Mercurial > hg > nginx

annotate src/event/ngx_event_quic.c @ 8203:ec0c44aa2881 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Chacha20 header protection support with BoringSSL. BoringSSL lacks EVP for Chacha20. Here we use CRYPTO_chacha_20() instead.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 10 Mar 2020 19:15:12 +0300
parents a4ed2305ad2c
children 9e0c30e1f7fb
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2 /*
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
3 * Copyright (C) Nginx, Inc.
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
4 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
5
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
6
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7 #include <ngx_config.h>
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 #include <ngx_core.h>
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
9
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
10
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
11 #define quic_version 0xff000018
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
13 #define NGX_AES_128_GCM_SHA256 0x1301
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
14 #define NGX_AES_256_GCM_SHA384 0x1302
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
15 #define NGX_CHACHA20_POLY1305_SHA256 0x1303
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
16
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
17 #define NGX_QUIC_IV_LEN 12
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
18
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
19 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
20 #define ngx_quic_cipher_t EVP_AEAD
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
21 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
22 #define ngx_quic_cipher_t EVP_CIPHER
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
23 #endif
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
24
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
25
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
26 #if (NGX_HAVE_NONALIGNED)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
27
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
28 #define ngx_quic_parse_uint16(p) ntohs(*(uint16_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
29 #define ngx_quic_parse_uint32(p) ntohl(*(uint32_t *) (p))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
30
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
31 #define ngx_quic_write_uint16 ngx_quic_write_uint16_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
32 #define ngx_quic_write_uint32 ngx_quic_write_uint32_aligned
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
33
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
34 #else
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
35
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
36 #define ngx_quic_parse_uint16(p) ((p)[0] << 8 | (p)[1])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
37 #define ngx_quic_parse_uint32(p) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
38 ((uint32_t) (p)[0] << 24 | (p)[1] << 16 | (p)[2] << 8 | (p)[3])
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
39
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
40 #define ngx_quic_write_uint16(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
41 ((p)[0] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
42 (p)[1] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
43 (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
44
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
45 #define ngx_quic_write_uint32(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
46 ((p)[0] = (u_char) ((s) >> 24), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
47 (p)[1] = (u_char) ((s) >> 16), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
48 (p)[2] = (u_char) ((s) >> 8), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
49 (p)[3] = (u_char) (s), \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
50 (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
51
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
52 #endif
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
53
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
54
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
55 #define ngx_quic_write_uint16_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
56 (*(uint16_t *) (p) = htons((uint16_t) (s)), (p) + sizeof(uint16_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
57
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
58 #define ngx_quic_write_uint32_aligned(p, s) \
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
59 (*(uint32_t *) (p) = htonl((uint32_t) (s)), (p) + sizeof(uint32_t))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
60
8191
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
61 #define ngx_quic_varint_len(value) \
7bd7c4e24951 Macro for calculating size of varint.
Vladimir Homutov <vl@nginx.com>
parents: 8190
diff changeset
62 ((value) <= 63 ? 1 : (value) <= 16383 ? 2 : (value) <= 1073741823 ? 4 : 8)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
63
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
64
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
65 #if (NGX_DEBUG)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
66
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
67 #define ngx_quic_hexdump(log, fmt, data, len, ...) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
68 do { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
69 ngx_int_t m; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
70 u_char buf[2048]; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
71 \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
72 if (log->log_level & NGX_LOG_DEBUG_EVENT) { \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
73 m = ngx_hex_dump(buf, (u_char *) data, ngx_min(len, 1024)) - buf; \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
74 ngx_log_debug(NGX_LOG_DEBUG_EVENT, log, 0, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
75 "%s: " fmt " %*s%s, len: %uz", \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
76 __FUNCTION__, __VA_ARGS__, m, buf, \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
77 len < 2048 ? "" : "...", len); \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
78 } \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
79 } while (0)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
80
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
81 #else
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
82
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
83 #define ngx_quic_hexdump(log, fmt, data, len, ...)
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
84
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
85 #endif
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
86
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
87 #define ngx_quic_hexdump0(log, fmt, data, len) \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
88 ngx_quic_hexdump(log, fmt "%s", data, len, "") \
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
89
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
90
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
91 /* 17.2. Long Header Packets */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
92
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
93 #define NGX_QUIC_PKT_LONG 0x80
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
94
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
95 #define NGX_QUIC_PKT_INITIAL 0xc0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
96 #define NGX_QUIC_PKT_HANDSHAKE 0xe0
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
97
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
98 /* 12.4. Frames and Frame Types */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
99 #define NGX_QUIC_FT_PADDING 0x00
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
100 #define NGX_QUIC_FT_PING 0x01
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
101 #define NGX_QUIC_FT_ACK 0x02
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
102 #define NGX_QUIC_FT_ACK_ECN 0x03
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
103 #define NGX_QUIC_FT_RESET_STREAM 0x04
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
104 #define NGX_QUIC_FT_STOP_SENDING 0x05
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
105 #define NGX_QUIC_FT_CRYPTO 0x06
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
106 #define NGX_QUIC_FT_NEW_TOKEN 0x07
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
107 #define NGX_QUIC_FT_STREAM 0x08 // - 0x0f
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
108 #define NGX_QUIC_FT_MAX_DATA 0x10
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
109 #define NGX_QUIC_FT_MAX_STREAM_DATA 0x11
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
110 #define NGX_QUIC_FT_MAX_STREAMS 0x12
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
111 #define NGX_QUIC_FT_MAX_STREAMS2 0x13 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
112 #define NGX_QUIC_FT_DATA_BLOCKED 0x14
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
113 #define NGX_QUIC_FT_STREAM_DATA_BLOCKED 0x15
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
114 #define NGX_QUIC_FT_STREAMS_BLOCKED 0x16
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
115 #define NGX_QUIC_FT_STREAMS_BLOCKED2 0x17 // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
116 #define NGX_QUIC_FT_NEW_CONNECTION_ID 0x18
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
117 #define NGX_QUIC_FT_RETIRE_CONNECTION_ID 0x19
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
118 #define NGX_QUIC_FT_PATH_CHALLENGE 0x1a
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
119 #define NGX_QUIC_FT_PATH_RESPONSE 0x1b
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
120 #define NGX_QUIC_FT_CONNECTION_CLOSE 0x1c
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
121 #define NGX_QUIC_FT_CONNECTION_CLOSE2 0x1d // XXX
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
122 #define NGX_QUIC_FT_HANDSHAKE_DONE 0x1e
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
123
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
124
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
125 /* TODO: real states, these are stubs */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
126 typedef enum {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
127 NGX_QUIC_ST_INITIAL,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
128 NGX_QUIC_ST_HANDSHAKE,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
129 NGX_QUIC_ST_APP_DATA
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
130 } ngx_quic_state_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
131
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
132
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
133 typedef struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
134 ngx_str_t secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
135 ngx_str_t key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
136 ngx_str_t iv;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
137 ngx_str_t hp;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
138 } ngx_quic_secret_t;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
139
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
140 typedef struct {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
141 const ngx_quic_cipher_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
142 const EVP_CIPHER *hp;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
143 const EVP_MD *d;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
144 } ngx_quic_ciphers_t;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
145
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
146 typedef enum ssl_encryption_level_t ngx_quic_level_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
147
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
148 typedef struct ngx_quic_frame_s ngx_quic_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
149
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
150 typedef struct {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
151 ngx_uint_t pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
152
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
153 // input
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
154 uint64_t largest;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
155 uint64_t delay;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
156 uint64_t range_count;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
157 uint64_t first_range;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
158 uint64_t ranges[20];
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
159 /* ecn counts */
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
160 } ngx_quic_ack_frame_t;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
161
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
162 typedef struct {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
163 size_t offset;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
164 size_t len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
165 u_char *data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
166 } ngx_quic_crypto_frame_t;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
167
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
168
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
169 struct ngx_quic_frame_s {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
170 ngx_uint_t type;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
171 ngx_quic_level_t level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
172 ngx_quic_frame_t *next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
173 union {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
174 ngx_quic_crypto_frame_t crypto;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
175 ngx_quic_ack_frame_t ack;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
176 // more frames
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
177 } u;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
178
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
179 u_char info[128]; // for debug purposes
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
180 };
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
181
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
182
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
183 struct ngx_quic_connection_s {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
184
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
185 ngx_quic_state_t state;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
186 ngx_ssl_t *ssl;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
187
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
188 ngx_quic_frame_t *frames;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
189
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
190 ngx_str_t scid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
191 ngx_str_t dcid;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
192 ngx_str_t token;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
193
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
194 /* current packet numbers for each namespace */
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
195 ngx_uint_t initial_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
196 ngx_uint_t handshake_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
197 ngx_uint_t appdata_pn;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
198
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
199 ngx_quic_secret_t client_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
200 ngx_quic_secret_t client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
201 ngx_quic_secret_t client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
202 ngx_quic_secret_t server_in;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
203 ngx_quic_secret_t server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
204 ngx_quic_secret_t server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
205 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
206
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
207
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
208 typedef struct {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
209 ngx_quic_secret_t *secret;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
210 ngx_uint_t type;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
211 ngx_uint_t *number;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
212 ngx_uint_t flags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
213 uint32_t version;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
214 ngx_str_t token;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
215 ngx_quic_level_t level;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
216
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
217 /* filled in by parser */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
218 ngx_str_t buf; /* quic packet from wire */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
219 u_char *pos; /* current parser position */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
220
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
221 /* cleartext fields */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
222 ngx_str_t dcid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
223 ngx_str_t scid;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
224
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
225 uint64_t pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
226
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
227 ngx_str_t payload; /* decrypted payload */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
228
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
229 } ngx_quic_header_t;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
230
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
231
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
232 static ngx_int_t ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
233 ngx_buf_t *b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
