net/quic/crypto/quic_crypto_server_config.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/quic/crypto/quic_crypto_server_config.h"
   6
   7 #include <stdlib.h>
   8 #include <algorithm>
   9
  10 #include "base/stl_util.h"
  11 #include "base/strings/string_number_conversions.h"
  12 #include "crypto/hkdf.h"
  13 #include "crypto/secure_hash.h"
  14 #include "net/base/net_util.h"
  15 #include "net/quic/crypto/aes_128_gcm_12_decrypter.h"
  16 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h"
  17 #include "net/quic/crypto/cert_compressor.h"
  18 #include "net/quic/crypto/chacha20_poly1305_encrypter.h"
  19 #include "net/quic/crypto/channel_id.h"
  20 #include "net/quic/crypto/crypto_framer.h"
  21 #include "net/quic/crypto/crypto_server_config_protobuf.h"
  22 #include "net/quic/crypto/crypto_utils.h"
  23 #include "net/quic/crypto/curve25519_key_exchange.h"
  24 #include "net/quic/crypto/ephemeral_key_source.h"
  25 #include "net/quic/crypto/key_exchange.h"
  26 #include "net/quic/crypto/local_strike_register_client.h"
  27 #include "net/quic/crypto/p256_key_exchange.h"
  28 #include "net/quic/crypto/proof_source.h"
  29 #include "net/quic/crypto/quic_decrypter.h"
  30 #include "net/quic/crypto/quic_encrypter.h"
  31 #include "net/quic/crypto/quic_random.h"
  32 #include "net/quic/crypto/source_address_token.h"
  33 #include "net/quic/crypto/strike_register.h"
  34 #include "net/quic/crypto/strike_register_client.h"
  35 #include "net/quic/quic_clock.h"
  36 #include "net/quic/quic_flags.h"
  37 #include "net/quic/quic_protocol.h"
  38 #include "net/quic/quic_socket_address_coder.h"
  39 #include "net/quic/quic_utils.h"
  40
  41 using base::StringPiece;
  42 using crypto::SecureHash;
  43 using std::map;
  44 using std::sort;
  45 using std::string;
  46 using std::vector;
  47
  48 namespace net {
  49
  50 namespace {
  51
  52 string DeriveSourceAddressTokenKey(StringPiece source_address_token_secret) {
  53   crypto::HKDF hkdf(source_address_token_secret,
  54                     StringPiece() /* no salt */,
  55                     "QUIC source address token key",
  56                     CryptoSecretBoxer::GetKeySize(),
  57                     0 /* no fixed IV needed */,
  58                     0 /* no subkey secret */);
  59   return hkdf.server_write_key().as_string();
  60 }
  61
  62 }  // namespace
  63
  64 // ClientHelloInfo contains information about a client hello message that is
  65 // only kept for as long as it's being processed.
  66 struct ClientHelloInfo {
  67   ClientHelloInfo(const IPEndPoint& in_client_ip, QuicWallTime in_now)
  68       : client_ip(in_client_ip),
  69         now(in_now),
  70         valid_source_address_token(false),
  71         client_nonce_well_formed(false),
  72         unique(false) {}
  73
  74   // Inputs to EvaluateClientHello.
  75   const IPEndPoint client_ip;
  76   const QuicWallTime now;
  77
  78   // Outputs from EvaluateClientHello.
  79   bool valid_source_address_token;
  80   bool client_nonce_well_formed;
  81   bool unique;
  82   StringPiece sni;
  83   StringPiece client_nonce;
  84   StringPiece server_nonce;
  85   StringPiece user_agent_id;
  86
  87   // Errors from EvaluateClientHello.
  88   vector<uint32> reject_reasons;
  89   COMPILE_ASSERT(sizeof(QuicTag) == sizeof(uint32), header_out_of_sync);
  90 };
  91
  92 struct ValidateClientHelloResultCallback::Result {
  93   Result(const CryptoHandshakeMessage& in_client_hello,
  94          IPEndPoint in_client_ip,
  95          QuicWallTime in_now)
  96       : client_hello(in_client_hello),
  97         info(in_client_ip, in_now),
  98         error_code(QUIC_NO_ERROR) {
  99   }
 100
 101   CryptoHandshakeMessage client_hello;
 102   ClientHelloInfo info;
 103   QuicErrorCode error_code;
 104   string error_details;
 105 };
 106
 107 class ValidateClientHelloHelper {
 108  public:
 109   ValidateClientHelloHelper(ValidateClientHelloResultCallback::Result* result,
 110                             ValidateClientHelloResultCallback* done_cb)
 111       : result_(result), done_cb_(done_cb) {
 112   }
 113
 114   ~ValidateClientHelloHelper() {
 115     LOG_IF(DFATAL, done_cb_ != NULL)
 116         << "Deleting ValidateClientHelloHelper with a pending callback.";
 117   }
 118
 119   void ValidationComplete(QuicErrorCode error_code, const char* error_details) {
 120     result_->error_code = error_code;
 121     result_->error_details = error_details;
 122     done_cb_->Run(result_);
 123     DetachCallback();
 124   }
 125
 126   void StartedAsyncCallback() {
 127     DetachCallback();
 128   }
 129
 130  private:
 131   void DetachCallback() {
 132     LOG_IF(DFATAL, done_cb_ == NULL) << "Callback already detached.";
 133     done_cb_ = NULL;
 134   }
 135
 136   ValidateClientHelloResultCallback::Result* result_;
 137   ValidateClientHelloResultCallback* done_cb_;
 138
 139   DISALLOW_COPY_AND_ASSIGN(ValidateClientHelloHelper);
 140 };
 141
 142 class VerifyNonceIsValidAndUniqueCallback
 143     : public StrikeRegisterClient::ResultCallback {
 144  public:
 145   VerifyNonceIsValidAndUniqueCallback(
 146       ValidateClientHelloResultCallback::Result* result,
 147       ValidateClientHelloResultCallback* done_cb)
 148       : result_(result), done_cb_(done_cb) {
 149   }
 150
 151  protected:
 152   virtual void RunImpl(bool nonce_is_valid_and_unique,
 153                        InsertStatus nonce_error) OVERRIDE {
 154     DVLOG(1) << "Using client nonce, unique: " << nonce_is_valid_and_unique
 155              << " nonce_error: " << nonce_error;
 156     result_->info.unique = nonce_is_valid_and_unique;
 157     if (!nonce_is_valid_and_unique) {
 158       HandshakeFailureReason client_nonce_error;
 159       switch (nonce_error) {
 160         case NONCE_INVALID_FAILURE:
 161           client_nonce_error = CLIENT_NONCE_INVALID_FAILURE;
 162           break;
 163         case NONCE_NOT_UNIQUE_FAILURE:
 164           client_nonce_error = CLIENT_NONCE_NOT_UNIQUE_FAILURE;
 165           break;
 166         case NONCE_INVALID_ORBIT_FAILURE:
 167           client_nonce_error = CLIENT_NONCE_INVALID_ORBIT_FAILURE;
 168           break;
 169         case NONCE_INVALID_TIME_FAILURE:
 170           client_nonce_error = CLIENT_NONCE_INVALID_TIME_FAILURE;
 171           break;
 172         case STRIKE_REGISTER_TIMEOUT:
 173           client_nonce_error = CLIENT_NONCE_STRIKE_REGISTER_TIMEOUT;
 174           break;
 175         case STRIKE_REGISTER_FAILURE:
 176           client_nonce_error = CLIENT_NONCE_STRIKE_REGISTER_FAILURE;
 177           break;
 178         case NONCE_UNKNOWN_FAILURE:
 179           client_nonce_error = CLIENT_NONCE_UNKNOWN_FAILURE;
 180           break;
 181         case NONCE_OK:
 182         default:
 183           LOG(DFATAL) << "Unexpected client nonce error: " << nonce_error;
 184           client_nonce_error = CLIENT_NONCE_UNKNOWN_FAILURE;
 185           break;
 186       }
 187       result_->info.reject_reasons.push_back(client_nonce_error);
 188     }
 189     done_cb_->Run(result_);
 190   }
 191
 192  private:
 193   ValidateClientHelloResultCallback::Result* result_;
 194   ValidateClientHelloResultCallback* done_cb_;
 195
 196   DISALLOW_COPY_AND_ASSIGN(VerifyNonceIsValidAndUniqueCallback);
 197 };
 198
 199 // static
 200 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing";
 201
 202 PrimaryConfigChangedCallback::PrimaryConfigChangedCallback() {
 203 }
 204
 205 PrimaryConfigChangedCallback::~PrimaryConfigChangedCallback() {
 206 }
 207
 208 ValidateClientHelloResultCallback::ValidateClientHelloResultCallback() {
 209 }
 210
 211 ValidateClientHelloResultCallback::~ValidateClientHelloResultCallback() {
 212 }
 213
 214 void ValidateClientHelloResultCallback::Run(const Result* result) {
 215   RunImpl(result->client_hello, *result);
 216   delete result;
 217   delete this;
 218 }
 219
 220 QuicCryptoServerConfig::ConfigOptions::ConfigOptions()
 221     : expiry_time(QuicWallTime::Zero()),
 222       channel_id_enabled(false),
 223       p256(false) {}
 224
 225 QuicCryptoServerConfig::QuicCryptoServerConfig(
 226     StringPiece source_address_token_secret,
 227     QuicRandom* rand)
 228     : replay_protection_(true),
 229       configs_lock_(),
 230       primary_config_(NULL),
 231       next_config_promotion_time_(QuicWallTime::Zero()),
 232       server_nonce_strike_register_lock_(),
 233       strike_register_no_startup_period_(false),
 234       strike_register_max_entries_(1 << 10),
 235       strike_register_window_secs_(600),
 236       source_address_token_future_secs_(3600),
 237       source_address_token_lifetime_secs_(86400),
 238       server_nonce_strike_register_max_entries_(1 << 10),
 239       server_nonce_strike_register_window_secs_(120) {
 240   default_source_address_token_boxer_.SetKey(
 241       DeriveSourceAddressTokenKey(source_address_token_secret));
 242
 243   // Generate a random key and orbit for server nonces.
