[0] & 0x1f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1306 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1307
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1308 pnl = (clearflags & 0x03) + 1;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1309 pn = ngx_quic_parse_pn(&p, pnl, &mask[1]);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1310
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1311 pkt->pn = pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1312
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1313 ngx_quic_hexdump0(c->log, "mask", mask, 5);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1314 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1315 "quic clear flags: %xi", clearflags);
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1316 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1317 "quic packet number: %uL, len: %xi", pn, pnl);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1318
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1319 /* packet protection */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1320
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1321 in.data = p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1322
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1323 if (pkt->flags & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1324 in.len = pkt->buf.len - pnl;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1325
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1326 } else {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1327 in.len = pkt->buf.data + pkt->buf.len - p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1328 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1329
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1330 ad.len = p - pkt->buf.data;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1331 ad.data = ngx_pnalloc(c->pool, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1332 if (ad.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1333 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1334 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1335
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1336 ngx_memcpy(ad.data, pkt->buf.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1337 ad.data[0] = clearflags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1338 ad.data[ad.len - pnl] = (u_char) pn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1339
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1340 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1341 nonce[11] ^= pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1342
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1343 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1344 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1345
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1346 rc = ngx_quic_tls_open(c, ciphers.c, pkt->secret, &pkt->payload,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1347 nonce, &in, &ad);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1348
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1349 ngx_quic_hexdump0(c->log, "packet payload",
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1350 pkt->payload.data, pkt->payload.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1351
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1352 pkt->pos = pkt->payload.data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1353
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1354 return rc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1355 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1356
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1357
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1358 ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1359 ngx_quic_read_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1360 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1361 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1362 u_char *p, *end;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1363
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1364 size_t npad;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1365
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1366 p = pkt->pos;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1367 end = pkt->payload.data + pkt->payload.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1368
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1369 frame->type = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1370
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1371 switch (frame->type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1372
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1373 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1374 frame->u.crypto.offset = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1375 frame->u.crypto.len = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1376 frame->u.crypto.data = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1377 p += frame->u.crypto.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1378
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1379 ngx_quic_hexdump0(c->log, "CRYPTO frame",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1380 frame->u.crypto.data, frame->u.crypto.len);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1381
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1382 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1383 "quic CRYPTO frame length: %uL off:%uL pp:%p",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1384 frame->u.crypto.len, frame->u.crypto.offset,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1385 frame->u.crypto.data);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1386 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1387
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1388 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1389 npad = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1390 while (p < end && *p == NGX_QUIC_FT_PADDING) { // XXX
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1391 p++; npad++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1392 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1393
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1394 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1395 "PADDING frame length %uL", npad);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1396
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1397 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1398
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1399 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1400 case NGX_QUIC_FT_ACK_ECN:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1401
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1402 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ACK frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1403
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1404 frame->u.ack.largest = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1405 frame->u.ack.delay = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1406 frame->u.ack.range_count =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1407 frame->u.ack.first_range =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1408
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1409 if (frame->u.ack.range_count) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1410 frame->u.ack.ranges[0] = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1411 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1412
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1413 if (frame->type ==NGX_QUIC_FT_ACK_ECN) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1414 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1415 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1416
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1417 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1418
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1419 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1420 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "PING frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1421 p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1422 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1423 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1424 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1425 "unknown frame type %xi", frame->type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1426 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1427 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1428
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1429 pkt->pos = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1430
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1431 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1432 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1433
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1434
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1435 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1436 ngx_quic_handle_crypto_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1437 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1438 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1439 int sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1440 ssize_t n;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1441 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1442
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1443 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1444
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1445 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1446 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1447 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1448 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1449
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1450
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1451 if (!SSL_provide_quic_data(ssl_conn, SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1452 frame->u.crypto.data, frame->u.crypto.len))
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1453 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1454 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1455 "SSL_provide_quic_data() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1456 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1457 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1458
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1459 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1460
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1461 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1462
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1463 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1464 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1465
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1466 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1467 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1468
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1469 if (sslerr == SSL_ERROR_SSL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1470 ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1471 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1472 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1473