234 static ngx_int_t ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *b);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
235 static ngx_int_t ngx_quic_app_input(ngx_connection_t *c, ngx_buf_t *b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
236
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
237 static int ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
238 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
239 const uint8_t *write_secret, size_t secret_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
240 static int ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
241 enum ssl_encryption_level_t level, const uint8_t *data, size_t len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
242 static ngx_int_t ngx_quic_create_long_packet(ngx_connection_t *c,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
243 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
244 ngx_str_t *res);
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
245 static ngx_int_t ngx_quic_create_short_packet(ngx_connection_t *c,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
246 ngx_ssl_conn_t *ssl_conn, ngx_quic_header_t *pkt, ngx_str_t *in,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
247 ngx_str_t *res);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
248 static int ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
249 static int ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
250 enum ssl_encryption_level_t level, uint8_t alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
251
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
252 static ngx_int_t ngx_quic_process_long_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
253 ngx_quic_header_t *pkt);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
254 static ngx_int_t ngx_quic_process_short_header(ngx_connection_t *c,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
255 ngx_quic_header_t *pkt);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
256 static ngx_int_t ngx_quic_process_initial_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
257 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
258 static ngx_int_t ngx_quic_process_handshake_header(ngx_connection_t *c,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
259 ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
260 static ngx_int_t ngx_quic_initial_secret(ngx_connection_t *c);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
261 static ngx_int_t ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
262
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
263 static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
264 static uint64_t ngx_quic_parse_int(u_char **pos);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
265 static void ngx_quic_build_int(u_char **pos, uint64_t value);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
266
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
267 static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
268 const EVP_MD *digest, const u_char *secret, size_t secret_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
269 const u_char *salt, size_t salt_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
270 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
271 const EVP_MD *digest, const u_char *prk, size_t prk_len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
272 const u_char *info, size_t info_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
273
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
274 static ngx_int_t ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
275 ngx_str_t *out, ngx_str_t *label, const uint8_t *prk, size_t prk_len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
276
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
277 static ngx_int_t ngx_quic_tls_open(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
278 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
279 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
280 static ngx_int_t ngx_quic_tls_seal(ngx_connection_t *c,
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
281 const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s, ngx_str_t *out,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
282 u_char *nonce, ngx_str_t *in, ngx_str_t *ad);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
283
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
284 static ngx_int_t ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
285 ngx_quic_secret_t *s, u_char *out, u_char *in);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
286
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
287 static ngx_int_t ngx_quic_ciphers(ngx_connection_t *c,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
288 ngx_quic_ciphers_t *ciphers, enum ssl_encryption_level_t level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
289
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
290 static SSL_QUIC_METHOD quic_method = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
291 ngx_quic_set_encryption_secrets,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
292 ngx_quic_add_handshake_data,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
293 ngx_quic_flush_flight,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
294 ngx_quic_send_alert,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
295 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
296
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
297
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
298 void
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
299 ngx_quic_init_ssl_methods(SSL_CTX* ctx)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
300 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
301 SSL_CTX_set_quic_method(ctx, &quic_method);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
302 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
303
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
304
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
305 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
306 ngx_quic_input(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
307 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
308 if (c->quic == NULL) {
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
309 return ngx_quic_new_connection(c, ssl, b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
310 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
311
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
312 if (b->start[0] & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
313 // TODO: check current state
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
314 return ngx_quic_handshake_input(c, b);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
315 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
316
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
317 return ngx_quic_app_input(c, b);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
318 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
319
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
320 static ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
321 ngx_quic_send_packet(ngx_connection_t *c, ngx_quic_connection_t *qc,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
322 ngx_quic_level_t level, ngx_str_t *payload)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
323 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
324 ngx_str_t res;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
325 ngx_quic_header_t pkt;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
326
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
327 static ngx_str_t initial_token = ngx_null_string;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
328
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
329 ngx_memzero(&pkt, sizeof(ngx_quic_header_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
330 ngx_quic_hexdump0(c->log, "payload", payload->data, payload->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
331
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
332 pkt.level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
333
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
334 if (level == ssl_encryption_initial) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
335 pkt.number = &qc->initial_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
336 pkt.flags = NGX_QUIC_PKT_INITIAL;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
337 pkt.secret = &qc->server_in;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
338 pkt.token = initial_token;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
339
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
340 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
341 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
342 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
343 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
344 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
345 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
346
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
347 } else if (level == ssl_encryption_handshake) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
348 pkt.number = &qc->handshake_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
349 pkt.flags = NGX_QUIC_PKT_HANDSHAKE;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
350 pkt.secret = &qc->server_hs;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
351
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
352 if (ngx_quic_create_long_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
353 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
354 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
355 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
356 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
357 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
358
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
359 } else {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
360 pkt.number = &qc->appdata_pn;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
361 pkt.secret = &qc->server_ad;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
362
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
363 if (ngx_quic_create_short_packet(c, c->ssl->connection,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
364 &pkt, payload, &res)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
365 != NGX_OK)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
366 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
367 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
368 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
369 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
370
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
371 ngx_quic_hexdump0(c->log, "packet to send", res.data, res.len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
372
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
373 c->send(c, res.data, res.len); // TODO: err handling
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
374
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
375 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
376 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
377
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
378
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
379 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
380 ngx_quic_create_ack(u_char *p, ngx_quic_ack_frame_t *ack)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
381 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
382 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
383 return 5; /* minimal ACK */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
384 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
385
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
386 ngx_quic_build_int(&p, NGX_QUIC_FT_ACK);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
387 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
388 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
389 ngx_quic_build_int(&p, 0);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
390 ngx_quic_build_int(&p, ack->pn);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
391
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
392 return 5;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
393 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
394
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
395
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
396 static size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
397 ngx_quic_create_crypto(u_char *p, ngx_quic_crypto_frame_t *crypto)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
398 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
399 u_char *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
400
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
401 if (p == NULL) {
8192
fb0879c65650 Fixed ngx_quic_varint_len misuse in the previous change.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8191
diff changeset
402 return 2 + ngx_quic_varint_len(crypto->len) + crypto->len;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
403 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
404
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
405 start = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
406
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
407 ngx_quic_build_int(&p, NGX_QUIC_FT_CRYPTO);
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
408 ngx_quic_build_int(&p, crypto->offset);
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
409 ngx_quic_build_int(&p, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
410 p = ngx_cpymem(p, crypto->data, crypto->len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
411
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
412 return p - start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
413 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
414
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
415 size_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
416 ngx_quic_frame_len(ngx_quic_frame_t *frame)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
417 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
418 switch (frame->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
419 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
420 return ngx_quic_create_ack(NULL, &frame->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
421 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
422 return ngx_quic_create_crypto(NULL, &frame->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
423 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
424 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
425 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
426 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
427 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
428
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
429
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
430 /* pack a group of frames [start; end) into memory p and send as single packet */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
431 ngx_int_t
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
432 ngx_quic_frames_send(ngx_connection_t *c, ngx_quic_frame_t *start,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
433 ngx_quic_frame_t *end, size_t total)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
434 {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
435 u_char *p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
436 ngx_str_t out;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
437 ngx_quic_frame_t *f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
438
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
439 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
440 "sending frames %p...%p", start, end);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
441
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
442 p = ngx_pnalloc(c->pool, total);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
443 if (p == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
444 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
445 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
446
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
447 out.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
448
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
449 for (f = start; f != end; f = f->next) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
450
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
451 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "frame: %s", f->info);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
452
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
453 switch (f->type) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
454 case NGX_QUIC_FT_ACK:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
455 p += ngx_quic_create_ack(p, &f->u.ack);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
456 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
457
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
458 case NGX_QUIC_FT_CRYPTO:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
459 p += ngx_quic_create_crypto(p, &f->u.crypto);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
460 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
461
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
462 default:
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
463 /* BUG: unsupported frame type generated */
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
464 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
465 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
466 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
467
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
468 out.len = p - out.data;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
469
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
470 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
471 "packet ready: %ui bytes at level %d",
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
472 out.len, start->level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
473
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
474 // IOVEC/sendmsg_chain ?
