Skip to content

Commit 492debe

Browse files
hodduchodduc
committed
apply libquic changes (cont.)
1 parent 3414ddd commit 492debe

7 files changed

+70
-32
lines changed

‎go_functions.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ void DeleteGoSession_C(int64_t go_quic_dispatcher, int64_t go_quic_server_sessio
2222
DeleteGoSession(go_quic_dispatcher, go_quic_server_session);
2323
}
2424

25-
int GetProof_C(int64_t go_proof_source, void* server_ip, size_t server_ip_sz, char* hostname, size_t hostname_sz, char* server_config, size_t server_config_sz, int ecdsa_ok, char **out_signature, size_t *out_signature_sz) {
26-
return GetProof(go_proof_source, server_ip, server_ip_sz, hostname, hostname_sz, server_config, server_config_sz, ecdsa_ok, out_signature, out_signature_sz);
25+
int GetProof_C(int64_t go_proof_source, char* server_ip, size_t server_ip_sz, char* hostname, size_t hostname_sz, char* server_config, size_t server_config_sz, int quic_version, char* chlo_hash, size_t chlo_hash_len, int ecdsa_ok, char **out_signature, size_t *out_signature_sz) {
26+
return GetProof(go_proof_source, server_ip, server_ip_sz, hostname, hostname_sz, server_config, server_config_sz, quic_version, chlo_hash, chlo_hash_len, ecdsa_ok, out_signature, out_signature_sz);
2727
}
2828

2929
int64_t CreateIncomingDynamicStream_C(int64_t go_quic_server_session, uint32_t id, void* go_quic_simple_server_stream_go_wrapper) {
@@ -80,8 +80,8 @@ void GoQuicSimpleServerStreamOnClose_C(int64_t go_quic_simple_server_stream) {
8080
GoQuicSimpleServerStreamOnClose(go_quic_simple_server_stream);
8181
}
8282

83-
int64_t NewProofVerifyJob_C(int64_t go_proof_verifier, const char* hostname, size_t hostname_len, const char* server_config, size_t server_config_len, const char* cert_sct, size_t cert_sct_len, const char* signature, size_t signature_len) {
84-
return NewProofVerifyJob(go_proof_verifier, (void *)hostname, hostname_len, (void *)server_config, server_config_len, (void *)cert_sct, cert_sct_len, (void *)signature, signature_len);
83+
int64_t NewProofVerifyJob_C(int64_t go_proof_verifier, int quic_version, const char* hostname, size_t hostname_len, const char* server_config, size_t server_config_len, const char* chlo_hash, size_t chlo_hash_len, const char* cert_sct, size_t cert_sct_len, const char* signature, size_t signature_len) {
84+
return NewProofVerifyJob(go_proof_verifier, quic_version, (void *)hostname, hostname_len, (void *)server_config, server_config_len, (void *)chlo_hash, chlo_hash_len, (void *)cert_sct, cert_sct_len, (void *)signature, signature_len);
8585
}
8686

8787
void ProofVerifyJobAddCert_C(int64_t job, const char* cert, size_t cert_len) {

‎go_functions.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ void WriteToUDP_C(int64_t go_writer, void* peer_ip, size_t peer_ip_sz, uint16_t
99
void WriteToUDPClient_C(int64_t go_writer, void* peer_ip, size_t peer_ip_sz, uint16_t peer_port, void* buffer, size_t buf_len);
1010
int64_t CreateGoSession_C(int64_t go_quic_dispatcher, void* quic_server_session);
1111
void DeleteGoSession_C(int64_t go_quic_dispatcher, int64_t go_quic_server_session);
12-
int GetProof_C(int64_t go_proof_source, void* server_ip, size_t server_ip_sz, char* hostname, size_t hostname_sz, char* server_config, size_t server_config_sz, int ecdsa_ok, char **out_signature, size_t *out_signature_sz);
12+
int GetProof_C(int64_t go_proof_source, char* server_ip, size_t server_ip_sz, char* hostname, size_t hostname_sz, char* server_config, size_t server_config_sz, int quic_version, char* chlo_hash, size_t chlo_hash_len, int ecdsa_ok, char **out_signature, size_t *out_signature_sz);
1313
int64_t CreateIncomingDynamicStream_C(int64_t go_quic_server_session, uint32_t id, void* go_quic_simple_server_stream_go_wrapper);
1414
void UnregisterQuicServerStreamFromSession_C(int64_t go_stream);
1515
void UnregisterQuicClientStreamFromSession_C(int64_t go_stream);
@@ -28,7 +28,7 @@ void GoQuicSimpleServerStreamOnTrailingHeadersComplete_C(int64_t go_quic_spdy_cl
2828
void GoQuicSimpleServerStreamOnDataAvailable_C(int64_t go_quic_simple_server_stream, const char *data, uint32_t data_len, int is_closed);
2929
void GoQuicSimpleServerStreamOnClose_C(int64_t go_quic_simple_server_stream);
3030