 244   rand->RandBytes(server_nonce_orbit_, sizeof(server_nonce_orbit_));
 245   const size_t key_size = server_nonce_boxer_.GetKeySize();
 246   scoped_ptr<uint8[]> key_bytes(new uint8[key_size]);
 247   rand->RandBytes(key_bytes.get(), key_size);
 248
 249   server_nonce_boxer_.SetKey(
 250       StringPiece(reinterpret_cast<char*>(key_bytes.get()), key_size));
 251 }
 252
 253 QuicCryptoServerConfig::~QuicCryptoServerConfig() {
 254   primary_config_ = NULL;
 255 }
 256
 257 // static
 258 QuicServerConfigProtobuf* QuicCryptoServerConfig::GenerateConfig(
 259     QuicRandom* rand,
 260     const QuicClock* clock,
 261     const ConfigOptions& options) {
 262   CryptoHandshakeMessage msg;
 263
 264   const string curve25519_private_key =
 265       Curve25519KeyExchange::NewPrivateKey(rand);
 266   scoped_ptr<Curve25519KeyExchange> curve25519(
 267       Curve25519KeyExchange::New(curve25519_private_key));
 268   StringPiece curve25519_public_value = curve25519->public_value();
 269
 270   string encoded_public_values;
 271   // First three bytes encode the length of the public value.
 272   encoded_public_values.push_back(curve25519_public_value.size());
 273   encoded_public_values.push_back(curve25519_public_value.size() >> 8);
 274   encoded_public_values.push_back(curve25519_public_value.size() >> 16);
 275   encoded_public_values.append(curve25519_public_value.data(),
 276                                curve25519_public_value.size());
 277
 278   string p256_private_key;
 279   if (options.p256) {
 280     p256_private_key = P256KeyExchange::NewPrivateKey();
 281     scoped_ptr<P256KeyExchange> p256(P256KeyExchange::New(p256_private_key));
 282     StringPiece p256_public_value = p256->public_value();
 283
 284     encoded_public_values.push_back(p256_public_value.size());
 285     encoded_public_values.push_back(p256_public_value.size() >> 8);
 286     encoded_public_values.push_back(p256_public_value.size() >> 16);
 287     encoded_public_values.append(p256_public_value.data(),
 288                                  p256_public_value.size());
 289   }
 290
 291   msg.set_tag(kSCFG);
 292   if (options.p256) {
 293     msg.SetTaglist(kKEXS, kC255, kP256, 0);
 294   } else {
 295     msg.SetTaglist(kKEXS, kC255, 0);
 296   }
 297   if (ChaCha20Poly1305Encrypter::IsSupported()) {
 298     msg.SetTaglist(kAEAD, kAESG, kCC12, 0);
 299   } else {
 300     msg.SetTaglist(kAEAD, kAESG, 0);
 301   }
 302   msg.SetStringPiece(kPUBS, encoded_public_values);
 303
 304   if (options.expiry_time.IsZero()) {
 305     const QuicWallTime now = clock->WallNow();
 306     const QuicWallTime expiry = now.Add(QuicTime::Delta::FromSeconds(
 307         60 * 60 * 24 * 180 /* 180 days, ~six months */));
 308     const uint64 expiry_seconds = expiry.ToUNIXSeconds();
 309     msg.SetValue(kEXPY, expiry_seconds);
 310   } else {
 311     msg.SetValue(kEXPY, options.expiry_time.ToUNIXSeconds());
 312   }
 313
 314   char orbit_bytes[kOrbitSize];
 315   if (options.orbit.size() == sizeof(orbit_bytes)) {
 316     memcpy(orbit_bytes, options.orbit.data(), sizeof(orbit_bytes));
 317   } else {
 318     DCHECK(options.orbit.empty());
 319     rand->RandBytes(orbit_bytes, sizeof(orbit_bytes));
 320   }
 321   msg.SetStringPiece(kORBT, StringPiece(orbit_bytes, sizeof(orbit_bytes)));
 322
 323   if (options.channel_id_enabled) {
 324     msg.SetTaglist(kPDMD, kCHID, 0);
 325   }
 326
 327   if (options.id.empty()) {
 328     // We need to ensure that the SCID changes whenever the server config does
 329     // thus we make it a hash of the rest of the server config.
 330     scoped_ptr<QuicData> serialized(
 331         CryptoFramer::ConstructHandshakeMessage(msg));
 332     scoped_ptr<SecureHash> hash(SecureHash::Create(SecureHash::SHA256));
 333     hash->Update(serialized->data(), serialized->length());
 334
 335     char scid_bytes[16];
 336     hash->Finish(scid_bytes, sizeof(scid_bytes));
 337     msg.SetStringPiece(kSCID, StringPiece(scid_bytes, sizeof(scid_bytes)));
 338   } else {
 339     msg.SetStringPiece(kSCID, options.id);
 340   }
 341   // Don't put new tags below this point. The SCID generation should hash over
 342   // everything but itself and so extra tags should be added prior to the
 343   // preceeding if block.