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
475 if (ngx_quic_send_packet(c, c->quic, start->level, &out) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
476 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
477 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
478
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
479 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
480 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
481
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
482
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
483 ngx_int_t
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
484 ngx_quic_output(ngx_connection_t *c)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
485 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
486 size_t len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
487 ngx_uint_t lvl;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
488 ngx_quic_frame_t *f, *start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
489 ngx_quic_connection_t *qc;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
490
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
491 qc = c->quic;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
492
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
493 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
494 return NGX_OK;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
495 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
496
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
497 lvl = qc->frames->level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
498 start = qc->frames;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
499 f = start;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
500
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
501 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
502 len = 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
503
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
504 do {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
505 /* process same-level group of frames */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
506
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
507 len += ngx_quic_frame_len(f);// TODO: handle overflow, max size
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
508
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
509 f = f->next;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
510 } while (f && f->level == lvl);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
511
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
512
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
513 if (ngx_quic_frames_send(c, start, f, len) != NGX_OK) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
514 return NGX_ERROR;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
515 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
516
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
517 if (f == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
518 break;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
519 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
520
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
521 lvl = f->level; // TODO: must not decrease (ever, also between calls)
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
522 start = f;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
523
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
524 } while (1);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
525
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
526 qc->frames = NULL;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
527
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
528 return NGX_OK;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
529 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
530
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
531
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
532 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
533 ngx_quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
534 enum ssl_encryption_level_t level, const uint8_t *read_secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
535 const uint8_t *write_secret, size_t secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
536 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
537 ngx_int_t key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
538 ngx_uint_t i;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
539 ngx_connection_t *c;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
540 ngx_quic_secret_t *client, *server;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
541 ngx_quic_ciphers_t ciphers;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
542
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
543 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
544
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
545 ngx_quic_hexdump(c->log, "level:%d read", read_secret, secret_len, level);
8196
d447168ed13f Fixed write secret logging in set_encryption_secrets callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8195
diff changeset
546 ngx_quic_hexdump(c->log, "level:%d write", write_secret, secret_len, level);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
547
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
548 key_len = ngx_quic_ciphers(c, &ciphers, level);
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
549
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
550 if (key_len == NGX_ERROR) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
551 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "unexpected cipher");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
552 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
553 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
554
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
555 switch (level) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
556
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
557 case ssl_encryption_handshake:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
558 client = &c->quic->client_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
559 server = &c->quic->server_hs;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
560
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
561 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
562
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
563 case ssl_encryption_application:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
564 client = &c->quic->client_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
565 server = &c->quic->server_ad;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
566
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
567 break;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
568
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
569 default:
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
570 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
571 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
572
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
573 client->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
574 server->key.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
575
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
576 client->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
577 server->iv.len = NGX_QUIC_IV_LEN;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
578
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
579 client->hp.len = key_len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
580 server->hp.len = key_len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
581
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
582 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
583 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
584 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
585 const uint8_t *secret;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
586 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
587 { ngx_string("tls13 quic key"), &client->key, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
588 { ngx_string("tls13 quic iv"), &client->iv, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
589 { ngx_string("tls13 quic hp"), &client->hp, read_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
590 { ngx_string("tls13 quic key"), &server->key, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
591 { ngx_string("tls13 quic iv"), &server->iv, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
592 { ngx_string("tls13 quic hp"), &server->hp, write_secret },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
593 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
594
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
595 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
596
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
597 if (ngx_quic_hkdf_expand(c, ciphers.d, seq[i].key, &seq[i].label,
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
598 seq[i].secret, secret_len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
599 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
600 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
601 return 0;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
602 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
603 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
604
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
605 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
606 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
607
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
608
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
609 static ngx_int_t
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
610 ngx_quic_create_long_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
611 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
612 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
613 u_char *p, *pnp, *nonce, *sample, *packet;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
614 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
615 ngx_quic_ciphers_t ciphers;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
616 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
617 u_char mask[16];
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
618
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
619 qc = c->quic;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
620
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
621 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
622
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
623 ad.data = ngx_alloc(346 /*max header*/, c->log);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
624 if (ad.data == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
625 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
626 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
627
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
628 p = ad.data;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
629
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
630 *p++ = pkt->flags;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
631
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
632 p = ngx_quic_write_uint32(p, quic_version);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
633
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
634 *p++ = qc->scid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
635 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
636
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
637 *p++ = qc->dcid.len;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
638 p = ngx_cpymem(p, qc->dcid.data, qc->dcid.len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
639
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
640 if (pkt->level == ssl_encryption_initial) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
641 ngx_quic_build_int(&p, pkt->token.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
642 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
643
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
644 ngx_quic_build_int(&p, out.len + 1); // length (inc. pnl)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
645 pnp = p;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
646
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
647 *p++ = (*pkt->number)++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
648
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
649 ad.len = p - ad.data;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
650
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
651 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
652
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
653 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
654 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
655 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
656
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
657 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
658 if (pkt->level == ssl_encryption_handshake) {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
659 nonce[11] ^= (*pkt->number - 1);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
660 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
661
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
662 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
663 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
664
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
665 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
666 != NGX_OK)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
667 {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
668 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
669 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
670
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
671 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
672 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
673 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
674 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
675
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
676 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
677 ngx_quic_hexdump0(c->log, "mask", mask, 16);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
678 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
679
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
680 // header protection, pnl = 0
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
681 ad.data[0] ^= mask[0] & 0x0f;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
682 *pnp ^= mask[1];
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
683
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
684 packet = ngx_alloc(ad.len + out.len, c->log);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
685 if (packet == 0) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
686 return NGX_ERROR;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
687 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
688
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
689 p = ngx_cpymem(packet, ad.data, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
690 p = ngx_cpymem(p, out.data, out.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
691
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
692 res->data = packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
693 res->len = p - packet;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
694
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
695 return NGX_OK;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
696 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
697
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
698
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
699 static ngx_int_t
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
700 ngx_quic_create_short_packet(ngx_connection_t *c, ngx_ssl_conn_t *ssl_conn,
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
701 ngx_quic_header_t *pkt, ngx_str_t *payload, ngx_str_t *res)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
702 {
8189
80a07843c711 Using SSL cipher suite id to obtain cipher/digest, part 1.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8188
diff changeset
703 u_char *p, *pnp, *nonce, *sample, *packet;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
704 ngx_str_t ad, out;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
705 ngx_quic_ciphers_t ciphers;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
706 ngx_quic_connection_t *qc;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
707 u_char mask[16];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
708
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
709 qc = c->quic;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
710
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
711 out.len = payload->len + EVP_GCM_TLS_TAG_LEN;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
712
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
713 ad.data = ngx_alloc(25 /*max header*/, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
714 if (ad.data == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
715 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
716 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
717
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
718 p = ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
719
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
720 *p++ = 0x40;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
721
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
722 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
723
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
724 pnp = p;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
725
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
726 *p++ = (*pkt->number)++;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
727
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
728 ad.len = p - ad.data;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
729
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
730 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
731
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
732 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
733 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
734 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
735
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
736 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8200
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
737 if (pkt->level == ssl_encryption_handshake
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
738 || pkt->level == ssl_encryption_application)
9582adbc7d70 Fixed nonce in short packet protection.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8199
diff changeset
739 {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
740 nonce[11] ^= (*pkt->number - 1);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
741 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
742
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
743 ngx_quic_hexdump0(c->log, "server_iv", pkt->secret->iv.data, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
744 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
745
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
746 if (ngx_quic_tls_seal(c, ciphers.c, pkt->secret, &out, nonce, payload, &ad)
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
747 != NGX_OK)
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
748 {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
749 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
750 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
751
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
752 ngx_quic_hexdump0(c->log, "out", out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
753
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
754 sample = &out.data[3]; // pnl=0
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
