handshake

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 11, 2017 License: MIT Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrMalformedTag                         = qerr.Error(qerr.InvalidCryptoMessageParameter, "malformed Tag value")
	ErrFlowControlRenegotiationNotSupported = qerr.Error(qerr.InvalidCryptoMessageParameter, "renegotiation of flow control parameters not supported")
)

ErrMalformedTag is returned when the tag value cannot be read

View Source 
var ErrHOLExperiment = qerr.Error(qerr.InvalidCryptoMessageParameter, "HOL experiment. Unsupported")

ErrHOLExperiment is returned when the client sends the FHL2 tag in the CHLO this is an expiremnt implemented by Chrome in QUIC 36, which we don't support TODO: remove this when dropping support for QUIC 36

Functions

func WriteHandshakeMessage 

func WriteHandshakeMessage(b *bytes.Buffer, messageTag Tag, data map[Tag][]byte)

WriteHandshakeMessage writes a crypto message

Types

type ConnectionParametersManager 

type ConnectionParametersManager interface {
	SetFromMap(map[Tag][]byte) error
	GetHelloMap() (map[Tag][]byte, error)

	GetSendStreamFlowControlWindow() protocol.ByteCount
	GetSendConnectionFlowControlWindow() protocol.ByteCount
	GetReceiveStreamFlowControlWindow() protocol.ByteCount
	GetMaxReceiveStreamFlowControlWindow() protocol.ByteCount
	GetReceiveConnectionFlowControlWindow() protocol.ByteCount
	GetMaxReceiveConnectionFlowControlWindow() protocol.ByteCount
	GetMaxOutgoingStreams() uint32
	GetMaxIncomingStreams() uint32
	GetIdleConnectionStateLifetime() time.Duration
	TruncateConnectionID() bool
}

ConnectionParametersManager negotiates and stores the connection parameters A ConnectionParametersManager can be used for a server as well as a client For the server: 1. call SetFromMap with the values received in the CHLO. This sets the corresponding values here, subject to negotiation 2. call GetHelloMap to get the values to send in the SHLO For the client: 1. call GetHelloMap to get the values to send in a CHLO 2. call SetFromMap with the values received in the SHLO

func NewConnectionParamatersManager 

func NewConnectionParamatersManager(pers protocol.Perspective, v protocol.VersionNumber) ConnectionParametersManager

NewConnectionParamatersManager creates a new connection parameters manager

type CryptoSetup 

type CryptoSetup interface {
	Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, protocol.EncryptionLevel, error)
	HandleCryptoStream() error
	HandshakeComplete() bool
	// TODO: clean up this interface
	DiversificationNonce() []byte         // only needed for cryptoSetupServer
	SetDiversificationNonce([]byte) error // only needed for cryptoSetupClient

	GetSealer() (protocol.EncryptionLevel, Sealer)
	GetSealerWithEncryptionLevel(protocol.EncryptionLevel) (Sealer, error)
}

CryptoSetup is a crypto setup

func NewCryptoSetup 

func NewCryptoSetup(
	connID protocol.ConnectionID,
	sourceAddr []byte,
	version protocol.VersionNumber,
	scfg *ServerConfig,
	cryptoStream io.ReadWriter,
	connectionParametersManager ConnectionParametersManager,
	aeadChanged chan protocol.EncryptionLevel,
) (CryptoSetup, error)

NewCryptoSetup creates a new CryptoSetup instance for a server

func NewCryptoSetupClient 

func NewCryptoSetupClient(
	hostname string,
	connID protocol.ConnectionID,
	version protocol.VersionNumber,
	cryptoStream io.ReadWriter,
	tlsConfig *tls.Config,
	connectionParameters ConnectionParametersManager,
	aeadChanged chan protocol.EncryptionLevel,
	negotiatedVersions []protocol.VersionNumber,
) (CryptoSetup, error)

NewCryptoSetupClient creates a new CryptoSetup instance for a client

type KeyDerivationFunction 

type KeyDerivationFunction func(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (crypto.AEAD, error)

KeyDerivationFunction is used for key derivation

type KeyExchangeFunction 

type KeyExchangeFunction func() crypto.KeyExchange

KeyExchangeFunction is used to make a new KEX

type Sealer 

type Sealer func(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte

Sealer seals a packet

type ServerConfig 

type ServerConfig struct {
	ID []byte
	// contains filtered or unexported fields
}

ServerConfig is a server config

func NewServerConfig 

func NewServerConfig(kex crypto.KeyExchange, certChain crypto.CertChain) (*ServerConfig, error)

NewServerConfig creates a new server config

func (*ServerConfig) Get 

func (s *ServerConfig) Get() []byte

Get the server config binary representation

func (*ServerConfig) GetCertsCompressed 

func (s *ServerConfig) GetCertsCompressed(sni string, commonSetHashes, compressedHashes []byte) ([]byte, error)

GetCertsCompressed returns the certificate data

func (*ServerConfig) Sign 

func (s *ServerConfig) Sign(sni string, chlo []byte) ([]byte, error)

Sign the server config and CHLO with the server's keyData

type Tag 

type Tag uint32

A Tag in the QUIC crypto 

const (
	// TagCHLO is a client hello
	TagCHLO Tag = 'C' + 'H'<<8 + 'L'<<16 + 'O'<<24
	// TagREJ is a server hello rejection
	TagREJ Tag = 'R' + 'E'<<8 + 'J'<<16
	// TagSCFG is a server config
	TagSCFG Tag = 'S' + 'C'<<8 + 'F'<<16 + 'G'<<24