31-
int64_t NewProofVerifyJob_C(int64_t go_proof_verifier, const char* hostname, size_t hostname_len, const char* server_config, size_t server_config_len, const char* cert_sct, size_t cert_sct_len, const char* signature, size_t signature_len);
31+
int64_t NewProofVerifyJob_C(int64_t go_proof_verifier, int quic_version, const char* hostname, size_t hostname_len, const char* server_config, size_t server_config_len, const char* chlo_hash, size_t chlo_hash_len, const char* cert_sct, size_t cert_sct_len, const char* signature, size_t signature_len);
3232
void ProofVerifyJobAddCert_C(int64_t job, const char* cert, size_t cert_len);
3333
int ProofVerifyJobVerifyProof_C(int64_t job);
3434

‎proof_source.go

+28-13
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,34 @@ import (
1111
"crypto/rsa"
1212
"crypto/tls"
1313
"crypto/x509"
14+
"encoding/binary"
1415
"net"
1516
"unsafe"
1617
)
1718

18-
// Generate "proof of authenticity" (See "Quic Crypto" docs for details)
19-
// Length of the prefix used to calculate the signature: length of label + 0x00 byte
20-
const kPrefixStr = "QUIC server config signature"
21-
const kPrefixLen = len(kPrefixStr) + 1
22-
2319
type ProofSource struct {
2420
Certificate tls.Certificate
2521
proofSource_c unsafe.Pointer
2622
}
2723

28-
func (ps *ProofSource) GetProof(addr net.IP, hostname []byte, serverConfig []byte, ecdsaOk bool) (outSignature []byte) {
24+
func (ps *ProofSource) GetProof(quicVersion int, addr net.IP, hostname []byte, serverConfig []byte, chloHash []byte, ecdsaOk bool) (outSignature []byte) {
2925
var err error = nil
30-
31-
bufferToSign := bytes.NewBuffer(make([]byte, 0, len(serverConfig)+kPrefixLen))
32-
bufferToSign.Write([]byte(kPrefixStr))
33-
bufferToSign.Write([]byte("\x00"))
34-
bufferToSign.Write(serverConfig)
26+
var bufferToSign *bytes.Buffer
27+
28+
if quicVersion > 30 {
29+
bufferToSign = bytes.NewBuffer(nil)
30+
bufferToSign.Write(ProofSignatureLabel)
31+
32+
bs := make([]byte, 4)
33+
binary.LittleEndian.PutUint32(bs, uint32(len(chloHash)))
34+
bufferToSign.Write(bs)
35+
bufferToSign.Write(chloHash)
36+
bufferToSign.Write(serverConfig)
37+
} else {
38+
bufferToSign = bytes.NewBuffer(nil)
39+
bufferToSign.Write(ProofSignatureLabelOld)
40+
bufferToSign.Write(serverConfig)
41+
}
3542

3643
hasher := crypto.SHA256.New()
3744
_, err = hasher.Write(bufferToSign.Bytes())
@@ -86,15 +93,23 @@ func NewProofSource(cert tls.Certificate) *ProofSource {
8693
}
8794

8895
//export GetProof
89-
func GetProof(proof_source_key int64, server_ip_c unsafe.Pointer, server_ip_sz C.size_t, hostname_c unsafe.Pointer, hostname_sz_c C.size_t, server_config_c unsafe.Pointer, server_config_sz_c C.size_t, ecdsa_ok_c C.int, out_signature_c **C.char, out_signature_sz_c *C.size_t) C.int {
96+
func GetProof(proof_source_key int64,
97+
server_ip_c unsafe.Pointer, server_ip_sz C.size_t,
98+
hostname_c unsafe.Pointer, hostname_sz_c C.size_t,
99+
server_config_c unsafe.Pointer, server_config_sz_c C.size_t,
100+
quicVersion int,
101+
chlo_hash_c unsafe.Pointer, chlo_hash_sz C.size_t,
102+
ecdsa_ok_c C.int, out_signature_c **C.char, out_signature_sz_c *C.size_t) C.int {
103+
90104
proofSource := proofSourcePtr.Get(proof_source_key)
91105