755 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
756 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
757 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
758
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
759 ngx_quic_hexdump0(c->log, "sample", sample, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
760 ngx_quic_hexdump0(c->log, "mask", mask, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
761 ngx_quic_hexdump0(c->log, "hp_key", pkt->secret->hp.data, 16);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
762
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
763 // header protection, pnl = 0
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
764 ad.data[0] ^= mask[0] & 0x1f;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
765 *pnp ^= mask[1];
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
766
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
767 packet = ngx_alloc(ad.len + out.len, c->log);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
768 if (packet == 0) {
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
769 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
770 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
771
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
772 p = ngx_cpymem(packet, ad.data, ad.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
773 p = ngx_cpymem(p, out.data, out.len);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
774
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
775 ngx_quic_hexdump0(c->log, "packet", packet, p - packet);
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
776
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
777 res->data = packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
778 res->len = p - packet;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
779
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
780 return NGX_OK;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
781 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
782
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
783
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
784 static void
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
785 ngx_quic_queue_frame(ngx_quic_connection_t *qc, ngx_quic_frame_t *frame)
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
786 {
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
787 ngx_quic_frame_t *f;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
788
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
789 if (qc->frames == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
790 qc->frames = frame;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
791 return;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
792 }
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
793
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
794 for (f = qc->frames; f->next; f = f->next) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
795 if (f->next->level > frame->level) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
796 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
797 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
798 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
799
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
800 frame->next = f->next;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
801 f->next = frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
802 }
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
803
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
804
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
805 static int
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
806 ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
807 enum ssl_encryption_level_t level, const uint8_t *data, size_t len)
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
808 {
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
809 u_char *p;
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
810 ngx_quic_frame_t *frame;
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
811 ngx_connection_t *c;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
812 ngx_quic_connection_t *qc;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
813
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
814 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
815 qc = c->quic;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
816
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
817 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
818 "ngx_quic_add_handshake_data");
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
819
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
820 frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
821 if (frame == NULL) {
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
822 return 0;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
823 }
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
824
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
825 p = ngx_pnalloc(c->pool, len);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
826 if (p == NULL) {
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
827 return 0;
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
828 }
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
829
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
830 ngx_memcpy(p, data, len);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
831
8186
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
832 frame->level = level;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
833 frame->type = NGX_QUIC_FT_CRYPTO;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
834 frame->u.crypto.len = len;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
835 frame->u.crypto.data = p;
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
836
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
837 ngx_sprintf(frame->info, "crypto, generated by SSL len=%ui level=%d", len, level);
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
838
0a2683df5f11 Implemented improved version of quic_output().
Vladimir Homutov <vl@nginx.com>
parents: 8185
diff changeset
839 ngx_quic_queue_frame(qc, frame);
8184
ec1f84996990 Split frame and packet generation into separate steps.
Vladimir Homutov <vl@nginx.com>
parents: 8183
diff changeset
840
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
841 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
842 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
843
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
844
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
845 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
846 ngx_quic_flush_flight(ngx_ssl_conn_t *ssl_conn)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
847 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
848 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
849
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
850 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
851
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
852 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_quic_flush_flight()");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
853
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
854 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
855 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
856
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
857
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
858 static int
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
859 ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
860 uint8_t alert)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
861 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
862 ngx_connection_t *c;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
863
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
864 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
865
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
866 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
867 "ngx_quic_send_alert(), lvl=%d, alert=%d",
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
868 (int) level, (int) alert);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
869
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
870 return 1;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
871 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
872
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
873
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
874 /* TODO: stub for short packet header processing */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
875 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
876 ngx_quic_process_short_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
877 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
878 u_char *p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
879
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
880 p = pkt->buf.data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
881
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
882 ngx_quic_hexdump0(c->log, "input", pkt->buf.data, pkt->buf.len);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
883
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
884 if ((p[0] & NGX_QUIC_PKT_LONG)) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
885 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a short packet");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
886 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
887 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
888
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
889 pkt->flags = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
890
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
891 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
892 "quic flags:%xi", pkt->flags);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
893
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
894 if (ngx_memcmp(p, c->quic->dcid.data, c->quic->dcid.len) != 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
895 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
896 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
897 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
898
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
899 pkt->dcid.data = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
900 p += c->quic->dcid.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
901
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
902 pkt->pos = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
903
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
904 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
905 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
906
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
907
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
908 static ngx_int_t
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
909 ngx_quic_process_long_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
910 {
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
911 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
912
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
913 p = pkt->buf.data;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
914
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
915 ngx_quic_hexdump0(c->log, "input", pkt->buf.data, pkt->buf.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
916
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
917 if (!(p[0] & NGX_QUIC_PKT_LONG)) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
918 ngx_log_error(NGX_LOG_INFO, c->log, 0, "not a long packet");
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
919 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
920 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
921
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
922 pkt->flags = *p++;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
923
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
924 pkt->version = ngx_quic_parse_uint32(p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
925 p += sizeof(uint32_t);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
926
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
927 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
928 "quic flags:%xi version:%xD", pkt->flags, pkt->version);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
929
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
930 if (pkt->version != quic_version) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
931 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unsupported quic version");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
932 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
933 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
934
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
935 pkt->dcid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
936 pkt->dcid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
937 p += pkt->dcid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
938
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
939 pkt->scid.len = *p++;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
940 pkt->scid.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
941 p += pkt->scid.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
942
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
943 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
944
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
945 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
946 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
947
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
948
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
949 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
950 ngx_quic_process_initial_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
951 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
952 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
953 ngx_int_t plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
954
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
955 p = pkt->pos;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
956
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
957 pkt->token.len = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
958 pkt->token.data = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
959
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
960 p += pkt->token.len;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
961
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
962 plen = ngx_quic_parse_int(&p);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
963
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
964 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
965 "quic packet length: %d", plen);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
966
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
967 if (plen > pkt->buf.data + pkt->buf.len - p) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
968 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated initial packet");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
969 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
970 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
971
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
972 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
973 pkt->buf.len = plen;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
974
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
975 ngx_quic_hexdump0(c->log, "DCID", pkt->dcid.data, pkt->dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
976 ngx_quic_hexdump0(c->log, "SCID", pkt->scid.data, pkt->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
977 ngx_quic_hexdump0(c->log, "token", pkt->token.data, pkt->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
978
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
979 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
980 "quic packet length: %d", plen);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
981
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
982 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
983 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
984
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
985 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
986 ngx_quic_process_handshake_header(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
987 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
988 u_char *p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
989 ngx_int_t plen;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
990
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
991 p = pkt->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
992
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
993 plen = ngx_quic_parse_int(&p);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
994
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
995 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
996 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
997
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
998 if (plen > pkt->buf.data + pkt->buf.len - p) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
999 ngx_log_error(NGX_LOG_INFO, c->log, 0, "truncated handshake packet");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1000 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1001 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1002
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1003 pkt->pos = p;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1004 pkt->buf.len = plen;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1005
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1006 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1007 "quic packet length: %d", plen);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1008
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1009 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1010 }
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1011
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1012
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1013 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1014 ngx_quic_initial_secret(ngx_connection_t *c)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1015 {
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1016 size_t is_len;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1017 uint8_t is[SHA256_DIGEST_LENGTH];
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1018 ngx_uint_t i;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1019 const EVP_MD *digest;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1020 const EVP_CIPHER *cipher;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1021 ngx_quic_connection_t *qc;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1022
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1023 static const uint8_t salt[20] =
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1024 "\xc3\xee\xf7\x12\xc7\x2e\xbb\x5a\x11\xa7"
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1025 "\xd2\x43\x2b\xb4\x63\x65\xbe\xf9\xf5\x02";
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1026
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1027 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1028
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1029 cipher = EVP_aes_128_gcm();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1030 digest = EVP_sha256();
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1031
8194
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1032 qc = c->quic;
Vladimir Homutov <vl@nginx.com>
parents: 8193
diff changeset
1033
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1034 if (ngx_hkdf_extract(is, &is_len, digest, qc->dcid.data, qc->dcid.len,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1035 salt, sizeof(salt))