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1474 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1475 "quic ssl cipher: %s", SSL_get_cipher(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1476
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1477 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1478 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1479 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1480 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1481
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1482 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1483 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1484
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1485
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1486
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1487 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1488 ngx_quic_init_connection(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1489 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1490 int n, sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1491 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1492 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1493
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1494 /* STUB: initial_max_streams_uni=3, active_connection_id_limit=5 */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1495 static const uint8_t params[12] = "\x00\x0a\x00\x0e\x00\x01\x05\x00\x09\x00\x01\x03";
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1496
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1497 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1498
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1499 if (ngx_ssl_create_connection(qc->ssl, c, NGX_SSL_BUFFER) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1500 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1501 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1502
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1503 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1504
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1505 if (SSL_set_quic_transport_params(ssl_conn, params, sizeof(params)) == 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1506 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1507 "SSL_set_quic_transport_params() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1508 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1509 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1510
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1511 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1512
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1513 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1514
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1515 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1516 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1517
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1518 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1519 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1520 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1521
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1522 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1523 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1524 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1525 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1526
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1527 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1528 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1529
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1530
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1531 /* process all payload from the current packet and generate ack if required */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1532 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1533 ngx_quic_payload_handler(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1534 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1535 u_char *end;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1536 ngx_uint_t ack_this;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1537 ngx_quic_frame_t frame, *ack_frame;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1538 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1539
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1540 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1541 end = pkt->payload.data + pkt->payload.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1542
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1543 ack_this = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1544
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1545 while (pkt->pos < end) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1546
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1547 if (ngx_quic_read_frame(c, pkt, &frame) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1548 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1549 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1550
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1551 switch (frame.type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1552
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1553 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1554
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1555 // TODO: handle ack
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1556
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1557 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1558 "ACK: { largest=%ui delay=%ui first=%ui count=%ui}",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1559 frame.u.ack.largest,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1560 frame.u.ack.delay,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1561 frame.u.ack.first_range,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1562 frame.u.ack.range_count);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1563
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1564 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1565
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1566 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1567
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1568 if (frame.u.crypto.offset != 0x0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1569 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1570 "crypto frame with non-zero offset");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1571 // TODO: support packet spanning with offsets
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1572 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1573 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1574
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1575 if (ngx_quic_handle_crypto_frame(c, pkt, &frame) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1576 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1577 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1578
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1579 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1580
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1581 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1582
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1583 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1584 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1585
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1586 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1587 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1588 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1589
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1590 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1591 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1592 "unexpected frame type 0x%xd in packet", frame.type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1593 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1594 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1595 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1596
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1597 if (ack_this == 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1598 /* do not ack packets with ACKs and PADDING */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1599 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1600 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1601
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1602 // packet processed, ACK it now if required
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1603 // TODO: if (ack_required) ... - currently just ack each packet
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1604
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1605 ack_frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1606 if (ack_frame == NULL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1607 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1608 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1609
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1610 ack_frame->level = pkt->level;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1611 ack_frame->type = NGX_QUIC_FT_ACK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1612 ack_frame->u.ack.pn = pkt->pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1613
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1614 ngx_sprintf(ack_frame->info, "ACK for PN=%d from frame handler", pkt->pn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1615 ngx_quic_queue_frame(qc, ack_frame);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1616
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1617 return ngx_quic_output(c);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1618 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1619
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1620
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1621 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1622 ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1623 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1624 ngx_quic_connection_t *qc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1625
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1626 ngx_quic_header_t pkt = { 0 };
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1627
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1628 pkt.buf.data = b->start;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1629 pkt.buf.len = b->last - b->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1630
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1631 if (ngx_buf_size(b) < 1200) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1632 ngx_log_error(NGX_LOG_INFO, c->log, 0, "too small UDP datagram");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1633 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1634 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1635
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1636 if (ngx_quic_process_long_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1637 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1638 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1639
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1640 if ((pkt.flags & 0xf0) != NGX_QUIC_PKT_INITIAL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1641 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8195
2d7202fc05d1 Fixed format specifiers.