 344
 345   scoped_ptr<QuicData> serialized(CryptoFramer::ConstructHandshakeMessage(msg));
 346
 347   scoped_ptr<QuicServerConfigProtobuf> config(new QuicServerConfigProtobuf);
 348   config->set_config(serialized->AsStringPiece());
 349   QuicServerConfigProtobuf::PrivateKey* curve25519_key = config->add_key();
 350   curve25519_key->set_tag(kC255);
 351   curve25519_key->set_private_key(curve25519_private_key);
 352
 353   if (options.p256) {
 354     QuicServerConfigProtobuf::PrivateKey* p256_key = config->add_key();
 355     p256_key->set_tag(kP256);
 356     p256_key->set_private_key(p256_private_key);
 357   }
 358
 359   return config.release();
 360 }
 361
 362 CryptoHandshakeMessage* QuicCryptoServerConfig::AddConfig(
 363     QuicServerConfigProtobuf* protobuf,
 364     const QuicWallTime now) {
 365   scoped_ptr<CryptoHandshakeMessage> msg(
 366       CryptoFramer::ParseMessage(protobuf->config()));
 367
 368   if (!msg.get()) {
 369     LOG(WARNING) << "Failed to parse server config message";
 370     return NULL;
 371   }
 372
 373   scoped_refptr<Config> config(ParseConfigProtobuf(protobuf));
 374   if (!config.get()) {
 375     LOG(WARNING) << "Failed to parse server config message";
 376     return NULL;
 377   }
 378
 379   {
 380     base::AutoLock locked(configs_lock_);
 381     if (configs_.find(config->id) != configs_.end()) {
 382       LOG(WARNING) << "Failed to add config because another with the same "
 383                       "server config id already exists: "
 384                    << base::HexEncode(config->id.data(), config->id.size());
 385       return NULL;
 386     }
 387
 388     configs_[config->id] = config;
 389     SelectNewPrimaryConfig(now);
 390     DCHECK(primary_config_.get());
 391     DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_);
 392   }
 393
 394   return msg.release();
 395 }
 396
 397 CryptoHandshakeMessage* QuicCryptoServerConfig::AddDefaultConfig(
 398     QuicRandom* rand,
 399     const QuicClock* clock,
 400     const ConfigOptions& options) {
 401   scoped_ptr<QuicServerConfigProtobuf> config(
 402       GenerateConfig(rand, clock, options));
 403   return AddConfig(config.get(), clock->WallNow());
 404 }
 405
 406 bool QuicCryptoServerConfig::SetConfigs(
 407     const vector<QuicServerConfigProtobuf*>& protobufs,
 408     const QuicWallTime now) {
 409   vector<scoped_refptr<Config> > parsed_configs;
 410   bool ok = true;
 411
 412   for (vector<QuicServerConfigProtobuf*>::const_iterator i = protobufs.begin();
 413        i != protobufs.end(); ++i) {
 414     scoped_refptr<Config> config(ParseConfigProtobuf(*i));
 415     if (!config.get()) {
 416       ok = false;
 417       break;
 418     }
 419
 420     parsed_configs.push_back(config);
 421   }
 422
 423   if (parsed_configs.empty()) {
 424     LOG(WARNING) << "New config list is empty.";
 425     ok = false;
 426   }
 427
 428   if (!ok) {
 429     LOG(WARNING) << "Rejecting QUIC configs because of above errors";
 430   } else {
 431     VLOG(1) << "Updating configs:";
 432
 433     base::AutoLock locked(configs_lock_);
 434     ConfigMap new_configs;
 435
 436     for (vector<scoped_refptr<Config> >::const_iterator i =
 437              parsed_configs.begin();
 438          i != parsed_configs.end(); ++i) {
 439       scoped_refptr<Config> config = *i;
 440
 441       ConfigMap::iterator it = configs_.find(config->id);
 442       if (it != configs_.end()) {
 443         VLOG(1)
 444             << "Keeping scid: " << base::HexEncode(
 445                 config->id.data(), config->id.size())
 446             << " orbit: " << base::HexEncode(
 447                 reinterpret_cast<const char *>(config->orbit), kOrbitSize)
 448             << " new primary_time " << config->primary_time.ToUNIXSeconds()
 449             << " old primary_time " << it->second->primary_time.ToUNIXSeconds()
 450             << " new priority " << config->priority
 451             << " old priority " << it->second->priority;
 452         // Update primary_time and priority.
 453         it->second->primary_time = config->primary_time;
 454         it->second->priority = config->priority;
 455         new_configs.insert(*it);
 456       } else {
 457         VLOG(1) << "Adding scid: " << base::HexEncode(
 458                     config->id.data(), config->id.size())
 459                 << " orbit: " << base::HexEncode(
 460                     reinterpret_cast<const char *>(config->orbit), kOrbitSize)
 461                 << " primary_time " << config->primary_time.ToUNIXSeconds()
 462                 << " priority " << config->priority;
 463         new_configs.insert(make_pair(config->id, config));
 464       }
 465     }
 466
 467     configs_.swap(new_configs);
 468     SelectNewPrimaryConfig(now);
 469     DCHECK(primary_config_.get());
 470     DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_);
 471   }
 472
 473   return ok;
 474 }
 475
 476 void QuicCryptoServerConfig::GetConfigIds(vector<string>* scids) const {
 477   base::AutoLock locked(configs_lock_);
 478   for (ConfigMap::const_iterator it = configs_.begin();
 479        it != configs_.end(); ++it) {
 480     scids->push_back(it->first);
 481   }
 482 }
 483
 484 void QuicCryptoServerConfig::ValidateClientHello(
 485     const CryptoHandshakeMessage& client_hello,
 486     IPEndPoint client_ip,
 487     const QuicClock* clock,
 488     ValidateClientHelloResultCallback* done_cb) const {
 489   const QuicWallTime now(clock->WallNow());
 490
 491   ValidateClientHelloResultCallback::Result* result =
 492       new ValidateClientHelloResultCallback::Result(
 493           client_hello, client_ip, now);
 494
 495   StringPiece requested_scid;
 496   client_hello.GetStringPiece(kSCID, &requested_scid);
 497
 498   uint8 primary_orbit[kOrbitSize];
 499   scoped_refptr<Config> requested_config;
 500   {
 501     base::AutoLock locked(configs_lock_);
 502
 503     if (!primary_config_.get()) {
 504       result->error_code = QUIC_CRYPTO_INTERNAL_ERROR;
 505       result->error_details = "No configurations loaded";
 506     } else {
 507       if (!next_config_promotion_time_.IsZero() &&
 508           next_config_promotion_time_.IsAfter(now)) {
 509         SelectNewPrimaryConfig(now);
 510         DCHECK(primary_config_.get());
 511         DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_);
 512       }
 513
 514       memcpy(primary_orbit, primary_config_->orbit, sizeof(primary_orbit));
 515     }
 516
 517     requested_config = GetConfigWithScid(requested_scid);
 518   }
 519
 520   if (result->error_code == QUIC_NO_ERROR) {
 521     EvaluateClientHello(primary_orbit, requested_config, result, done_cb);
 522   } else {
 523     done_cb->Run(result);
 524   }
 525 }
 526
 527 QuicErrorCode QuicCryptoServerConfig::ProcessClientHello(
 528     const ValidateClientHelloResultCallback::Result& validate_chlo_result,
 529     QuicConnectionId connection_id,
 530     IPEndPoint client_address,
 531     QuicVersion version,
 532     const QuicVersionVector& supported_versions,
 533     const QuicClock* clock,
 534     QuicRandom* rand,
 535     QuicCryptoNegotiatedParameters *params,
 536     CryptoHandshakeMessage* out,
 537     string* error_details) const {
 538   DCHECK(error_details);
 539
 540   const CryptoHandshakeMessage& client_hello =
 541       validate_chlo_result.client_hello;
 542   const ClientHelloInfo& info = validate_chlo_result.info;
 543
 544   // If the client's preferred version is not the version we are currently
 545   // speaking, then the client went through a version negotiation.  In this
 546   // case, we need to make sure that we actually do not support this version
 547   // and that it wasn't a downgrade attack.
 548   QuicTag client_version_tag;
 549   if (client_hello.GetUint32(kVER, &client_version_tag) != QUIC_NO_ERROR) {
 550     *error_details = "client hello missing version list";
 551     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 552   }
 553   QuicVersion client_version = QuicTagToQuicVersion(client_version_tag);
 554   if (client_version != version) {
 555     // Just because client_version is a valid version enum doesn't mean that
 556     // this server actually supports that version, so we check to see if
 557     // it's actually in the supported versions list.
 558     for (size_t i = 0; i < supported_versions.size(); ++i) {
 559       if (client_version == supported_versions[i]) {
 560         *error_details = "Downgrade attack detected";
 561         return QUIC_VERSION_NEGOTIATION_MISMATCH;
 562       }
 563     }
 564   }
 565
 566   StringPiece requested_scid;
 567   client_hello.GetStringPiece(kSCID, &requested_scid);
 568   const QuicWallTime now(clock->WallNow());
 569
 570   scoped_refptr<Config> requested_config;
 571   scoped_refptr<Config> primary_config;
 572   {
 573     base::AutoLock locked(configs_lock_);
 574
 575     if (!primary_config_.get()) {
 576       *error_details = "No configurations loaded";
 577       return QUIC_CRYPTO_INTERNAL_ERROR;
 578     }
 579
 580     if (!next_config_promotion_time_.IsZero() &&
 581         next_config_promotion_time_.IsAfter(now)) {
 582       SelectNewPrimaryConfig(now);
 583       DCHECK(primary_config_.get());
 584       DCHECK_EQ(configs_.find(primary_config_->id)->second, primary_config_);
 585     }
 586
 587     // We'll use the config that the client requested in order to do
 588     // key-agreement. Otherwise we'll give it a copy of |primary_config_|
 589     // to use.