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1036 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1037 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1038 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1039 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1040
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1041 ngx_str_t iss = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1042 .data = is,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1043 .len = is_len
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1044 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1045
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1046 ngx_quic_hexdump0(c->log, "salt", salt, sizeof(salt));
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1047 ngx_quic_hexdump0(c->log, "initial secret", is, is_len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1048
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1049 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1050 qc->client_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1051 qc->server_in.secret.len = SHA256_DIGEST_LENGTH;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1052
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1053 qc->client_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1054 qc->server_in.key.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1055
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1056 qc->client_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1057 qc->server_in.hp.len = EVP_CIPHER_key_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1058
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1059 qc->client_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1060 qc->server_in.iv.len = EVP_CIPHER_iv_length(cipher);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1061
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1062 struct {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1063 ngx_str_t label;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1064 ngx_str_t *key;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1065 ngx_str_t *prk;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1066 } seq[] = {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1067
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1068 /* draft-ietf-quic-tls-23#section-5.2 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1069 { ngx_string("tls13 client in"), &qc->client_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1070 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1071 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1072 &qc->client_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1073 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1074 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1075 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1076 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1077 &qc->client_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1078 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1079 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1080 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1081 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1082 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1083 &qc->client_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1084 &qc->client_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1085 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1086 { ngx_string("tls13 server in"), &qc->server_in.secret, &iss },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1087 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1088 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.3 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1089 ngx_string("tls13 quic key"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1090 &qc->server_in.key,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1091 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1092 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1093 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1094 ngx_string("tls13 quic iv"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1095 &qc->server_in.iv,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1096 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1097 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1098 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1099 /* AEAD_AES_128_GCM prior to handshake, quic-tls-23#section-5.4.1 */
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1100 ngx_string("tls13 quic hp"),
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1101 &qc->server_in.hp,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1102 &qc->server_in.secret,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1103 },
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1104
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1105 };
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1106
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1107 for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1108
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1109 if (ngx_quic_hkdf_expand(c, digest, seq[i].key, &seq[i].label,
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1110 seq[i].prk->data, seq[i].prk->len)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1111 != NGX_OK)
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1112 {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1113 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1114 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1115 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1116
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1117 return NGX_OK;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1118 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1119
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1120
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1121 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1122 ngx_quic_decrypt(ngx_connection_t *c, ngx_quic_header_t *pkt)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1123 {
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1124 u_char clearflags, *p, *sample;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1125 uint8_t *nonce;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1126 uint64_t pn;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1127 ngx_int_t pnl, rc;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1128 ngx_str_t in, ad;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1129 ngx_quic_ciphers_t ciphers;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1130 uint8_t mask[16];
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1131
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1132 if (ngx_quic_ciphers(c, &ciphers, pkt->level) == NGX_ERROR) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1133 return NGX_ERROR;
8198
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1134 }
ff14b0fe9731 Fixed header protection with negotiated cipher suite.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8197
diff changeset
1135
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1136 p = pkt->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1137
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1138 /* draft-ietf-quic-tls-23#section-5.4.2:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1139 * the Packet Number field is assumed to be 4 bytes long
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1140 * draft-ietf-quic-tls-23#section-5.4.[34]:
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1141 * AES-Based and ChaCha20-Based header protections sample 16 bytes
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1142 */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1143
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1144 sample = p + 4;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1145
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1146 ngx_quic_hexdump0(c->log, "sample", sample, 16);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1147
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1148 /* header protection */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1149
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1150 if (ngx_quic_tls_hp(c, ciphers.hp, pkt->secret, mask, sample) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1151 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1152 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1153
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1154 if (pkt->flags & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1155 clearflags = pkt->flags ^ (mask[0] & 0x0f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1156
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1157 } else {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1158 clearflags = pkt->flags ^ (mask[0] & 0x1f);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1159 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1160
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1161 pnl = (clearflags & 0x03) + 1;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1162 pn = ngx_quic_parse_pn(&p, pnl, &mask[1]);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1163
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1164 pkt->pn = pn;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1165
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1166 ngx_quic_hexdump0(c->log, "mask", mask, 5);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1167 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1168 "quic clear flags: %xi", clearflags);
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1169 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1170 "quic packet number: %uL, len: %xi", pn, pnl);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1171
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1172 /* packet protection */
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1173
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1174 in.data = p;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1175
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1176 if (pkt->flags & NGX_QUIC_PKT_LONG) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1177 in.len = pkt->buf.len - pnl;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1178
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1179 } else {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1180 in.len = pkt->buf.data + pkt->buf.len - p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1181 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1182
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1183 ad.len = p - pkt->buf.data;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1184 ad.data = ngx_pnalloc(c->pool, ad.len);
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1185 if (ad.data == NULL) {
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1186 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1187 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1188
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1189 ngx_memcpy(ad.data, pkt->buf.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1190 ad.data[0] = clearflags;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1191 ad.data[ad.len - pnl] = (u_char) pn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1192
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1193 nonce = ngx_pstrdup(c->pool, &pkt->secret->iv);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1194 nonce[11] ^= pn;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1195
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1196 ngx_quic_hexdump0(c->log, "nonce", nonce, 12);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1197 ngx_quic_hexdump0(c->log, "ad", ad.data, ad.len);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1198
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1199 rc = ngx_quic_tls_open(c, ciphers.c, pkt->secret, &pkt->payload,
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1200 nonce, &in, &ad);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1201
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1202 ngx_quic_hexdump0(c->log, "packet payload",
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1203 pkt->payload.data, pkt->payload.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1204
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1205 pkt->pos = pkt->payload.data;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1206
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1207 return rc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1208 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1209
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1210
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1211 ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1212 ngx_quic_read_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1213 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1214 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1215 u_char *p, *end;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1216
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1217 size_t npad;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1218
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1219 p = pkt->pos;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1220 end = pkt->payload.data + pkt->payload.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1221
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1222 frame->type = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1223
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1224 switch (frame->type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1225
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1226 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1227 frame->u.crypto.offset = *p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1228 frame->u.crypto.len = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1229 frame->u.crypto.data = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1230 p += frame->u.crypto.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1231
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1232 ngx_quic_hexdump0(c->log, "CRYPTO frame",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1233 frame->u.crypto.data, frame->u.crypto.len);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1234
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1235 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1236 "quic CRYPTO frame length: %uL off:%uL pp:%p",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1237 frame->u.crypto.len, frame->u.crypto.offset,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1238 frame->u.crypto.data);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1239 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1240
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1241 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1242 npad = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1243 while (p < end && *p == NGX_QUIC_FT_PADDING) { // XXX
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1244 p++; npad++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1245 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1246
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1247 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1248 "PADDING frame length %uL", npad);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1249
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1250 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1251
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1252 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1253 case NGX_QUIC_FT_ACK_ECN:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1254
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1255 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ACK frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1256
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1257 frame->u.ack.largest = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1258 frame->u.ack.delay = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1259 frame->u.ack.range_count =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1260 frame->u.ack.first_range =ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1261
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1262 if (frame->u.ack.range_count) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1263 frame->u.ack.ranges[0] = ngx_quic_parse_int(&p);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1264 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1265
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1266 if (frame->type ==NGX_QUIC_FT_ACK_ECN) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1267 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1268 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1269
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1270 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1271
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1272 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1273 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "PING frame");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1274 p++;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1275 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1276 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1277 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1278 "unknown frame type %xi", frame->type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1279 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1280 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1281
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1282 pkt->pos = p;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1283
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1284 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1285 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1286
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1287
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1288 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1289 ngx_quic_handle_crypto_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1290 ngx_quic_frame_t *frame)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1291 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1292 int sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1293 ssize_t n;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1294 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1295
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1296 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1297
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1298 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1299 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1300 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1301 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1302
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1303
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1304 if (!SSL_provide_quic_data(ssl_conn, SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1305 frame->u.crypto.data, frame->u.crypto.len))
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1306 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1307 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1308 "SSL_provide_quic_data() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1309 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1310 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1311
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1312 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1313
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1314 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1315
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1316 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1317 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1318