Vladimir Homutov <vl@nginx.com>
parents: 8194
diff changeset
1642 "invalid initial packet: 0x%xi", pkt.flags);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1643 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1644 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1645
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1646 if (ngx_quic_process_initial_header(c, &pkt) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1647 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1648 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1649
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1650 qc = ngx_pcalloc(c->pool, sizeof(ngx_quic_connection_t));
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1651 if (qc == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1652 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1653 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1654
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1655 c->quic = qc;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1656 qc->ssl = ssl;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1657
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1658 qc->dcid.len = pkt.dcid.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1659 qc->dcid.data = ngx_pnalloc(c->pool, pkt.dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1660 if (qc->dcid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1661 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1662 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1663 ngx_memcpy(qc->dcid.data, pkt.dcid.data, qc->dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1664
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1665 qc->scid.len = pkt.scid.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1666 qc->scid.data = ngx_pnalloc(c->pool, qc->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1667 if (qc->scid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1668 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1669 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1670 ngx_memcpy(qc->scid.data, pkt.scid.data, qc->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1671
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1672 qc->token.len = pkt.token.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1673 qc->token.data = ngx_pnalloc(c->pool, qc->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1674 if (qc->token.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1675 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1676 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1677 ngx_memcpy(qc->token.data, pkt.token.data, qc->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1678
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1679
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1680 if (ngx_quic_initial_secret(c) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1681 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1682 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1683
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1684 pkt.secret = &qc->client_in;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1685 pkt.level = ssl_encryption_initial;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1686
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1687 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1688 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1689 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1690
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1691 if (ngx_quic_init_connection(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1692 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1693 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1694
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1695 return ngx_quic_payload_handler(c, &pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1696 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1697
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1698
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1699 static ngx_int_t
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1700 ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *b)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1701 {
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1702 ngx_ssl_conn_t *ssl_conn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1703 ngx_quic_connection_t *qc;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1704
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1705 ngx_quic_header_t pkt = { 0 };
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1706
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1707 qc = c->quic;
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1708 ssl_conn = c->ssl->connection;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1709
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1710 pkt.buf.data = b->start;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1711 pkt.buf.len = b->last - b->pos;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1712
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1713 /* extract cleartext data into pkt */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1714 if (ngx_quic_process_long_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1715 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1716 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1717
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1718 if (pkt.dcid.len != qc->dcid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1719 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1720 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1721 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1722
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1723 if (ngx_memcmp(pkt.dcid.data, qc->dcid.data, qc->dcid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1724 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1725 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1726 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1727
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1728 if (pkt.scid.len != qc->scid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1729 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1730 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1731 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1732
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1733 if (ngx_memcmp(pkt.scid.data, qc->scid.data, qc->scid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1734 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1735 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1736 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1737
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1738 if ((pkt.flags & 0xf0) != NGX_QUIC_PKT_HANDSHAKE) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1739 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8195
2d7202fc05d1 Fixed format specifiers.
Vladimir Homutov <vl@nginx.com>
parents: 8194
diff changeset
1740 "invalid packet type: 0x%xi", pkt.flags);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1741 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1742 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1743
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1744 if (ngx_quic_process_handshake_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1745 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1746 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1747
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1748 pkt.secret = &qc->client_hs;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1749 pkt.level = ssl_encryption_handshake;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1750
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1751 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1752 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1753 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1754
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1755 return ngx_quic_payload_handler(c, &pkt);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1756 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1757
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1758
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1759 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1760 ngx_quic_app_input(ngx_connection_t *c, ngx_buf_t *b)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1761 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1762 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1763
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1764 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1765
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1766 /* TODO: this is a stub, untested */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1767
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1768 ngx_quic_header_t pkt = { 0 };
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1769
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1770 pkt.buf.data = b->start;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1771 pkt.buf.len = b->last - b->pos;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1772
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1773 if (ngx_quic_process_short_header(c, &pkt) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1774 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1775 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1776
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1777 pkt.secret = &qc->client_ad;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1778 pkt.level = ssl_encryption_application;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1779
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1780 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1781 return NGX_ERROR;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1782 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1783
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1784 return ngx_quic_payload_handler(c, &pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1785 }
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1786
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1787
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1788 uint64_t
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1789 ngx_quic_parse_int(u_char **pos)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1790 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1791 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1792 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1793 ngx_uint_t len;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1794
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1795 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1796 len = 1 << ((*p & 0xc0) >> 6);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1797 value = *p++ & 0x3f;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1798
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1799 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1800 value = (value << 8) + *p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1801 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1802
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1803 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1804 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1805 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1806
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1807
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1808 void
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1809 ngx_quic_build_int(u_char **pos, uint64_t value)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1810 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1811 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1812 ngx_uint_t len;//, len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1813
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1814 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1815 len = 0;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1816
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1817 while (value >> ((1 << len) * 8 - 2)) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1818 len++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1819 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1820
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1821 *p = len << 6;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1822
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1823 // len2 =
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1824 len = (1 << len);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1825 len--;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1826 *p |= value >> (len * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1827 p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1828
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1829 while (len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1830 *p++ = value >> ((len-- - 1) * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1831 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1832
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1833 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1834 // return len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1835 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1836
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1837
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1838 static uint64_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1839 ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1840 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1841 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1842 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1843
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1844 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1845 value = *p++ ^ *mask++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1846
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1847 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1848 value = (value << 8) + (*p++ ^ *mask++);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1849 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1850
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1851 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1852 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1853 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1854