 590     primary_config = primary_config_;
 591
 592     requested_config = GetConfigWithScid(requested_scid);
 593   }
 594
 595   if (validate_chlo_result.error_code != QUIC_NO_ERROR) {
 596     *error_details = validate_chlo_result.error_details;
 597     return validate_chlo_result.error_code;
 598   }
 599
 600   out->Clear();
 601
 602   if (!info.valid_source_address_token ||
 603       !info.client_nonce_well_formed ||
 604       !info.unique ||
 605       !requested_config.get()) {
 606     BuildRejection(
 607         *primary_config.get(), client_hello, info, rand, params, out);
 608     return QUIC_NO_ERROR;
 609   }
 610
 611   const QuicTag* their_aeads;
 612   const QuicTag* their_key_exchanges;
 613   size_t num_their_aeads, num_their_key_exchanges;
 614   if (client_hello.GetTaglist(kAEAD, &their_aeads,
 615                               &num_their_aeads) != QUIC_NO_ERROR ||
 616       client_hello.GetTaglist(kKEXS, &their_key_exchanges,
 617                               &num_their_key_exchanges) != QUIC_NO_ERROR ||
 618       num_their_aeads != 1 ||
 619       num_their_key_exchanges != 1) {
 620     *error_details = "Missing or invalid AEAD or KEXS";
 621     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 622   }
 623
 624   size_t key_exchange_index;
 625   if (!QuicUtils::FindMutualTag(requested_config->aead, their_aeads,
 626                                 num_their_aeads, QuicUtils::LOCAL_PRIORITY,
 627                                 &params->aead, NULL) ||
 628       !QuicUtils::FindMutualTag(
 629           requested_config->kexs, their_key_exchanges, num_their_key_exchanges,
 630           QuicUtils::LOCAL_PRIORITY, &params->key_exchange,
 631           &key_exchange_index)) {
 632     *error_details = "Unsupported AEAD or KEXS";
 633     return QUIC_CRYPTO_NO_SUPPORT;
 634   }
 635
 636   StringPiece public_value;
 637   if (!client_hello.GetStringPiece(kPUBS, &public_value)) {
 638     *error_details = "Missing public value";
 639     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 640   }
 641
 642   const KeyExchange* key_exchange =
 643       requested_config->key_exchanges[key_exchange_index];
 644   if (!key_exchange->CalculateSharedKey(public_value,
 645                                         &params->initial_premaster_secret)) {
 646     *error_details = "Invalid public value";
 647     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 648   }
 649
 650   if (!info.sni.empty()) {
 651     scoped_ptr<char[]> sni_tmp(new char[info.sni.length() + 1]);
 652     memcpy(sni_tmp.get(), info.sni.data(), info.sni.length());
 653     sni_tmp[info.sni.length()] = 0;
 654     params->sni = CryptoUtils::NormalizeHostname(sni_tmp.get());
 655   }
 656
 657   string hkdf_suffix;
 658   const QuicData& client_hello_serialized = client_hello.GetSerialized();
 659   hkdf_suffix.reserve(sizeof(connection_id) + client_hello_serialized.length() +
 660                       requested_config->serialized.size());
 661   hkdf_suffix.append(reinterpret_cast<char*>(&connection_id),
 662                      sizeof(connection_id));
 663   hkdf_suffix.append(client_hello_serialized.data(),
 664                      client_hello_serialized.length());
 665   hkdf_suffix.append(requested_config->serialized);
 666
 667   StringPiece cetv_ciphertext;
 668   if (requested_config->channel_id_enabled &&
 669       client_hello.GetStringPiece(kCETV, &cetv_ciphertext)) {
 670     CryptoHandshakeMessage client_hello_copy(client_hello);
 671     client_hello_copy.Erase(kCETV);
 672     client_hello_copy.Erase(kPAD);
 673
 674     const QuicData& client_hello_serialized = client_hello_copy.GetSerialized();
 675     string hkdf_input;
 676     hkdf_input.append(QuicCryptoConfig::kCETVLabel,
 677                       strlen(QuicCryptoConfig::kCETVLabel) + 1);
 678     hkdf_input.append(reinterpret_cast<char*>(&connection_id),
 679                       sizeof(connection_id));
 680     hkdf_input.append(client_hello_serialized.data(),
 681                       client_hello_serialized.length());
 682     hkdf_input.append(requested_config->serialized);
 683
 684     CrypterPair crypters;
 685     if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, params->aead,
 686                                  info.client_nonce, info.server_nonce,
 687                                  hkdf_input, CryptoUtils::SERVER, &crypters,
 688                                  NULL /* subkey secret */)) {
 689       *error_details = "Symmetric key setup failed";
 690       return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
 691     }
 692
 693     scoped_ptr<QuicData> cetv_plaintext(crypters.decrypter->DecryptPacket(
 694         0 /* sequence number */, StringPiece() /* associated data */,
 695         cetv_ciphertext));
 696     if (!cetv_plaintext.get()) {
 697       *error_details = "CETV decryption failure";
 698       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 699     }
 700
 701     scoped_ptr<CryptoHandshakeMessage> cetv(CryptoFramer::ParseMessage(
 702         cetv_plaintext->AsStringPiece()));
 703     if (!cetv.get()) {
 704       *error_details = "CETV parse error";
 705       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 706     }
 707
 708     StringPiece key, signature;
 709     if (cetv->GetStringPiece(kCIDK, &key) &&
 710         cetv->GetStringPiece(kCIDS, &signature)) {
 711       if (!ChannelIDVerifier::Verify(key, hkdf_input, signature)) {
 712         *error_details = "ChannelID signature failure";
 713         return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 714       }
 715
 716       params->channel_id = key.as_string();
 717     }
 718   }
 719
 720   string hkdf_input;
 721   size_t label_len = strlen(QuicCryptoConfig::kInitialLabel) + 1;
 722   hkdf_input.reserve(label_len + hkdf_suffix.size());
 723   hkdf_input.append(QuicCryptoConfig::kInitialLabel, label_len);
 724   hkdf_input.append(hkdf_suffix);
 725
 726   if (!CryptoUtils::DeriveKeys(params->initial_premaster_secret, params->aead,
 727                                info.client_nonce, info.server_nonce, hkdf_input,
 728                                CryptoUtils::SERVER,
 729                                &params->initial_crypters,
 730                                NULL /* subkey secret */)) {
 731     *error_details = "Symmetric key setup failed";
 732     return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
 733   }
 734
 735   string forward_secure_public_value;
 736   if (ephemeral_key_source_.get()) {
 737     params->forward_secure_premaster_secret =
 738         ephemeral_key_source_->CalculateForwardSecureKey(
 739             key_exchange, rand, clock->ApproximateNow(), public_value,
 740             &forward_secure_public_value);
 741   } else {
 742     scoped_ptr<KeyExchange> forward_secure_key_exchange(
 743         key_exchange->NewKeyPair(rand));
 744     forward_secure_public_value =
 745         forward_secure_key_exchange->public_value().as_string();
 746     if (!forward_secure_key_exchange->CalculateSharedKey(
 747             public_value, &params->forward_secure_premaster_secret)) {
 748       *error_details = "Invalid public value";
 749       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
 750     }
 751   }
 752
 753   string forward_secure_hkdf_input;
 754   label_len = strlen(QuicCryptoConfig::kForwardSecureLabel) + 1;
 755   forward_secure_hkdf_input.reserve(label_len + hkdf_suffix.size());
 756   forward_secure_hkdf_input.append(QuicCryptoConfig::kForwardSecureLabel,
 757                                    label_len);
 758   forward_secure_hkdf_input.append(hkdf_suffix);
 759
 760   if (!CryptoUtils::DeriveKeys(
 761            params->forward_secure_premaster_secret, params->aead,
 762            info.client_nonce, info.server_nonce, forward_secure_hkdf_input,
 763            CryptoUtils::SERVER, &params->forward_secure_crypters,
 764            &params->subkey_secret)) {
 765     *error_details = "Symmetric key setup failed";
 766     return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
 767   }
 768
 769   out->set_tag(kSHLO);
 770   QuicTagVector supported_version_tags;
 771   for (size_t i = 0; i < supported_versions.size(); ++i) {
 772     supported_version_tags.push_back
 773         (QuicVersionToQuicTag(supported_versions[i]));
 774   }
 775   out->SetVector(kVER, supported_version_tags);
 776   out->SetStringPiece(
 777       kSourceAddressTokenTag,
 778       NewSourceAddressToken(
 779           *requested_config.get(), client_address, rand, info.now, NULL));
 780   QuicSocketAddressCoder address_coder(client_address);
 781   out->SetStringPiece(kCADR, address_coder.Encode());
 782   out->SetStringPiece(kPUBS, forward_secure_public_value);
 783
 784   return QUIC_NO_ERROR;
 785 }
 786
 787 scoped_refptr<QuicCryptoServerConfig::Config>
 788 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const {
 789   // In Chromium, we will dead lock if the lock is held by the current thread.