	// TagPAD is padding
	TagPAD Tag = 'P' + 'A'<<8 + 'D'<<16
	// TagSNI is the server name indication
	TagSNI Tag = 'S' + 'N'<<8 + 'I'<<16
	// TagVER is the QUIC version
	TagVER Tag = 'V' + 'E'<<8 + 'R'<<16
	// TagCCS are the hashes of the common certificate sets
	TagCCS Tag = 'C' + 'C'<<8 + 'S'<<16
	// TagCCRT are the hashes of the cached certificates
	TagCCRT Tag = 'C' + 'C'<<8 + 'R'<<16 + 'T'<<24
	// TagMSPC is max streams per connection
	TagMSPC Tag = 'M' + 'S'<<8 + 'P'<<16 + 'C'<<24
	// TagMIDS is max incoming dyanamic streams
	TagMIDS Tag = 'M' + 'I'<<8 + 'D'<<16 + 'S'<<24
	// TagUAID is the user agent ID
	TagUAID Tag = 'U' + 'A'<<8 + 'I'<<16 + 'D'<<24
	// TagSVID is the server ID (unofficial tag by us :)
	TagSVID Tag = 'S' + 'V'<<8 + 'I'<<16 + 'D'<<24
	// TagTCID is truncation of the connection ID
	TagTCID Tag = 'T' + 'C'<<8 + 'I'<<16 + 'D'<<24
	// TagPDMD is the proof demand
	TagPDMD Tag = 'P' + 'D'<<8 + 'M'<<16 + 'D'<<24
	// TagSRBF is the socket receive buffer
	TagSRBF Tag = 'S' + 'R'<<8 + 'B'<<16 + 'F'<<24
	// TagICSL is the idle connection state lifetime
	TagICSL Tag = 'I' + 'C'<<8 + 'S'<<16 + 'L'<<24
	// TagNONP is the client proof nonce
	TagNONP Tag = 'N' + 'O'<<8 + 'N'<<16 + 'P'<<24
	// TagSCLS is the silently close timeout
	TagSCLS Tag = 'S' + 'C'<<8 + 'L'<<16 + 'S'<<24
	// TagCSCT is the signed cert timestamp (RFC6962) of leaf cert
	TagCSCT Tag = 'C' + 'S'<<8 + 'C'<<16 + 'T'<<24
	// TagCOPT are the connection options
	TagCOPT Tag = 'C' + 'O'<<8 + 'P'<<16 + 'T'<<24
	// TagCFCW is the initial session/connection flow control receive window
	TagCFCW Tag = 'C' + 'F'<<8 + 'C'<<16 + 'W'<<24
	// TagSFCW is the initial stream flow control receive window.
	TagSFCW Tag = 'S' + 'F'<<8 + 'C'<<16 + 'W'<<24

	// TagFHL2 forces head of line blocking.
	// Chrome experiment (see https://codereview.chromium.org/2115033002)
	// unsupported by quic-go
	TagFHL2 Tag = 'F' + 'H'<<8 + 'L'<<16 + '2'<<24

	// TagSTK is the source-address token
	TagSTK Tag = 'S' + 'T'<<8 + 'K'<<16
	// TagSNO is the server nonce
	TagSNO Tag = 'S' + 'N'<<8 + 'O'<<16
	// TagPROF is the server proof
	TagPROF Tag = 'P' + 'R'<<8 + 'O'<<16 + 'F'<<24

	// TagNONC is the client nonce
	TagNONC Tag = 'N' + 'O'<<8 + 'N'<<16 + 'C'<<24
	// TagXLCT is the expected leaf certificate
	TagXLCT Tag = 'X' + 'L'<<8 + 'C'<<16 + 'T'<<24

	// TagSCID is the server config ID
	TagSCID Tag = 'S' + 'C'<<8 + 'I'<<16 + 'D'<<24
	// TagKEXS is the list of key exchange algos
	TagKEXS Tag = 'K' + 'E'<<8 + 'X'<<16 + 'S'<<24
	// TagAEAD is the list of AEAD algos
	TagAEAD Tag = 'A' + 'E'<<8 + 'A'<<16 + 'D'<<24
	// TagPUBS is the public value for the KEX
	TagPUBS Tag = 'P' + 'U'<<8 + 'B'<<16 + 'S'<<24
	// TagOBIT is the client orbit
	TagOBIT Tag = 'O' + 'B'<<8 + 'I'<<16 + 'T'<<24
	// TagEXPY is the server config expiry
	TagEXPY Tag = 'E' + 'X'<<8 + 'P'<<16 + 'Y'<<24
	// TagCERT is the CERT data
	TagCERT Tag = 0xff545243

	// TagSHLO is the server hello
	TagSHLO Tag = 'S' + 'H'<<8 + 'L'<<16 + 'O'<<24

	// TagPRST is the public reset tag
	TagPRST Tag = 'P' + 'R'<<8 + 'S'<<16 + 'T'<<24
	// TagRSEQ is the public reset rejected packet number
	TagRSEQ Tag = 'R' + 'S'<<8 + 'E'<<16 + 'Q'<<24
	// TagRNON is the public reset nonce
	TagRNON Tag = 'R' + 'N'<<8 + 'O'<<16 + 'N'<<24
)

func ParseHandshakeMessage 

func ParseHandshakeMessage(r io.Reader) (Tag, map[Tag][]byte, error)

ParseHandshakeMessage reads a crypto message

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.