net/quic/crypto/aead_base_decrypter.h

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_QUIC_CRYPTO_AEAD_BASE_DECRYPTER_H_
   6 #define NET_QUIC_CRYPTO_AEAD_BASE_DECRYPTER_H_
   7
   8 #include "base/compiler_specific.h"
   9 #include "net/quic/crypto/quic_decrypter.h"
  10
  11 #if defined(USE_OPENSSL)
  12 #include "net/quic/crypto/scoped_evp_aead_ctx.h"
  13 #else
  14 #include <pkcs11t.h>
  15 #include <seccomon.h>
  16 typedef struct PK11SymKeyStr PK11SymKey;
  17 typedef SECStatus (*PK11_DecryptFunction)(
  18       PK11SymKey* symKey, CK_MECHANISM_TYPE mechanism, SECItem* param,
  19       unsigned char* out, unsigned int* outLen, unsigned int maxLen,
  20       const unsigned char* enc, unsigned encLen);
  21 #endif
  22
  23 namespace net {
  24
  25 // AeadBaseDecrypter is the base class of AEAD QuicDecrypter subclasses.
  26 class NET_EXPORT_PRIVATE AeadBaseDecrypter : public QuicDecrypter {
  27  public:
  28 #if defined(USE_OPENSSL)
  29   AeadBaseDecrypter(const EVP_AEAD* aead_alg,
  30                     size_t key_size,
  31                     size_t auth_tag_size,
  32                     size_t nonce_prefix_size);
  33 #else
  34   AeadBaseDecrypter(CK_MECHANISM_TYPE aead_mechanism,
  35                     PK11_DecryptFunction pk11_decrypt,
  36                     size_t key_size,
  37                     size_t auth_tag_size,
  38                     size_t nonce_prefix_size);
  39 #endif
  40   ~AeadBaseDecrypter() override;
  41
  42   // QuicDecrypter implementation
  43   bool SetKey(base::StringPiece key) override;
  44   bool SetNoncePrefix(base::StringPiece nonce_prefix) override;
  45   bool DecryptPacket(QuicPacketSequenceNumber sequence_number,
  46                      const base::StringPiece& associated_data,
  47                      const base::StringPiece& ciphertext,
  48                      char* output,
  49                      size_t* output_length,
  50                      size_t max_output_length) override;
  51   base::StringPiece GetKey() const override;
  52   base::StringPiece GetNoncePrefix() const override;
  53
  54  protected:
  55   // Make these constants available to the subclasses so that the subclasses
  56   // can assert at compile time their key_size_ and nonce_prefix_size_ do not
  57   // exceed the maximum.
  58   static const size_t kMaxKeySize = 32;
  59   static const size_t kMaxNoncePrefixSize = 4;
  60
  61 #if !defined(USE_OPENSSL)
  62   struct AeadParams {
  63     unsigned int len;
  64     union {
  65       CK_GCM_PARAMS gcm_params;
  66 #if !defined(USE_NSS)
  67       // USE_NSS means we are using system NSS rather than our copy of NSS.
  68       // The system NSS <pkcs11n.h> header doesn't define this type yet.
  69       CK_NSS_AEAD_PARAMS nss_aead_params;
  70 #endif
  71     } data;
  72   };
  73
  74   virtual void FillAeadParams(base::StringPiece nonce,
  75                               const base::StringPiece& associated_data,
  76                               size_t auth_tag_size,
  77                               AeadParams* aead_params) const = 0;
  78 #endif  // !defined(USE_OPENSSL)
  79
  80  private:
  81   bool Decrypt(base::StringPiece nonce,
  82                const base::StringPiece& associated_data,
  83                const base::StringPiece& ciphertext,
  84                uint8* output,
  85                size_t* output_length,
  86                size_t max_output_length);
  87
  88 #if defined(USE_OPENSSL)
  89   const EVP_AEAD* const aead_alg_;
  90 #else
  91   const CK_MECHANISM_TYPE aead_mechanism_;
  92   const PK11_DecryptFunction pk11_decrypt_;
  93 #endif
  94   const size_t key_size_;
  95   const size_t auth_tag_size_;
  96   const size_t nonce_prefix_size_;
  97
  98   // The key.
  99   unsigned char key_[kMaxKeySize];
 100   // The nonce prefix.
 101   unsigned char nonce_prefix_[kMaxNoncePrefixSize];
 102
 103 #if defined(USE_OPENSSL)
 104   ScopedEVPAEADCtx ctx_;
 105 #endif
 106
 107   DISALLOW_COPY_AND_ASSIGN(AeadBaseDecrypter);
 108 };
 109
 110 }  // namespace net
 111
 112 #endif  // NET_QUIC_CRYPTO_AEAD_BASE_DECRYPTER_H_