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1855
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1856 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1857 ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1858 const u_char *secret, size_t secret_len, const u_char *salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1859 size_t salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1860 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1861 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1862 if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1863 salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1864 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1865 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1866 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1867 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1868 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1869
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1870 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1871
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1872 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1873
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1874 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1875 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1876 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1877
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1878 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1879 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1880 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1881
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1882 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1883 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1884 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1885
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1886 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1887 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1888 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1889
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1890 if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1891 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1892 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1893
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1894 if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1895 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1896 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1897
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1898 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1899
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1900 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1901 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1902
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1903
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1904 static ngx_int_t
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1905 ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest, ngx_str_t *out,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1906 ngx_str_t *label, const uint8_t *prk, size_t prk_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1907 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1908 uint8_t *p;
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1909 size_t info_len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1910 uint8_t info[20];
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1911
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1912 out->data = ngx_pnalloc(c->pool, out->len);
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1913 if (out->data == NULL) {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1914 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1915 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1916
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1917 info_len = 2 + 1 + label->len + 1;
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1918
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1919 info[0] = 0;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1920 info[1] = out->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1921 info[2] = label->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1922 p = ngx_cpymem(&info[3], label->data, label->len);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1923 *p = '\0';
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1924
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1925 if (ngx_hkdf_expand(out->data, out->len, digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1926 prk, prk_len, info, info_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1927 != NGX_OK)
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1928 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1929 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1930 "ngx_hkdf_expand(%V) failed", label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1931 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1932 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1933
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1934 ngx_quic_hexdump(c->log, "%V info", info, info_len, label);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1935 ngx_quic_hexdump(c->log, "%V key", out->data, out->len, label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1936
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1937 return NGX_OK;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1938 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1939
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1940
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1941 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1942 ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1943 const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1944 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1945 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1946 if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1947 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1948 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1949 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1950 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1951 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1952
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1953 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1954
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1955 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1956
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1957 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1958 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1959 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1960
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1961 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1962 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1963 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1964
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1965 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1966 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1967 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1968
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1969 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1970 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1971 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1972
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1973 if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1974 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1975 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1976
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1977 if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1978 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1979 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1980
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1981 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1982
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1983 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1984 }
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1985
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1986
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1987 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1988 ngx_quic_tls_open(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1989 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1990 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1991 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1992 out->len = in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1993 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1994 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1995 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1996 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1997
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1998 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1999 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2000
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2001 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2002 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2003 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2004 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2005 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2006 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2007
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2008 if (EVP_AEAD_CTX_open(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2009 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2010 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2011 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2012 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2013 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_open() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2014 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2015 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2016
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2017 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2018 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2019 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2020 u_char *tag;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2021 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2022
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2023 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2024 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2025 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2026 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2027 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2028
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2029 if (EVP_DecryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2030 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2031 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2032 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2033 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2034
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2035 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2036 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2037 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2038 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2039 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2040 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2041 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2042 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2043
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2044 if (EVP_DecryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2045 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2046 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2047 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2048 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2049
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2050 if (EVP_DecryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2051 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2052 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2053 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2054 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2055
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2056 if (EVP_DecryptUpdate(ctx, out->data, &len, in->data,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2057 in->len - EVP_GCM_TLS_TAG_LEN)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2058 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2059 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2060 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2061 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2062 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2063 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2064
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2065 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2066 tag = in->data + in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2067
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2068 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, EVP_GCM_TLS_TAG_LEN, tag)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2069 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2070 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2071 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2072 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2073 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2074 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2075 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2076
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2077 if (EVP_DecryptFinal_ex(ctx, out->data + len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2078 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2079 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2080 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2081 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2082
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2083 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2084