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1319 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1320 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1321
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1322 if (sslerr == SSL_ERROR_SSL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1323 ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1324 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1325 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1326
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1327 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1328 "quic ssl cipher: %s", SSL_get_cipher(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1329
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1330 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1331 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1332 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1333 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1334
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1335 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1336 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1337
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1338
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1339
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1340 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1341 ngx_quic_init_connection(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1342 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1343 int n, sslerr;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1344 ngx_ssl_conn_t *ssl_conn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1345 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1346
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1347 /* STUB: initial_max_streams_uni=3, active_connection_id_limit=5 */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1348 static const uint8_t params[12] = "\x00\x0a\x00\x0e\x00\x01\x05\x00\x09\x00\x01\x03";
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1349
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1350 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1351
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1352 if (ngx_ssl_create_connection(qc->ssl, c, NGX_SSL_BUFFER) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1353 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1354 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1355
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1356 ssl_conn = c->ssl->connection;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1357
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1358 if (SSL_set_quic_transport_params(ssl_conn, params, sizeof(params)) == 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1359 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1360 "SSL_set_quic_transport_params() failed");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1361 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1362 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1363
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1364 n = SSL_do_handshake(ssl_conn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1365
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1366 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1367
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1368 if (n == -1) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1369 sslerr = SSL_get_error(ssl_conn, n);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1370
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1371 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1372 sslerr);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1373 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1374
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1375 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1376 "SSL_quic_read_level: %d, SSL_quic_write_level: %d",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1377 (int) SSL_quic_read_level(ssl_conn),
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1378 (int) SSL_quic_write_level(ssl_conn));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1379
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1380 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1381 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1382
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1383
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1384 /* process all payload from the current packet and generate ack if required */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1385 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1386 ngx_quic_payload_handler(ngx_connection_t *c, ngx_quic_header_t *pkt)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1387 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1388 u_char *end;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1389 ngx_uint_t ack_this;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1390 ngx_quic_frame_t frame, *ack_frame;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1391 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1392
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1393 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1394 end = pkt->payload.data + pkt->payload.len;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1395
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1396 ack_this = 0;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1397
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1398 while (pkt->pos < end) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1399
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1400 if (ngx_quic_read_frame(c, pkt, &frame) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1401 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1402 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1403
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1404 switch (frame.type) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1405
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1406 case NGX_QUIC_FT_ACK:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1407
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1408 // TODO: handle ack
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1409
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1410 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1411 "ACK: { largest=%ui delay=%ui first=%ui count=%ui}",
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1412 frame.u.ack.largest,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1413 frame.u.ack.delay,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1414 frame.u.ack.first_range,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1415 frame.u.ack.range_count);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1416
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1417 break;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1418
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1419 case NGX_QUIC_FT_CRYPTO:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1420
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1421 if (frame.u.crypto.offset != 0x0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1422 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1423 "crypto frame with non-zero offset");
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1424 // TODO: support packet spanning with offsets
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1425 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1426 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1427
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1428 if (ngx_quic_handle_crypto_frame(c, pkt, &frame) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1429 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1430 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1431
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1432 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1433
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1434 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1435
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1436 case NGX_QUIC_FT_PADDING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1437 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1438
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1439 case NGX_QUIC_FT_PING:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1440 ack_this = 1;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1441 continue;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1442
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1443 default:
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1444 ngx_log_error(NGX_LOG_INFO, c->log, 0,
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1445 "unexpected frame type 0x%xd in packet", frame.type);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1446 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1447 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1448 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1449
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1450 if (ack_this == 0) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1451 /* do not ack packets with ACKs and PADDING */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1452 return NGX_OK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1453 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1454
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1455 // packet processed, ACK it now if required
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1456 // TODO: if (ack_required) ... - currently just ack each packet
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1457
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1458 ack_frame = ngx_pcalloc(c->pool, sizeof(ngx_quic_frame_t));
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1459 if (ack_frame == NULL) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1460 return NGX_ERROR;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1461 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1462
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1463 ack_frame->level = pkt->level;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1464 ack_frame->type = NGX_QUIC_FT_ACK;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1465 ack_frame->u.ack.pn = pkt->pn;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1466
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1467 ngx_sprintf(ack_frame->info, "ACK for PN=%d from frame handler", pkt->pn);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1468 ngx_quic_queue_frame(qc, ack_frame);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1469
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1470 return ngx_quic_output(c);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1471 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1472
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1473
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1474 static ngx_int_t
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1475 ngx_quic_new_connection(ngx_connection_t *c, ngx_ssl_t *ssl, ngx_buf_t *b)
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1476 {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1477 ngx_quic_connection_t *qc;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1478
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1479 ngx_quic_header_t pkt = { 0 };
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1480
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1481 pkt.buf.data = b->start;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1482 pkt.buf.len = b->last - b->pos;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1483
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1484 if (ngx_buf_size(b) < 1200) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1485 ngx_log_error(NGX_LOG_INFO, c->log, 0, "too small UDP datagram");
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1486 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1487 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1488
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1489 if (ngx_quic_process_long_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1490 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1491 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1492
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1493 if ((pkt.flags & 0xf0) != NGX_QUIC_PKT_INITIAL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1494 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8195
2d7202fc05d1 Fixed format specifiers.
Vladimir Homutov <vl@nginx.com>
parents: 8194
diff changeset
1495 "invalid initial packet: 0x%xi", pkt.flags);
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1496 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1497 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1498
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1499 if (ngx_quic_process_initial_header(c, &pkt) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1500 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1501 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1502
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1503 qc = ngx_pcalloc(c->pool, sizeof(ngx_quic_connection_t));
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1504 if (qc == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1505 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1506 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1507
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1508 c->quic = qc;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1509 qc->ssl = ssl;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1510
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1511 qc->dcid.len = pkt.dcid.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1512 qc->dcid.data = ngx_pnalloc(c->pool, pkt.dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1513 if (qc->dcid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1514 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1515 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1516 ngx_memcpy(qc->dcid.data, pkt.dcid.data, qc->dcid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1517
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1518 qc->scid.len = pkt.scid.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1519 qc->scid.data = ngx_pnalloc(c->pool, qc->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1520 if (qc->scid.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1521 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1522 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1523 ngx_memcpy(qc->scid.data, pkt.scid.data, qc->scid.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1524
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1525 qc->token.len = pkt.token.len;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1526 qc->token.data = ngx_pnalloc(c->pool, qc->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1527 if (qc->token.data == NULL) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1528 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1529 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1530 ngx_memcpy(qc->token.data, pkt.token.data, qc->token.len);
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1531
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1532
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1533 if (ngx_quic_initial_secret(c) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1534 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1535 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1536
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1537 pkt.secret = &qc->client_in;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1538 pkt.level = ssl_encryption_initial;
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1539
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1540 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1541 return NGX_ERROR;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1542 }
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1543
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1544 if (ngx_quic_init_connection(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1545 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1546 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1547
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1548 return ngx_quic_payload_handler(c, &pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1549 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1550
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1551
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1552 static ngx_int_t
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1553 ngx_quic_handshake_input(ngx_connection_t *c, ngx_buf_t *b)
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1554 {
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1555 ngx_ssl_conn_t *ssl_conn;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1556 ngx_quic_connection_t *qc;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1557
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1558 ngx_quic_header_t pkt = { 0 };
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1559
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1560 qc = c->quic;
8188
bf555b94e387 Using cached ssl_conn in ngx_quic_handshake_input(), NFC.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8187
diff changeset
1561 ssl_conn = c->ssl->connection;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1562
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1563 pkt.buf.data = b->start;
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1564 pkt.buf.len = b->last - b->pos;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1565
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1566 /* extract cleartext data into pkt */
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1567 if (ngx_quic_process_long_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1568 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1569 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1570
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1571 if (pkt.dcid.len != qc->dcid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1572 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1573 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1574 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1575
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1576 if (ngx_memcmp(pkt.dcid.data, qc->dcid.data, qc->dcid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1577 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic dcid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1578 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1579 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1580
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1581 if (pkt.scid.len != qc->scid.len) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1582 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scidl");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1583 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1584 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1585
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1586 if (ngx_memcmp(pkt.scid.data, qc->scid.data, qc->scid.len) != 0) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1587 ngx_log_error(NGX_LOG_INFO, c->log, 0, "unexpected quic scid");
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1588 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1589 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1590
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1591 if ((pkt.flags & 0xf0) != NGX_QUIC_PKT_HANDSHAKE) {
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1592 ngx_log_error(NGX_LOG_INFO, c->log, 0,
8195
2d7202fc05d1 Fixed format specifiers.