 790   // Chromium doesn't have AssertReaderHeld API call.
 791   // configs_lock_.AssertReaderHeld();
 792
 793   if (!requested_scid.empty()) {
 794     ConfigMap::const_iterator it = configs_.find(requested_scid.as_string());
 795     if (it != configs_.end()) {
 796       // We'll use the config that the client requested in order to do
 797       // key-agreement.
 798       return scoped_refptr<Config>(it->second);
 799     }
 800   }
 801
 802   return scoped_refptr<Config>();
 803 }
 804
 805 // ConfigPrimaryTimeLessThan is a comparator that implements "less than" for
 806 // Config's based on their primary_time.
 807 // static
 808 bool QuicCryptoServerConfig::ConfigPrimaryTimeLessThan(
 809     const scoped_refptr<Config>& a,
 810     const scoped_refptr<Config>& b) {
 811   if (a->primary_time.IsBefore(b->primary_time) ||
 812       b->primary_time.IsBefore(a->primary_time)) {
 813     // Primary times differ.
 814     return a->primary_time.IsBefore(b->primary_time);
 815   } else if (a->priority != b->priority) {
 816     // Primary times are equal, sort backwards by priority.
 817     return a->priority < b->priority;
 818   } else {
 819     // Primary times and priorities are equal, sort by config id.
 820     return a->id < b->id;
 821   }
 822 }
 823
 824 void QuicCryptoServerConfig::SelectNewPrimaryConfig(
 825     const QuicWallTime now) const {
 826   vector<scoped_refptr<Config> > configs;
 827   configs.reserve(configs_.size());
 828
 829   for (ConfigMap::const_iterator it = configs_.begin();
 830        it != configs_.end(); ++it) {
 831     // TODO(avd) Exclude expired configs?
 832     configs.push_back(it->second);
 833   }
 834
 835   if (configs.empty()) {
 836     if (primary_config_.get()) {
 837       LOG(DFATAL) << "No valid QUIC server config. Keeping the current config.";
 838     } else {
 839       LOG(DFATAL) << "No valid QUIC server config.";
 840     }
 841     return;
 842   }
 843
 844   sort(configs.begin(), configs.end(), ConfigPrimaryTimeLessThan);
 845
 846   Config* best_candidate = configs[0].get();
 847
 848   for (size_t i = 0; i < configs.size(); ++i) {
 849     const scoped_refptr<Config> config(configs[i]);
 850     if (!config->primary_time.IsAfter(now)) {
 851       if (config->primary_time.IsAfter(best_candidate->primary_time)) {
 852         best_candidate = config.get();
 853       }
 854       continue;
 855     }
 856
 857     // This is the first config with a primary_time in the future. Thus the
 858     // previous Config should be the primary and this one should determine the
 859     // next_config_promotion_time_.
 860     scoped_refptr<Config> new_primary(best_candidate);
 861     if (i == 0) {
 862       // We need the primary_time of the next config.
 863       if (configs.size() > 1) {
 864         next_config_promotion_time_ = configs[1]->primary_time;
 865       } else {
 866         next_config_promotion_time_ = QuicWallTime::Zero();
 867       }
 868     } else {
 869       next_config_promotion_time_ = config->primary_time;
 870     }
 871
 872     if (primary_config_.get()) {
 873       primary_config_->is_primary = false;
 874     }
 875     primary_config_ = new_primary;
 876     new_primary->is_primary = true;
 877     DVLOG(1) << "New primary config.  orbit: "
 878              << base::HexEncode(
 879                  reinterpret_cast<const char*>(primary_config_->orbit),
 880                  kOrbitSize);
 881     if (primary_config_changed_cb_.get() != NULL) {
 882       primary_config_changed_cb_->Run(primary_config_->id);
 883     }
 884
 885     return;
 886   }
 887
 888   // All config's primary times are in the past. We should make the most recent
 889   // and highest priority candidate primary.
 890   scoped_refptr<Config> new_primary(best_candidate);
 891   if (primary_config_.get()) {
 892     primary_config_->is_primary = false;
 893   }
 894   primary_config_ = new_primary;
 895   new_primary->is_primary = true;
 896   DVLOG(1) << "New primary config.  orbit: "
 897            << base::HexEncode(
 898                reinterpret_cast<const char*>(primary_config_->orbit),
 899                kOrbitSize)
 900            << " scid: " << base::HexEncode(primary_config_->id.data(),
 901                                            primary_config_->id.size());
 902   next_config_promotion_time_ = QuicWallTime::Zero();
 903   if (primary_config_changed_cb_.get() != NULL) {
 904     primary_config_changed_cb_->Run(primary_config_->id);
 905   }
 906 }
 907
 908 void QuicCryptoServerConfig::EvaluateClientHello(
 909     const uint8* primary_orbit,
 910     scoped_refptr<Config> requested_config,
 911     ValidateClientHelloResultCallback::Result* client_hello_state,
 912     ValidateClientHelloResultCallback* done_cb) const {
 913   ValidateClientHelloHelper helper(client_hello_state, done_cb);
 914
 915   const CryptoHandshakeMessage& client_hello =
 916       client_hello_state->client_hello;
 917   ClientHelloInfo* info = &(client_hello_state->info);
 918
 919   if (client_hello.size() < kClientHelloMinimumSize) {
 920     helper.ValidationComplete(QUIC_CRYPTO_INVALID_VALUE_LENGTH,
 921                               "Client hello too small");
 922     return;
 923   }
 924
 925   if (client_hello.GetStringPiece(kSNI, &info->sni) &&
 926       !CryptoUtils::IsValidSNI(info->sni)) {
 927     helper.ValidationComplete(QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER,
 928                               "Invalid SNI name");
 929     return;
 930   }
 931
 932   client_hello.GetStringPiece(kUAID, &info->user_agent_id);
 933
 934   if (!requested_config.get()) {
 935     StringPiece requested_scid;
 936     if (client_hello.GetStringPiece(kSCID, &requested_scid)) {
 937       info->reject_reasons.push_back(SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE);
 938     } else {
 939       info->reject_reasons.push_back(SERVER_CONFIG_INCHOATE_HELLO_FAILURE);
 940     }
 941     // No server config with the requested ID.
 942     helper.ValidationComplete(QUIC_NO_ERROR, "");
 943     return;
 944   }
 945
 946   HandshakeFailureReason source_address_token_error;
 947   StringPiece srct;
 948   if (client_hello.GetStringPiece(kSourceAddressTokenTag, &srct)) {
 949     source_address_token_error = ValidateSourceAddressToken(
 950         *requested_config.get(), srct, info->client_ip, info->now);
 951     info->valid_source_address_token =
 952         (source_address_token_error == HANDSHAKE_OK);
 953   } else {
 954     source_address_token_error = SOURCE_ADDRESS_TOKEN_INVALID_FAILURE;
 955   }
 956
 957   bool found_error = false;
 958   if (source_address_token_error != HANDSHAKE_OK) {
 959     info->reject_reasons.push_back(source_address_token_error);
 960     // No valid source address token.
 961     if (FLAGS_use_early_return_when_verifying_chlo) {
 962       helper.ValidationComplete(QUIC_NO_ERROR, "");
 963       return;
 964     }
 965     found_error = true;
 966   }
 967
 968   if (client_hello.GetStringPiece(kNONC, &info->client_nonce) &&
 969       info->client_nonce.size() == kNonceSize) {
 970     info->client_nonce_well_formed = true;
 971   } else {
 972     info->reject_reasons.push_back(CLIENT_NONCE_INVALID_FAILURE);
 973     // Invalid client nonce.
