handshake

Documentation

Index

• Variables
• func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective) (Sealer, Opener, error)
• type CryptoSetup
  • func NewCryptoSetupClient(initialStream io.Writer, handshakeStream io.Writer, oneRTTStream io.Writer, ...) (CryptoSetup, <-chan struct{}, error)
  • func NewCryptoSetupServer(initialStream io.Writer, handshakeStream io.Writer, oneRTTStream io.Writer, ...) (CryptoSetup, error)
• type Opener
• type Sealer
• type Token
• type TokenGenerator
  • func NewTokenGenerator() (*TokenGenerator, error)
  • func (g *TokenGenerator) DecodeToken(encrypted []byte) (*Token, error)
  • func (g *TokenGenerator) NewRetryToken(raddr net.Addr, origConnID protocol.ConnectionID) ([]byte, error)
  • func (g *TokenGenerator) NewToken(raddr net.Addr) ([]byte, error)
• type TransportParameters
  • func (p *TransportParameters) Marshal() []byte
  • func (p *TransportParameters) String() string
  • func (p *TransportParameters) Unmarshal(data []byte, sentBy protocol.Perspective) error

Variables

var (
	// ErrOpenerNotYetAvailable is returned when an opener is requested for an encryption level,
	// but the corresponding opener has not yet been initialized
	// This can happen when packets arrive out of order.
	ErrOpenerNotYetAvailable = errors.New("CryptoSetup: opener at this encryption level not yet available")
	// ErrKeysDropped is returned when an opener or a sealer is requested for an encryption level,
	// but the corresponding keys have already been dropped.
	ErrKeysDropped = errors.New("CryptoSetup: keys were already dropped")
)

Functions

func NewInitialAEAD

func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective) (Sealer, Opener, error)

NewInitialAEAD creates a new AEAD for Initial encryption / decryption.

Types

type CryptoSetup

type CryptoSetup interface {
	RunHandshake()
	io.Closer
	ChangeConnectionID(protocol.ConnectionID) error

	HandleMessage([]byte, protocol.EncryptionLevel) bool
	Received1RTTAck()
	ConnectionState() tls.ConnectionState

	GetSealer() (protocol.EncryptionLevel, Sealer)
	GetSealerWithEncryptionLevel(protocol.EncryptionLevel) (Sealer, error)
	GetOpener(protocol.EncryptionLevel) (Opener, error)
}

CryptoSetup handles the handshake and protecting / unprotecting packets

func NewCryptoSetupClient

func NewCryptoSetupClient(
	initialStream io.Writer,
	handshakeStream io.Writer,
	oneRTTStream io.Writer,
	connID protocol.ConnectionID,
	remoteAddr net.Addr,
	tp *TransportParameters,
	runner handshakeRunner,
	tlsConf *tls.Config,
	logger utils.Logger,
) (CryptoSetup, <-chan struct{}, error)

NewCryptoSetupClient creates a new crypto setup for the client

func NewCryptoSetupServer

func NewCryptoSetupServer(
	initialStream io.Writer,
	handshakeStream io.Writer,
	oneRTTStream io.Writer,
	connID protocol.ConnectionID,
	remoteAddr net.Addr,
	tp *TransportParameters,
	runner handshakeRunner,
	tlsConf *tls.Config,
	logger utils.Logger,
) (CryptoSetup, error)

NewCryptoSetupServer creates a new crypto setup for the server

type Opener

type Opener interface {
	Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error)
	DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
}

Opener opens a packet

type Sealer

type Sealer interface {
	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
	EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
	Overhead() int
}

Sealer seals a packet

type Token

type Token struct {
	IsRetryToken bool
	RemoteAddr   string
	SentTime     time.Time
	// only set for retry tokens
	OriginalDestConnectionID protocol.ConnectionID
}

A Token is derived from the client address and can be used to verify the ownership of this address.

type TokenGenerator

type TokenGenerator struct {
	// contains filtered or unexported fields
}

A TokenGenerator generates tokens

func NewTokenGenerator

func NewTokenGenerator() (*TokenGenerator, error)

NewTokenGenerator initializes a new TookenGenerator

func (*TokenGenerator) DecodeToken

func (g *TokenGenerator) DecodeToken(encrypted []byte) (*Token, error)

DecodeToken decodes a token

func (*TokenGenerator) NewRetryToken

func (g *TokenGenerator) NewRetryToken(raddr net.Addr, origConnID protocol.ConnectionID) ([]byte, error)

NewRetryToken generates a new token for a Retry for a given source address

func (*TokenGenerator) NewToken

func (g *TokenGenerator) NewToken(raddr net.Addr) ([]byte, error)

NewToken generates a new token to be sent in a NEW_TOKEN frame

type TransportParameters

type TransportParameters struct {
	InitialMaxStreamDataBidiLocal  protocol.ByteCount
	InitialMaxStreamDataBidiRemote protocol.ByteCount
	InitialMaxStreamDataUni        protocol.ByteCount
	InitialMaxData                 protocol.ByteCount

	MaxAckDelay      time.Duration
	AckDelayExponent uint8

	MaxPacketSize protocol.ByteCount

	MaxUniStreamNum  protocol.StreamNum
	MaxBidiStreamNum protocol.StreamNum

	IdleTimeout      time.Duration
	DisableMigration bool

	StatelessResetToken  *[16]byte
	OriginalConnectionID protocol.ConnectionID
}

TransportParameters are parameters sent to the peer during the handshake

func (*TransportParameters) Marshal

func (p *TransportParameters) Marshal() []byte

Marshal the transport parameters

func (*TransportParameters) String

func (p *TransportParameters) String() string

String returns a string representation, intended for logging.

func (*TransportParameters) Unmarshal

func (p *TransportParameters) Unmarshal(data []byte, sentBy protocol.Perspective) error

Unmarshal the transport parameters