Vladimir Homutov <vl@nginx.com>
parents: 8194
diff changeset
1593 "invalid packet type: 0x%xi", pkt.flags);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1594 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1595 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1596
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1597 if (ngx_quic_process_handshake_header(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1598 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1599 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1600
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1601 pkt.secret = &qc->client_hs;
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1602 pkt.level = ssl_encryption_handshake;
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1603
8193
4355efde26d8 Added functions to decrypt long packets.
Vladimir Homutov <vl@nginx.com>
parents: 8192
diff changeset
1604 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1605 return NGX_ERROR;
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1606 }
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1607
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1608 return ngx_quic_payload_handler(c, &pkt);
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1609 }
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1610
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1611
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1612 static ngx_int_t
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1613 ngx_quic_app_input(ngx_connection_t *c, ngx_buf_t *b)
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1614 {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1615 ngx_quic_connection_t *qc;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1616
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1617 qc = c->quic;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1618
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1619 /* TODO: this is a stub, untested */
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1620
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1621 ngx_quic_header_t pkt = { 0 };
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1622
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1623 pkt.buf.data = b->start;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1624 pkt.buf.len = b->last - b->pos;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1625
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1626 if (ngx_quic_process_short_header(c, &pkt) != NGX_OK) {
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1627 return NGX_ERROR;
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1628 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1629
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1630 pkt.secret = &qc->client_ad;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1631 pkt.level = ssl_encryption_application;
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1632
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1633 if (ngx_quic_decrypt(c, &pkt) != NGX_OK) {
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1634 return NGX_ERROR;
8185
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1635 }
6a76d9657772 QUIC handshake final bits.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8184
diff changeset
1636
8199
1297dc83a6b9 Generic payload handler for quic packets.
Vladimir Homutov <vl@nginx.com>
parents: 8198
diff changeset
1637 return ngx_quic_payload_handler(c, &pkt);
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1638 }
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1639
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1640
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1641 uint64_t
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1642 ngx_quic_parse_int(u_char **pos)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1643 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1644 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1645 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1646 ngx_uint_t len;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1647
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1648 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1649 len = 1 << ((*p & 0xc0) >> 6);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1650 value = *p++ & 0x3f;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1651
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1652 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1653 value = (value << 8) + *p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1654 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1655
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1656 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1657 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1658 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1659
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1660
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1661 void
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1662 ngx_quic_build_int(u_char **pos, uint64_t value)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1663 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1664 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1665 ngx_uint_t len;//, len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1666
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1667 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1668 len = 0;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1669
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1670 while (value >> ((1 << len) * 8 - 2)) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1671 len++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1672 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1673
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1674 *p = len << 6;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1675
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1676 // len2 =
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1677 len = (1 << len);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1678 len--;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1679 *p |= value >> (len * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1680 p++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1681
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1682 while (len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1683 *p++ = value >> ((len-- - 1) * 8);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1684 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1685
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1686 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1687 // return len2;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1688 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1689
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1690
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1691 static uint64_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1692 ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1693 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1694 u_char *p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1695 uint64_t value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1696
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1697 p = *pos;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1698 value = *p++ ^ *mask++;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1699
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1700 while (--len) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1701 value = (value << 8) + (*p++ ^ *mask++);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1702 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1703
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1704 *pos = p;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1705 return value;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1706 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1707
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1708
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1709 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1710 ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1711 const u_char *secret, size_t secret_len, const u_char *salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1712 size_t salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1713 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1714 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1715 if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1716 salt_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1717 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1718 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1719 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1720 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1721 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1722
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1723 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1724
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1725 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1726
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1727 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1728 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1729 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1730
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1731 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1732 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1733 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1734
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1735 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1736 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1737 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1738
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1739 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1740 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1741 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1742
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1743 if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1744 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1745 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1746
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1747 if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1748 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1749 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1750
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1751 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1752
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1753 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1754 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1755
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1756
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1757 static ngx_int_t
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1758 ngx_quic_hkdf_expand(ngx_connection_t *c, const EVP_MD *digest, ngx_str_t *out,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1759 ngx_str_t *label, const uint8_t *prk, size_t prk_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1760 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1761 uint8_t *p;
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1762 size_t info_len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1763 uint8_t info[20];
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1764
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1765 out->data = ngx_pnalloc(c->pool, out->len);
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1766 if (out->data == NULL) {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1767 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1768 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1769
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1770 info_len = 2 + 1 + label->len + 1;
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1771
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1772 info[0] = 0;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1773 info[1] = out->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1774 info[2] = label->len;
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1775 p = ngx_cpymem(&info[3], label->data, label->len);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1776 *p = '\0';
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1777
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1778 if (ngx_hkdf_expand(out->data, out->len, digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1779 prk, prk_len, info, info_len)
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1780 != NGX_OK)
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1781 {
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1782 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1783 "ngx_hkdf_expand(%V) failed", label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1784 return NGX_ERROR;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1785 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1786
8183
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1787 ngx_quic_hexdump(c->log, "%V info", info, info_len, label);
6091506af0f7 Aded the "ngx_quic_hexdump" macro.
Vladimir Homutov <vl@nginx.com>
parents: 8182
diff changeset
1788 ngx_quic_hexdump(c->log, "%V key", out->data, out->len, label);
8179
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1789
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1790 return NGX_OK;
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1791 }
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1792
7ee1ada04c8a Generic function for HKDF expansion.