92106
serverIp := net.IP(C.GoBytes(server_ip_c, C.int(server_ip_sz)))
93107
hostname := C.GoBytes(hostname_c, C.int(hostname_sz_c))
94108
serverConfig := C.GoBytes(server_config_c, C.int(server_config_sz_c))
109+
chloHash := C.GoBytes(chlo_hash_c, C.int(chlo_hash_sz))
95110
ecdsaOk := int(ecdsa_ok_c) > 0
96111

97-
sig := proofSource.GetProof(serverIp, hostname, serverConfig, ecdsaOk)
112+
sig := proofSource.GetProof(quicVersion, serverIp, hostname, serverConfig, chloHash, ecdsaOk)
98113

99114
*out_signature_c = C.CString(string(sig)) // Must free C string
100115
*out_signature_sz_c = C.size_t(len(sig))

‎proof_verifier.go

+23-3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"crypto/rsa"
99
"crypto/sha256"
1010
"crypto/x509"
11+
"encoding/binary"
1112
"errors"
1213
"log"
1314
"unsafe"
@@ -19,8 +20,11 @@ type ProofVerifier struct {
1920
}
2021

2122
type ProofVerifyJob struct {
23+
quicVersion int
24+
2225
hostname []byte
2326
serverConfig []byte
27+
chloHash []byte
2428
certSct []byte
2529
signature []byte
2630
certs [][]byte
@@ -32,14 +36,27 @@ func CreateProofVerifier() *ProofVerifier {
3236
}
3337
}
3438

35-
var ProofSignatureLabel = []byte{'Q', 'U', 'I', 'C', ' ', 's', 'e', 'r', 'v', 'e', 'r', ' ', 'c', 'o', 'n', 'f', 'i', 'g', ' ', 's', 'i', 'g', 'n', 'a', 't', 'u', 'r', 'e', 0x00}
39+
// Generate "proof of authenticity" (See "Quic Crypto" docs for details)
40+
// Length of the prefix used to calculate the signature: length of label + 0x00 byte
41+
var ProofSignatureLabelOld = []byte{'Q', 'U', 'I', 'C', ' ', 's', 'e', 'r', 'v', 'e', 'r', ' ', 'c', 'o', 'n', 'f', 'i', 'g', ' ', 's', 'i', 'g', 'n', 'a', 't', 'u', 'r', 'e', 0x00}
42+
var ProofSignatureLabel = []byte{'Q', 'U', 'I', 'C', ' ', 'C', 'H', 'L', 'O', ' ', 'a', 'n', 'd', ' ', 's', 'e', 'r', 'v', 'e', 'r', ' ', 'c', 'o', 'n', 'f', 'i', 'g', ' ', 's', 'i', 'g', 'n', 'a', 't', 'u', 'r', 'e', 0x00}
3643

3744
func (job *ProofVerifyJob) CheckSignature(cert *x509.Certificate) error {
3845
switch pub := cert.PublicKey.(type) {
3946
case *rsa.PublicKey:
4047
// cert.CheckSignature() uses PKCS1v15, not PSS. So we cannot use that on RSA
4148
h := sha256.New()
42-
h.Write(ProofSignatureLabel)
49+
50+
if job.quicVersion > 30 {
51+
h.Write(ProofSignatureLabel)
52+
53+
bs := make([]byte, 4)
54+
binary.LittleEndian.PutUint32(bs, uint32(len(job.chloHash)))
55+
h.Write(bs)
56+
h.Write(job.chloHash)
57+
} else {
58+
h.Write(ProofSignatureLabelOld)
59+
}
4360
h.Write(job.serverConfig)
4461

4562
if err := rsa.VerifyPSS(pub, crypto.SHA256, h.Sum(nil), job.signature, nil); err != nil {
@@ -102,17 +119,20 @@ func (job *ProofVerifyJob) Verify() bool {
102119
}
103120