 974     DVLOG(1) << "Invalid client nonce.";
 975     if (FLAGS_use_early_return_when_verifying_chlo) {
 976       helper.ValidationComplete(QUIC_NO_ERROR, "");
 977       return;
 978     }
 979     found_error = true;
 980   }
 981
 982   if (!replay_protection_) {
 983     if (!found_error) {
 984       info->unique = true;
 985     }
 986     DVLOG(1) << "No replay protection.";
 987     helper.ValidationComplete(QUIC_NO_ERROR, "");
 988     return;
 989   }
 990
 991   client_hello.GetStringPiece(kServerNonceTag, &info->server_nonce);
 992   if (!info->server_nonce.empty()) {
 993     // If the server nonce is present, use it to establish uniqueness.
 994     HandshakeFailureReason server_nonce_error =
 995         ValidateServerNonce(info->server_nonce, info->now);
 996     if (server_nonce_error == HANDSHAKE_OK) {
 997       info->unique = true;
 998     } else {
 999       info->reject_reasons.push_back(server_nonce_error);
1000       info->unique = false;
1001     }
1002     DVLOG(1) << "Using server nonce, unique: " << info->unique;
1003     helper.ValidationComplete(QUIC_NO_ERROR, "");
1004     return;
1005   }
1006
1007   // We want to contact strike register only if there are no errors because it
1008   // is a RPC call and is expensive.
1009   if (found_error) {
1010     helper.ValidationComplete(QUIC_NO_ERROR, "");
1011     return;
1012   }
1013
1014   // Use the client nonce to establish uniqueness.
1015   StrikeRegisterClient* strike_register_client;
1016   {
1017     base::AutoLock locked(strike_register_client_lock_);
1018
1019     if (strike_register_client_.get() == NULL) {
1020       strike_register_client_.reset(new LocalStrikeRegisterClient(
1021           strike_register_max_entries_,
1022           static_cast<uint32>(info->now.ToUNIXSeconds()),
1023           strike_register_window_secs_,
1024           primary_orbit,
1025           strike_register_no_startup_period_ ?
1026           StrikeRegister::NO_STARTUP_PERIOD_NEEDED :
1027           StrikeRegister::DENY_REQUESTS_AT_STARTUP));
1028     }
1029     strike_register_client = strike_register_client_.get();
1030   }
1031
1032   strike_register_client->VerifyNonceIsValidAndUnique(
1033       info->client_nonce,
1034       info->now,
1035       new VerifyNonceIsValidAndUniqueCallback(client_hello_state, done_cb));
1036   helper.StartedAsyncCallback();
1037 }
1038
1039 bool QuicCryptoServerConfig::BuildServerConfigUpdateMessage(
1040     const IPEndPoint& client_ip,
1041     const QuicClock* clock,
1042     QuicRandom* rand,
1043     const QuicCryptoNegotiatedParameters& params,
1044     const CachedNetworkParameters* cached_network_params,
1045     CryptoHandshakeMessage* out) const {
1046   base::AutoLock locked(configs_lock_);
1047   out->set_tag(kSCUP);
1048   out->SetStringPiece(kSCFG, primary_config_->serialized);
1049   out->SetStringPiece(kSourceAddressTokenTag,
1050                       NewSourceAddressToken(*primary_config_.get(),
1051                                             client_ip,
1052                                             rand,
1053                                             clock->WallNow(),
1054                                             cached_network_params));
1055
1056   if (proof_source_ == NULL) {
1057     // Insecure QUIC, can send SCFG without proof.
1058     return true;
1059   }
1060
1061   const vector<string>* certs;
1062   string signature;
1063   if (!proof_source_->GetProof(params.sni, primary_config_->serialized,
1064                                params.x509_ecdsa_supported, &certs,
1065                                &signature)) {
1066     DVLOG(1) << "Server: failed to get proof.";
1067     return false;
1068   }
1069
1070   const string compressed = CertCompressor::CompressChain(
1071       *certs, params.client_common_set_hashes, params.client_cached_cert_hashes,
1072       primary_config_->common_cert_sets);
1073
1074   out->SetStringPiece(kCertificateTag, compressed);
1075   out->SetStringPiece(kPROF, signature);
1076   return true;
1077 }
1078
1079 void QuicCryptoServerConfig::BuildRejection(
1080     const Config& config,
1081     const CryptoHandshakeMessage& client_hello,
1082     const ClientHelloInfo& info,
1083     QuicRandom* rand,
1084     QuicCryptoNegotiatedParameters *params,
1085     CryptoHandshakeMessage* out) const {
1086   out->set_tag(kREJ);
1087   out->SetStringPiece(kSCFG, config.serialized);
1088   out->SetStringPiece(kSourceAddressTokenTag,
1089                       NewSourceAddressToken(
1090                           config,
1091                           info.client_ip,
1092                           rand,
1093                           info.now,
1094                           NULL));
1095   if (replay_protection_) {
1096     out->SetStringPiece(kServerNonceTag, NewServerNonce(rand, info.now));
1097   }
1098
1099   if (FLAGS_send_quic_crypto_reject_reason) {
1100     // Send client the reject reason for debugging purposes.
1101     DCHECK_LT(0u, info.reject_reasons.size());
1102     out->SetVector(kRREJ, info.reject_reasons);
1103   }
1104
1105   // The client may have requested a certificate chain.
1106   const QuicTag* their_proof_demands;
1107   size_t num_their_proof_demands;
1108
1109   if (proof_source_.get() == NULL ||
1110       client_hello.GetTaglist(kPDMD, &their_proof_demands,
1111                               &num_their_proof_demands) !=
1112           QUIC_NO_ERROR) {
1113     return;
1114   }
1115
1116   bool x509_supported = false;
1117   for (size_t i = 0; i < num_their_proof_demands; i++) {
1118     switch (their_proof_demands[i]) {
1119       case kX509:
1120         x509_supported = true;
1121         params->x509_ecdsa_supported = true;
1122         break;
1123       case kX59R:
1124         x509_supported = true;
1125         break;
1126     }
1127   }
1128
1129   if (!x509_supported) {
1130     return;
1131   }
1132
1133   const vector<string>* certs;
1134   string signature;
1135   if (!proof_source_->GetProof(info.sni.as_string(), config.serialized,
1136                                params->x509_ecdsa_supported, &certs,
1137                                &signature)) {
1138     return;
1139   }
1140
1141   StringPiece client_common_set_hashes;
1142   if (client_hello.GetStringPiece(kCCS, &client_common_set_hashes)) {
1143     params->client_common_set_hashes = client_common_set_hashes.as_string();
1144   }
1145
1146   StringPiece client_cached_cert_hashes;
1147   if (client_hello.GetStringPiece(kCCRT, &client_cached_cert_hashes)) {
1148     params->client_cached_cert_hashes = client_cached_cert_hashes.as_string();
1149   }
1150
1151   const string compressed = CertCompressor::CompressChain(
1152       *certs, params->client_common_set_hashes,
1153       params->client_cached_cert_hashes, config.common_cert_sets);
1154
1155   // kREJOverheadBytes is a very rough estimate of how much of a REJ
1156   // message is taken up by things other than the certificates.
1157   // STK: 56 bytes
1158   // SNO: 56 bytes
1159   // SCFG
1160   //   SCID: 16 bytes
1161   //   PUBS: 38 bytes
1162   const size_t kREJOverheadBytes = 166;
1163   // kMultiplier is the multiple of the CHLO message size that a REJ message
1164   // must stay under when the client doesn't present a valid source-address
1165   // token.
1166   const size_t kMultiplier = 2;
1167   // max_unverified_size is the number of bytes that the certificate chain
1168   // and signature can consume before we will demand a valid source-address
1169   // token.