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2085 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2086 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2087
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2088 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2089 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2090
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2091
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2092 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2093 ngx_quic_tls_seal(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2094 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2095 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2096 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2097 out->len = in->len + EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2098 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2099 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2100 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2101 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2102
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2103 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2104 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2105
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2106 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2107 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2108 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2109 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2110 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2111 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2112
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2113 if (EVP_AEAD_CTX_seal(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2114 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2115 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2116 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2117 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2118 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_seal() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2119 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2120 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2121
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2122 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2123 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2124 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2125 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2126
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2127 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2128 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2129 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2130 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2131 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2132
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2133 if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2134 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2135 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2136 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2137 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2138
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2139 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2140 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2141 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2142 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2143 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2144 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2145 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2146 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2147
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2148 if (EVP_EncryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2149 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2150 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2151 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2152 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2153
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2154 if (EVP_EncryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2155 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2156 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2157 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2158 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2159
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2160 if (EVP_EncryptUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2161 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2162 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2163 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2164 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2165
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2166 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2167
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2168 if (EVP_EncryptFinal_ex(ctx, out->data + out->len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2169 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2170 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2171 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2172 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2173
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2174 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2175
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2176 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, EVP_GCM_TLS_TAG_LEN,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2177 out->data + in->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2178 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2179 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2180 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2181 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2182 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_GET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2183 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2184 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2185
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2186 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2187
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2188 out->len += EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2189 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2190
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2191 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2192 }
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2193
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2194
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2195 static ngx_int_t
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2196 ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2197 ngx_quic_secret_t *s, u_char *out, u_char *in)
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2198 {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2199 int outlen;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2200 EVP_CIPHER_CTX *ctx;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2201 u_char zero[5] = {0};
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2202
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2203 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2204 uint32_t counter;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2205
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2206 ngx_memcpy(&counter, in, sizeof(uint32_t));
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2207
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2208 if (cipher == (const EVP_CIPHER *) EVP_aead_chacha20_poly1305()) {
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2209 CRYPTO_chacha_20(out, zero, 5, s->hp.data, &in[4], counter);
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2210 return NGX_OK;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2211 }
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2212 #endif
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2213
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2214 ctx = EVP_CIPHER_CTX_new();
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2215 if (ctx == NULL) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2216 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2217 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2218
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2219 if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, in) != 1) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2220 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2221 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2222 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2223
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2224 if (!EVP_EncryptUpdate(ctx, out, &outlen, zero, 5)) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2225 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2226 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2227 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2228
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2229 if (!EVP_EncryptFinal_ex(ctx, out + 5, &outlen)) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2230 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_Ex() failed");
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2231 goto failed;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2232 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2233
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2234 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2235
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2236 return NGX_OK;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2237
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2238 failed:
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2239
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2240 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2241
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2242 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2243 }
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2244
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2245
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2246 static ngx_int_t
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2247 ngx_quic_ciphers(ngx_connection_t *c, ngx_quic_ciphers_t *ciphers,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2248 enum ssl_encryption_level_t level)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2249 {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2250 ngx_int_t id, len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2251
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2252 if (level == ssl_encryption_initial) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2253 id = NGX_AES_128_GCM_SHA256;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2254
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2255 } else {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2256 id = SSL_CIPHER_get_id(SSL_get_current_cipher(c->ssl->connection))
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2257 & 0xffff;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2258 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2259
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2260 switch (id) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2261
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2262 case NGX_AES_128_GCM_SHA256:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2263 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2264 ciphers->c = EVP_aead_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2265 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2266 ciphers->c = EVP_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2267 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2268 ciphers->hp = EVP_aes_128_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2269 ciphers->d = EVP_sha256();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2270 len = 16;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2271 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2272
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2273 case NGX_AES_256_GCM_SHA384:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2274 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2275 ciphers->c = EVP_aead_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2276 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2277 ciphers->c = EVP_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2278 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2279 ciphers->hp = EVP_aes_256_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2280 ciphers->d = EVP_sha384();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2281 len = 32;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2282 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2283
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2284 case NGX_CHACHA20_POLY1305_SHA256:
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2285 #ifdef OPENSSL_IS_BORINGSSL
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2286 ciphers->c = EVP_aead_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2287 #else
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2288 ciphers->c = EVP_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2289 #endif
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2290 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2291 ciphers->hp = (const EVP_CIPHER *) EVP_aead_chacha20_poly1305();
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2292 #else
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2293 ciphers->hp = EVP_chacha20();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2294 #endif
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2295 ciphers->d = EVP_sha256();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2296 len = 32;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2297 break;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2298
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2299 default:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2300 return NGX_ERROR;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2301 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2302
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2303 return len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2304 }