Vladimir Homutov <vl@nginx.com>
parents: 8178
diff changeset
1793
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1794 static ngx_int_t
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1795 ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
8180
01dc595de244 Cleanup.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8179
diff changeset
1796 const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
8171
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1797 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1798 #ifdef OPENSSL_IS_BORINGSSL
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1799 if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1800 == 0)
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1801 {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1802 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1803 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1804 #else
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1805
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1806 EVP_PKEY_CTX *pctx;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1807
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1808 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1809
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1810 if (EVP_PKEY_derive_init(pctx) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1811 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1812 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1813
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1814 if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1815 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1816 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1817
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1818 if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1819 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1820 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1821
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1822 if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1823 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1824 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1825
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1826 if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1827 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1828 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1829
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1830 if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1831 return NGX_ERROR;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1832 }
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1833
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1834 #endif
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1835
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1836 return NGX_OK;
4daf03d2bd0a OpenSSL compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1837 }
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1838
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1839
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1840 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1841 ngx_quic_tls_open(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1842 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1843 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1844 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1845 out->len = in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1846 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1847 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1848 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1849 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1850
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1851 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1852 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1853
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1854 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1855 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1856 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1857 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1858 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1859 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1860
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1861 if (EVP_AEAD_CTX_open(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1862 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1863 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1864 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1865 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1866 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_open() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1867 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1868 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1869
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1870 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1871 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1872 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1873 u_char *tag;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1874 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1875
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1876 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1877 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1878 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1879 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1880 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1881
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1882 if (EVP_DecryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1883 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1884 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1885 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1886 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1887
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1888 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1889 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1890 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1891 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1892 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1893 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1894 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1895 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1896
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1897 if (EVP_DecryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1898 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1899 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1900 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1901 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1902
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1903 if (EVP_DecryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1904 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1905 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1906 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1907 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1908
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1909 if (EVP_DecryptUpdate(ctx, out->data, &len, in->data,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1910 in->len - EVP_GCM_TLS_TAG_LEN)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1911 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1912 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1913 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1914 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1915 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1916 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1917
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1918 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1919 tag = in->data + in->len - EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1920
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1921 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, EVP_GCM_TLS_TAG_LEN, tag)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1922 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1923 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1924 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1925 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1926 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1927 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1928 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1929
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1930 if (EVP_DecryptFinal_ex(ctx, out->data + len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1931 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1932 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_DecryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1933 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1934 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1935
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1936 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1937
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1938 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1939 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1940
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1941 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1942 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1943
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1944
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
1945 static ngx_int_t
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1946 ngx_quic_tls_seal(ngx_connection_t *c, const ngx_quic_cipher_t *cipher,
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1947 ngx_quic_secret_t *s, ngx_str_t *out, u_char *nonce, ngx_str_t *in,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1948 ngx_str_t *ad)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1949 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1950 out->len = in->len + EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1951 out->data = ngx_pnalloc(c->pool, out->len);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1952 if (out->data == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1953 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1954 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1955
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
1956 #ifdef OPENSSL_IS_BORINGSSL
8177
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1957 EVP_AEAD_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1958
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1959 ctx = EVP_AEAD_CTX_new(cipher, s->key.data, s->key.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1960 EVP_AEAD_DEFAULT_TAG_LENGTH);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1961 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1962 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1963 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1964 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1965
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1966 if (EVP_AEAD_CTX_seal(ctx, out->data, &out->len, out->len, nonce, s->iv.len,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1967 in->data, in->len, ad->data, ad->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1968 != 1)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1969 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1970 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1971 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_AEAD_CTX_seal() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1972 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1973 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1974
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1975 EVP_AEAD_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1976 #else
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1977 int len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1978 EVP_CIPHER_CTX *ctx;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1979
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1980 ctx = EVP_CIPHER_CTX_new();
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1981 if (ctx == NULL) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1982 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_CIPHER_CTX_new() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1983 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1984 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1985
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1986 if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1987 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1988 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1989 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1990 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1991
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1992 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, s->iv.len, NULL)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1993 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1994 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1995 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1996 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1997 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_SET_IVLEN) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1998 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
1999 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2000
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2001 if (EVP_EncryptInit_ex(ctx, NULL, NULL, s->key.data, nonce) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2002 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2003 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2004 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2005 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2006
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2007 if (EVP_EncryptUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2008 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2009 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2010 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2011 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2012
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2013 if (EVP_EncryptUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2014 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2015 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2016 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2017 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2018
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2019 out->len = len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2020
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2021 if (EVP_EncryptFinal_ex(ctx, out->data + out->len, &len) <= 0) {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2022 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2023 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_ex failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2024 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2025 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2026
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2027 out->len += len;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2028
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2029 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, EVP_GCM_TLS_TAG_LEN,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2030 out->data + in->len)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2031 == 0)
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2032 {
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2033 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2034 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2035 "EVP_CIPHER_CTX_ctrl(EVP_CTRL_GCM_GET_TAG) failed");
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2036 return NGX_ERROR;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2037 }
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2038
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2039 EVP_CIPHER_CTX_free(ctx);
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2040
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2041 out->len += EVP_GCM_TLS_TAG_LEN;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2042 #endif
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2043
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2044 return NGX_OK;
76e29ff31cd3 AEAD routines, introduced ngx_quic_tls_open()/ngx_quic_tls_seal().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8171
diff changeset
2045 }
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2046
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2047
8182
b28ea685a56e Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents: 8180
diff changeset
2048 static ngx_int_t
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2049 ngx_quic_tls_hp(ngx_connection_t *c, const EVP_CIPHER *cipher,
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2050 ngx_quic_secret_t *s, u_char *out, u_char *in)
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2051 {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2052 int outlen;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2053 EVP_CIPHER_CTX *ctx;
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2054 u_char zero[5] = {0};
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2055
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2056 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2057 uint32_t counter;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2058
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2059 ngx_memcpy(&counter, in, sizeof(uint32_t));
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2060
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2061 if (cipher == (const EVP_CIPHER *) EVP_aead_chacha20_poly1305()) {
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2062 CRYPTO_chacha_20(out, zero, 5, s->hp.data, &in[4], counter);
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2063 return NGX_OK;
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2064 }
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2065 #endif
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2066
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2067 ctx = EVP_CIPHER_CTX_new();
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2068 if (ctx == NULL) {
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2069 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2070 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2071
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2072 if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, in) != 1) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2073 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptInit_ex() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2074 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2075 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2076
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2077 if (!EVP_EncryptUpdate(ctx, out, &outlen, zero, 5)) {
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2078 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptUpdate() failed");
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2079 goto failed;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2080 }
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2081
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2082 if (!EVP_EncryptFinal_ex(ctx, out + 5, &outlen)) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2083 ngx_ssl_error(NGX_LOG_INFO, c->log, 0, "EVP_EncryptFinal_Ex() failed");
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2084 goto failed;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2085 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2086
8178
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2087 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2088
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2089 return NGX_OK;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2090
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2091 failed:
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2092
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2093 EVP_CIPHER_CTX_free(ctx);
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2094
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2095 return NGX_ERROR;
a9ff4392ecde QUIC header protection routines, introduced ngx_quic_tls_hp().
Sergey Kandaurov <pluknet@nginx.com>
parents: 8177
diff changeset
2096 }
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2097
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2098
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2099 static ngx_int_t
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2100 ngx_quic_ciphers(ngx_connection_t *c, ngx_quic_ciphers_t *ciphers,
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2101 enum ssl_encryption_level_t level)
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2102 {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2103 ngx_int_t id, len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2104
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2105 if (level == ssl_encryption_initial) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2106 id = NGX_AES_128_GCM_SHA256;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2107
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2108 } else {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2109 id = SSL_CIPHER_get_id(SSL_get_current_cipher(c->ssl->connection))
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2110 & 0xffff;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2111 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2112
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2113 switch (id) {
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2114
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2115 case NGX_AES_128_GCM_SHA256:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2116 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2117 ciphers->c = EVP_aead_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2118 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2119 ciphers->c = EVP_aes_128_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2120 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2121 ciphers->hp = EVP_aes_128_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2122 ciphers->d = EVP_sha256();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2123 len = 16;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2124 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2125
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2126 case NGX_AES_256_GCM_SHA384:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2127 #ifdef OPENSSL_IS_BORINGSSL
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2128 ciphers->c = EVP_aead_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2129 #else
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2130 ciphers->c = EVP_aes_256_gcm();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2131 #endif
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2132 ciphers->hp = EVP_aes_256_ctr();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2133 ciphers->d = EVP_sha384();
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2134 len = 32;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2135 break;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2136
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2137 case NGX_CHACHA20_POLY1305_SHA256:
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2138 #ifdef OPENSSL_IS_BORINGSSL
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2139 ciphers->c = EVP_aead_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2140 #else
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2141 ciphers->c = EVP_chacha20_poly1305();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2142 #endif
8203
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2143 #ifdef OPENSSL_IS_BORINGSSL
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2144 ciphers->hp = (const EVP_CIPHER *) EVP_aead_chacha20_poly1305();
ec0c44aa2881 Chacha20 header protection support with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8202
diff changeset
2145 #else
8202
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2146 ciphers->hp = EVP_chacha20();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2147 #endif
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2148 ciphers->d = EVP_sha256();
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2149 len = 32;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2150 break;
a4ed2305ad2c ChaCha20 / Poly1305 initial support.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8201
diff changeset
2151
8201
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2152 default:
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2153 return NGX_ERROR;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2154 }
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2155
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2156 return len;
5c66dadb1e34 Using SSL cipher suite id to obtain cipher/digest, part 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8200
diff changeset
2157 }