1170   const size_t max_unverified_size =
1171       client_hello.size() * kMultiplier - kREJOverheadBytes;
1172   COMPILE_ASSERT(kClientHelloMinimumSize * kMultiplier >= kREJOverheadBytes,
1173                  overhead_calculation_may_underflow);
1174   if (info.valid_source_address_token ||
1175       signature.size() + compressed.size() < max_unverified_size) {
1176     out->SetStringPiece(kCertificateTag, compressed);
1177     out->SetStringPiece(kPROF, signature);
1178   }
1179 }
1180
1181 scoped_refptr<QuicCryptoServerConfig::Config>
1182 QuicCryptoServerConfig::ParseConfigProtobuf(
1183     QuicServerConfigProtobuf* protobuf) {
1184   scoped_ptr<CryptoHandshakeMessage> msg(
1185       CryptoFramer::ParseMessage(protobuf->config()));
1186
1187   if (msg->tag() != kSCFG) {
1188     LOG(WARNING) << "Server config message has tag " << msg->tag()
1189                  << " expected " << kSCFG;
1190     return NULL;
1191   }
1192
1193   scoped_refptr<Config> config(new Config);
1194   config->serialized = protobuf->config();
1195
1196   if (!protobuf->has_source_address_token_secret_override()) {
1197     // Use the default boxer.
1198     config->source_address_token_boxer = &default_source_address_token_boxer_;
1199   } else {
1200     // Create override boxer instance.
1201     CryptoSecretBoxer* boxer = new CryptoSecretBoxer;
1202     boxer->SetKey(DeriveSourceAddressTokenKey(
1203         protobuf->source_address_token_secret_override()));
1204     config->source_address_token_boxer_storage.reset(boxer);
1205     config->source_address_token_boxer = boxer;
1206   }
1207
1208   if (protobuf->has_primary_time()) {
1209     config->primary_time =
1210         QuicWallTime::FromUNIXSeconds(protobuf->primary_time());
1211   }
1212
1213   config->priority = protobuf->priority();
1214
1215   StringPiece scid;
1216   if (!msg->GetStringPiece(kSCID, &scid)) {
1217     LOG(WARNING) << "Server config message is missing SCID";
1218     return NULL;
1219   }
1220   config->id = scid.as_string();
1221
1222   const QuicTag* aead_tags;
1223   size_t aead_len;
1224   if (msg->GetTaglist(kAEAD, &aead_tags, &aead_len) != QUIC_NO_ERROR) {
1225     LOG(WARNING) << "Server config message is missing AEAD";
1226     return NULL;
1227   }
1228   config->aead = vector<QuicTag>(aead_tags, aead_tags + aead_len);
1229
1230   const QuicTag* kexs_tags;
1231   size_t kexs_len;
1232   if (msg->GetTaglist(kKEXS, &kexs_tags, &kexs_len) != QUIC_NO_ERROR) {
1233     LOG(WARNING) << "Server config message is missing KEXS";
1234     return NULL;
1235   }
1236
1237   StringPiece orbit;
1238   if (!msg->GetStringPiece(kORBT, &orbit)) {
1239     LOG(WARNING) << "Server config message is missing ORBT";
1240     return NULL;
1241   }
1242
1243   if (orbit.size() != kOrbitSize) {
1244     LOG(WARNING) << "Orbit value in server config is the wrong length."
1245                     " Got " << orbit.size() << " want " << kOrbitSize;
1246     return NULL;
1247   }
1248   COMPILE_ASSERT(sizeof(config->orbit) == kOrbitSize, orbit_incorrect_size);
1249   memcpy(config->orbit, orbit.data(), sizeof(config->orbit));
1250
1251   {
1252     StrikeRegisterClient* strike_register_client;
1253     {
1254       base::AutoLock locked(strike_register_client_lock_);
1255       strike_register_client = strike_register_client_.get();
1256     }
1257
1258     if (strike_register_client != NULL &&
1259         !strike_register_client->IsKnownOrbit(orbit)) {
1260       LOG(WARNING)
1261           << "Rejecting server config with orbit that the strike register "
1262           "client doesn't know about.";
1263       return NULL;
1264     }
1265   }
1266
1267   if (kexs_len != protobuf->key_size()) {
1268     LOG(WARNING) << "Server config has " << kexs_len
1269                  << " key exchange methods configured, but "
1270                  << protobuf->key_size() << " private keys";
1271     return NULL;
1272   }
1273
1274   const QuicTag* proof_demand_tags;
1275   size_t num_proof_demand_tags;
1276   if (msg->GetTaglist(kPDMD, &proof_demand_tags, &num_proof_demand_tags) ==
1277       QUIC_NO_ERROR) {
1278     for (size_t i = 0; i < num_proof_demand_tags; i++) {
1279       if (proof_demand_tags[i] == kCHID) {
1280         config->channel_id_enabled = true;
1281         break;
1282       }
1283     }
1284   }
1285
1286   for (size_t i = 0; i < kexs_len; i++) {
1287     const QuicTag tag = kexs_tags[i];
1288     string private_key;
1289
1290     config->kexs.push_back(tag);
1291
1292     for (size_t j = 0; j < protobuf->key_size(); j++) {
1293       const QuicServerConfigProtobuf::PrivateKey& key = protobuf->key(i);
1294       if (key.tag() == tag) {
1295         private_key = key.private_key();
1296         break;
1297       }
1298     }
1299
1300     if (private_key.empty()) {
1301       LOG(WARNING) << "Server config contains key exchange method without "
1302                       "corresponding private key: " << tag;
1303       return NULL;
1304     }
1305
1306     scoped_ptr<KeyExchange> ka;
1307     switch (tag) {
1308       case kC255:
1309         ka.reset(Curve25519KeyExchange::New(private_key));
1310         if (!ka.get()) {
1311           LOG(WARNING) << "Server config contained an invalid curve25519"
1312                           " private key.";
1313           return NULL;
1314         }
1315         break;
1316       case kP256:
1317         ka.reset(P256KeyExchange::New(private_key));
1318         if (!ka.get()) {
1319           LOG(WARNING) << "Server config contained an invalid P-256"
1320                           " private key.";
1321           return NULL;
1322         }
1323         break;
1324       default:
1325         LOG(WARNING) << "Server config message contains unknown key exchange "
1326                         "method: " << tag;
1327         return NULL;
1328     }
1329
1330     for (vector<KeyExchange*>::const_iterator i = config->key_exchanges.begin();
1331          i != config->key_exchanges.end(); ++i) {
1332       if ((*i)->tag() == tag) {
1333         LOG(WARNING) << "Duplicate key exchange in config: " << tag;
1334         return NULL;
1335       }
1336     }
1337
1338     config->key_exchanges.push_back(ka.release());
1339   }
1340
1341   return config;
1342 }
1343
1344 void QuicCryptoServerConfig::SetProofSource(ProofSource* proof_source) {
1345   proof_source_.reset(proof_source);
1346 }
1347
1348 void QuicCryptoServerConfig::SetEphemeralKeySource(
1349     EphemeralKeySource* ephemeral_key_source) {
1350   ephemeral_key_source_.reset(ephemeral_key_source);
1351 }
1352
1353 void QuicCryptoServerConfig::SetStrikeRegisterClient(
1354     StrikeRegisterClient* strike_register_client) {
1355   base::AutoLock locker(strike_register_client_lock_);
1356   DCHECK(!strike_register_client_.get());
1357   strike_register_client_.reset(strike_register_client);
1358 }
1359
1360 void QuicCryptoServerConfig::set_replay_protection(bool on) {
1361   replay_protection_ = on;
1362 }
1363
1364 void QuicCryptoServerConfig::set_strike_register_no_startup_period() {
1365   base::AutoLock locker(strike_register_client_lock_);
1366   DCHECK(!strike_register_client_.get());
1367   strike_register_no_startup_period_ = true;
1368 }
1369
1370 void QuicCryptoServerConfig::set_strike_register_max_entries(
1371     uint32 max_entries) {
1372   base::AutoLock locker(strike_register_client_lock_);
1373   DCHECK(!strike_register_client_.get());
1374   strike_register_max_entries_ = max_entries;
1375 }
1376
1377 void QuicCryptoServerConfig::set_strike_register_window_secs(
1378     uint32 window_secs) {
