Mercurial > hg > nginx

annotate src/event/quic/ngx_event_quic_protection.h @ 8694:cef042935003 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: the "quic_host_key" directive. The token generation in QUIC is reworked. Single host key is used to generate all required keys of needed sizes using HKDF. The "quic_stateless_reset_token_key" directive is removed. Instead, the "quic_host_key" directive is used, which reads key from file, or sets it to random bytes if not specified.
author Vladimir Homutov <vl@nginx.com>
date Mon, 08 Feb 2021 16:49:33 +0300
parents 046c951e393a
children d4e02b3b734f
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8221
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
1
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
2 /*
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
3 * Copyright (C) Nginx, Inc.
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
4 */
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
5
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
6
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
7 #ifndef _NGX_EVENT_QUIC_PROTECTION_H_INCLUDED_
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
8 #define _NGX_EVENT_QUIC_PROTECTION_H_INCLUDED_
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
9
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
10
8347
a5141e6b3214 Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents: 8339
diff changeset
11 #include <ngx_config.h>
a5141e6b3214 Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents: 8339
diff changeset
12 #include <ngx_core.h>
a5141e6b3214 Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents: 8339
diff changeset
13
8694
cef042935003 QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents: 8673
diff changeset
14 #include <ngx_event_quic_transport.h>
cef042935003 QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents: 8673
diff changeset
15
8347
a5141e6b3214 Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents: 8339
diff changeset
16
8306
058a5af7ddfc Refactored QUIC secrets storage.
Vladimir Homutov <vl@nginx.com>
parents: 8303
diff changeset
17 #define NGX_QUIC_ENCRYPTION_LAST ((ssl_encryption_application) + 1)
058a5af7ddfc Refactored QUIC secrets storage.
Vladimir Homutov <vl@nginx.com>
parents: 8303
diff changeset
18
058a5af7ddfc Refactored QUIC secrets storage.
Vladimir Homutov <vl@nginx.com>
parents: 8303
diff changeset
19
8621
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
20 ngx_quic_keys_t *ngx_quic_keys_new(ngx_pool_t *pool);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
21 ngx_int_t ngx_quic_keys_set_initial_secret(ngx_pool_t *pool,
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
22 ngx_quic_keys_t *keys, ngx_str_t *secret);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
23 int ngx_quic_keys_set_encryption_secret(ngx_pool_t *pool, ngx_uint_t is_write,
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
24 ngx_quic_keys_t *keys, enum ssl_encryption_level_t level,
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
25 const SSL_CIPHER *cipher, const uint8_t *secret, size_t secret_len);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
26 ngx_uint_t ngx_quic_keys_available(ngx_quic_keys_t *keys,
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
27 enum ssl_encryption_level_t level);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
28 void ngx_quic_keys_discard(ngx_quic_keys_t *keys,
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
29 enum ssl_encryption_level_t level);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
30 void ngx_quic_keys_switch(ngx_connection_t *c, ngx_quic_keys_t *keys);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
31 ngx_int_t ngx_quic_keys_update(ngx_connection_t *c, ngx_quic_keys_t *keys);
8694
cef042935003 QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents: 8673
diff changeset
32 ngx_int_t ngx_quic_derive_key(ngx_log_t *log, const char *label,
cef042935003 QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents: 8673
diff changeset
33 ngx_str_t *secret, ngx_str_t *salt, u_char *out, size_t len);
8621
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
34 ngx_int_t ngx_quic_encrypt(ngx_quic_header_t *pkt, ngx_str_t *res);
9c3be23ddbe7 QUIC: refactored key handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8562
diff changeset
35 ngx_int_t ngx_quic_decrypt(ngx_quic_header_t *pkt, uint64_t *largest_pn);
8221
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
36
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
37
69345a26ba69 Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
38 #endif /* _NGX_EVENT_QUIC_PROTECTION_H_INCLUDED_ */