Mercurial > hg > nginx

comparison src/event/quic/ngx_event_quic_protection.c @ 9176:8dacf87e4007

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: simplified ngx_quic_ciphers() API. After conversion to reusable crypto ctx, now there's enough caller context to remove the "level" argument from ngx_quic_ciphers().
author Sergey Kandaurov <pluknet@nginx.com>
date Fri, 20 Oct 2023 18:05:07 +0400
parents f7c9cd726298
children 22d110af473c
comparison
equal deleted inserted replaced
9175:f7c9cd726298 9176:8dacf87e4007
12 12
13 /* RFC 9001, 5.4.1. Header Protection Application: 5-byte mask */ 13 /* RFC 9001, 5.4.1. Header Protection Application: 5-byte mask */
14 #define NGX_QUIC_HP_LEN 5 14 #define NGX_QUIC_HP_LEN 5
15 15
16 #define NGX_QUIC_AES_128_KEY_LEN 16 16 #define NGX_QUIC_AES_128_KEY_LEN 16
17
18 #define NGX_QUIC_INITIAL_CIPHER TLS1_3_CK_AES_128_GCM_SHA256
17 19
18 20
19 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len, 21 static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
20 const EVP_MD *digest, const u_char *prk, size_t prk_len, 22 const EVP_MD *digest, const u_char *prk, size_t prk_len,
21 const u_char *info, size_t info_len); 23 const u_char *info, size_t info_len);
44 static ngx_int_t ngx_quic_create_retry_packet(ngx_quic_header_t *pkt, 46 static ngx_int_t ngx_quic_create_retry_packet(ngx_quic_header_t *pkt,
45 ngx_str_t *res); 47 ngx_str_t *res);
46 48
47 49
48 ngx_int_t 50 ngx_int_t
49 ngx_quic_ciphers(ngx_uint_t id, ngx_quic_ciphers_t *ciphers, 51 ngx_quic_ciphers(ngx_uint_t id, ngx_quic_ciphers_t *ciphers)
50 enum ssl_encryption_level_t level)
51 { 52 {
52 ngx_int_t len; 53 ngx_int_t len;
53
54 if (level == ssl_encryption_initial) {
55 id = TLS1_3_CK_AES_128_GCM_SHA256;
56 }
57 54
58 switch (id) { 55 switch (id) {
59 56
60 case TLS1_3_CK_AES_128_GCM_SHA256: 57 case TLS1_3_CK_AES_128_GCM_SHA256:
61 #ifdef OPENSSL_IS_BORINGSSL 58 #ifdef OPENSSL_IS_BORINGSSL
186 if (ngx_quic_hkdf_expand(&seq[i], digest, log) != NGX_OK) { 183 if (ngx_quic_hkdf_expand(&seq[i], digest, log) != NGX_OK) {
187 return NGX_ERROR; 184 return NGX_ERROR;
188 } 185 }
189 } 186 }
190 187
191 if (ngx_quic_ciphers(0, &ciphers, ssl_encryption_initial) == NGX_ERROR) { 188 if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
192 return NGX_ERROR; 189 return NGX_ERROR;
193 } 190 }
194 191
195 if (ngx_quic_crypto_init(ciphers.c, client, 0, log) == NGX_ERROR) { 192 if (ngx_quic_crypto_init(ciphers.c, client, 0, log) == NGX_ERROR) {
196 return NGX_ERROR; 193 return NGX_ERROR;
662 peer_secret = is_write ? &keys->secrets[level].server 659 peer_secret = is_write ? &keys->secrets[level].server
663 : &keys->secrets[level].client; 660 : &keys->secrets[level].client;
664 661
665 keys->cipher = SSL_CIPHER_get_id(cipher); 662 keys->cipher = SSL_CIPHER_get_id(cipher);
666 663
667 key_len = ngx_quic_ciphers(keys->cipher, &ciphers, level); 664 key_len = ngx_quic_ciphers(keys->cipher, &ciphers);
668 665
669 if (key_len == NGX_ERROR) { 666 if (key_len == NGX_ERROR) {
670 ngx_ssl_error(NGX_LOG_INFO, log, 0, "unexpected cipher"); 667 ngx_ssl_error(NGX_LOG_INFO, log, 0, "unexpected cipher");
671 return NGX_ERROR; 668 return NGX_ERROR;
672 } 669 }
778 775
779 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic key update"); 776 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic key update");
780 777
781 c->log->action = "updating keys"; 778 c->log->action = "updating keys";
782 779
783 if (ngx_quic_ciphers(keys->cipher, &ciphers, ssl_encryption_application) 780 if (ngx_quic_ciphers(keys->cipher, &ciphers) == NGX_ERROR) {
784 == NGX_ERROR)
785 {
786 goto failed; 781 goto failed;
787 } 782 }
788 783
789 next->client.secret.len = current->client.secret.len; 784 next->client.secret.len = current->client.secret.len;
790 next->client.key.len = current->client.key.len; 785 next->client.key.len = current->client.key.len;
925 #ifdef NGX_QUIC_DEBUG_CRYPTO 920 #ifdef NGX_QUIC_DEBUG_CRYPTO
926 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0, 921 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
927 "quic retry itag len:%uz %xV", ad.len, &ad); 922 "quic retry itag len:%uz %xV", ad.len, &ad);
928 #endif 923 #endif
929 924
930 if (ngx_quic_ciphers(0, &ciphers, pkt->level) == NGX_ERROR) { 925 if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
931 return NGX_ERROR; 926 return NGX_ERROR;
932 } 927 }
933 928
934 secret.key.len = sizeof(key); 929 secret.key.len = sizeof(key);
935 ngx_memcpy(secret.key.data, key, sizeof(key)); 930 ngx_memcpy(secret.key.data, key, sizeof(key));