1379   base::AutoLock locker(strike_register_client_lock_);
1380   DCHECK(!strike_register_client_.get());
1381   strike_register_window_secs_ = window_secs;
1382 }
1383
1384 void QuicCryptoServerConfig::set_source_address_token_future_secs(
1385     uint32 future_secs) {
1386   source_address_token_future_secs_ = future_secs;
1387 }
1388
1389 void QuicCryptoServerConfig::set_source_address_token_lifetime_secs(
1390     uint32 lifetime_secs) {
1391   source_address_token_lifetime_secs_ = lifetime_secs;
1392 }
1393
1394 void QuicCryptoServerConfig::set_server_nonce_strike_register_max_entries(
1395     uint32 max_entries) {
1396   DCHECK(!server_nonce_strike_register_.get());
1397   server_nonce_strike_register_max_entries_ = max_entries;
1398 }
1399
1400 void QuicCryptoServerConfig::set_server_nonce_strike_register_window_secs(
1401     uint32 window_secs) {
1402   DCHECK(!server_nonce_strike_register_.get());
1403   server_nonce_strike_register_window_secs_ = window_secs;
1404 }
1405
1406 void QuicCryptoServerConfig::AcquirePrimaryConfigChangedCb(
1407     PrimaryConfigChangedCallback* cb) {
1408   base::AutoLock locked(configs_lock_);
1409   primary_config_changed_cb_.reset(cb);
1410 }
1411
1412 string QuicCryptoServerConfig::NewSourceAddressToken(
1413     const Config& config,
1414     const IPEndPoint& ip,
1415     QuicRandom* rand,
1416     QuicWallTime now,
1417     const CachedNetworkParameters* cached_network_params) const {
1418   IPAddressNumber ip_address = ip.address();
1419   if (ip.GetSockAddrFamily() == AF_INET) {
1420     ip_address = ConvertIPv4NumberToIPv6Number(ip_address);
1421   }
1422   SourceAddressToken source_address_token;
1423   source_address_token.set_ip(IPAddressToPackedString(ip_address));
1424   source_address_token.set_timestamp(now.ToUNIXSeconds());
1425   if (cached_network_params != NULL) {
1426     source_address_token.set_cached_network_parameters(*cached_network_params);
1427   }
1428
1429   return config.source_address_token_boxer->Box(
1430       rand, source_address_token.SerializeAsString());
1431 }
1432
1433 HandshakeFailureReason QuicCryptoServerConfig::ValidateSourceAddressToken(
1434     const Config& config,
1435     StringPiece token,
1436     const IPEndPoint& ip,
1437     QuicWallTime now) const {
1438   string storage;
1439   StringPiece plaintext;
1440   if (!config.source_address_token_boxer->Unbox(token, &storage, &plaintext)) {
1441     return SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE;
1442   }
1443
1444   SourceAddressToken source_address_token;
1445   if (!source_address_token.ParseFromArray(plaintext.data(),
1446                                            plaintext.size())) {
1447     return SOURCE_ADDRESS_TOKEN_PARSE_FAILURE;
1448   }
1449
1450   IPAddressNumber ip_address = ip.address();
1451   if (ip.GetSockAddrFamily() == AF_INET) {
1452     ip_address = ConvertIPv4NumberToIPv6Number(ip_address);
1453   }
1454   if (source_address_token.ip() != IPAddressToPackedString(ip_address)) {
1455     // It's for a different IP address.
1456     return SOURCE_ADDRESS_TOKEN_DIFFERENT_IP_ADDRESS_FAILURE;
1457   }
1458
1459   const QuicWallTime timestamp(
1460       QuicWallTime::FromUNIXSeconds(source_address_token.timestamp()));
1461   const QuicTime::Delta delta(now.AbsoluteDifference(timestamp));
1462
1463   if (now.IsBefore(timestamp) &&
1464       delta.ToSeconds() > source_address_token_future_secs_) {
1465     return SOURCE_ADDRESS_TOKEN_CLOCK_SKEW_FAILURE;
1466   }
1467
1468   if (now.IsAfter(timestamp) &&
1469       delta.ToSeconds() > source_address_token_lifetime_secs_) {
1470     return SOURCE_ADDRESS_TOKEN_EXPIRED_FAILURE;
1471   }
1472
1473   return HANDSHAKE_OK;
1474 }
1475
1476 // kServerNoncePlaintextSize is the number of bytes in an unencrypted server
1477 // nonce.
1478 static const size_t kServerNoncePlaintextSize =
1479     4 /* timestamp */ + 20 /* random bytes */;
1480
1481 string QuicCryptoServerConfig::NewServerNonce(QuicRandom* rand,
1482                                               QuicWallTime now) const {
1483   const uint32 timestamp = static_cast<uint32>(now.ToUNIXSeconds());
1484
1485   uint8 server_nonce[kServerNoncePlaintextSize];
1486   COMPILE_ASSERT(sizeof(server_nonce) > sizeof(timestamp), nonce_too_small);
1487   server_nonce[0] = static_cast<uint8>(timestamp >> 24);
1488   server_nonce[1] = static_cast<uint8>(timestamp >> 16);
1489   server_nonce[2] = static_cast<uint8>(timestamp >> 8);
1490   server_nonce[3] = static_cast<uint8>(timestamp);
1491   rand->RandBytes(&server_nonce[sizeof(timestamp)],
1492                   sizeof(server_nonce) - sizeof(timestamp));
1493
1494   return server_nonce_boxer_.Box(
1495       rand,
1496       StringPiece(reinterpret_cast<char*>(server_nonce), sizeof(server_nonce)));
1497 }
1498
1499 HandshakeFailureReason QuicCryptoServerConfig::ValidateServerNonce(
1500     StringPiece token,
1501     QuicWallTime now) const {
1502   string storage;
1503   StringPiece plaintext;
1504   if (!server_nonce_boxer_.Unbox(token, &storage, &plaintext)) {
1505     return SERVER_NONCE_DECRYPTION_FAILURE;
1506   }
1507
1508   // plaintext contains:
1509   //   uint32 timestamp
1510   //   uint8[20] random bytes
1511
1512   if (plaintext.size() != kServerNoncePlaintextSize) {
1513     // This should never happen because the value decrypted correctly.
1514     LOG(DFATAL) << "Seemingly valid server nonce had incorrect length.";
1515     return SERVER_NONCE_INVALID_FAILURE;
1516   }
1517
1518   uint8 server_nonce[32];
1519   memcpy(server_nonce, plaintext.data(), 4);
1520   memcpy(server_nonce + 4, server_nonce_orbit_, sizeof(server_nonce_orbit_));
1521   memcpy(server_nonce + 4 + sizeof(server_nonce_orbit_), plaintext.data() + 4,
1522          20);
1523   COMPILE_ASSERT(4 + sizeof(server_nonce_orbit_) + 20 == sizeof(server_nonce),
1524                  bad_nonce_buffer_length);
1525
1526   InsertStatus nonce_error;
1527   {
1528     base::AutoLock auto_lock(server_nonce_strike_register_lock_);
1529     if (server_nonce_strike_register_.get() == NULL) {
1530       server_nonce_strike_register_.reset(new StrikeRegister(
1531           server_nonce_strike_register_max_entries_,
1532           static_cast<uint32>(now.ToUNIXSeconds()),
1533           server_nonce_strike_register_window_secs_, server_nonce_orbit_,
1534           StrikeRegister::NO_STARTUP_PERIOD_NEEDED));
1535     }
1536     nonce_error = server_nonce_strike_register_->Insert(
1537         server_nonce, static_cast<uint32>(now.ToUNIXSeconds()));
1538   }
1539
1540   switch (nonce_error) {
1541     case NONCE_OK:
1542       return HANDSHAKE_OK;
1543     case NONCE_INVALID_FAILURE:
1544     case NONCE_INVALID_ORBIT_FAILURE:
1545       return SERVER_NONCE_INVALID_FAILURE;
1546     case NONCE_NOT_UNIQUE_FAILURE:
1547       return SERVER_NONCE_NOT_UNIQUE_FAILURE;
1548     case NONCE_INVALID_TIME_FAILURE:
1549       return SERVER_NONCE_INVALID_TIME_FAILURE;
1550     case NONCE_UNKNOWN_FAILURE:
1551     case STRIKE_REGISTER_TIMEOUT:
1552     case STRIKE_REGISTER_FAILURE:
1553     default:
1554       LOG(DFATAL) << "Unexpected server nonce error: " << nonce_error;
1555       return SERVER_NONCE_NOT_UNIQUE_FAILURE;
1556   }
1557 }
1558
1559 QuicCryptoServerConfig::Config::Config()
1560     : channel_id_enabled(false),
1561       is_primary(false),
1562       primary_time(QuicWallTime::Zero()),
1563       priority(0),
1564       source_address_token_boxer(NULL) {}
1565
1566 QuicCryptoServerConfig::Config::~Config() { STLDeleteElements(&key_exchanges); }
1567
1568 }  // namespace net