104121
//export NewProofVerifyJob
105-
func NewProofVerifyJob(proof_verifier_key int64,
122+
func NewProofVerifyJob(proof_verifier_key int64, quicVersion int,
106123
hostname_c unsafe.Pointer, hostname_sz C.size_t,
107124
server_config_c unsafe.Pointer, server_config_sz C.size_t,
125+
chlo_hash_c unsafe.Pointer, chlo_hash_sz C.size_t,
108126
cert_sct_c unsafe.Pointer, cert_sct_sz C.size_t,
109127
signature_c unsafe.Pointer, signature_sz C.size_t) int64 {
110128

111129
proofVerifier := proofVerifierPtr.Get(proof_verifier_key)
112130

113131
job := &ProofVerifyJob{
132+
quicVersion: quicVersion,
114133
hostname: C.GoBytes(hostname_c, C.int(hostname_sz)),
115134
serverConfig: C.GoBytes(server_config_c, C.int(server_config_sz)),
135+
chloHash: C.GoBytes(chlo_hash_c, C.int(chlo_hash_sz)),
116136
certSct: C.GoBytes(cert_sct_c, C.int(cert_sct_sz)),
117137
signature: C.GoBytes(signature_c, C.int(signature_sz)),
118138
certs: make([][]byte, 0),

‎src/adaptor.cc

+1
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ QuicCryptoServerConfig* init_crypto_config(
145145
crypto_config->set_strike_register_no_startup_period();
146146
net::EphemeralKeySource* keySource = new GoEphemeralKeySource();
147147
crypto_config->SetEphemeralKeySource(keySource);
148+
crypto_config->set_replay_protection(false); // TODO(hodduc): Create strike-register client and turn on replay protection again
148149

149150
QuicClock* clock = new QuicClock(); // XXX: Not deleted.
150151

‎src/go_proof_verifier.cc

+8-5
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,16 @@ QuicAsyncStatus GoProofVerifier::VerifyProof(
3939
return QUIC_FAILURE;
4040
}
4141

42+
auto chlo_hash_str = chlo_hash.as_string();
43+
4244
// Convery certs to X509Certificate.
4345
GoPtr job = NewProofVerifyJob_C(
44-
go_proof_verifier_, (char*)(hostname.c_str()),
45-
(size_t)(hostname.length()), (char*)(server_config.c_str()),
46-
(size_t)(server_config.length()), (char*)(cert_sct.c_str()),
47-
(size_t)(cert_sct.length()), (char*)(signature.c_str()),
48-
(size_t)(signature.length()));
46+
go_proof_verifier_, (int)(quic_version),
47+
(char*)(hostname.c_str()), (size_t)(hostname.length()),
48+
(char*)(server_config.c_str()), (size_t)(server_config.length()),
49+
(char*)(chlo_hash_str.c_str()), (size_t)(chlo_hash_str.length()),
50+
(char*)(cert_sct.c_str()), (size_t)(cert_sct.length()),
51+
(char*)(signature.c_str()), (size_t)(signature.length()));
4952

5053
for (auto it = certs.begin(); it != certs.end(); it++) {
5154
ProofVerifyJobAddCert_C(job, (char*)it->c_str(), (size_t)it->length());

‎src/proof_source_goquic.cc

+4-5
Original file line numberDiff line numberDiff line change
@@ -35,16 +35,15 @@ bool ProofSourceGoquic::GetProof(const net::IPAddress& server_ip,
3535
char* c_out_signature;
3636
size_t c_out_signature_sz;
3737

38-
if (quic_version > QUIC_VERSION_30) {
39-
//TODO(hodduc): QUIC_VERSION_31 support
40-
return false;
41-
}
42-
4338
auto server_ip_bytes = server_ip.bytes();
39+
auto chlo_hash_str = chlo_hash.as_string();
40+
4441
int ret = GetProof_C(go_proof_source_,
4542
reinterpret_cast<char*>(server_ip_bytes.data()), server_ip_bytes.size(),
4643
(char*)hostname.c_str(), (size_t)hostname.length(),
4744
(char*)server_config.c_str(), (size_t)server_config.length(),
45+
(int)quic_version,
46+
(char*)chlo_hash_str.c_str(), (size_t)chlo_hash_str.length(),
4847
ecdsa_ok,
4948
&c_out_signature, &c_out_signature_sz);
5049

0 commit comments

Comments
 (0)