Skip to content
This repository has been archived by the owner on Aug 11, 2020. It is now read-only.

Commit

Permalink
[WIP] quic: replace key callback with set secrets callback
Browse files Browse the repository at this point in the history
  • Loading branch information
@jasnell
jasnell committed Oct 3, 2019
1 parent 0cf6f83 commit 578b286
Show file tree
Hide file tree
Showing 5 changed files with 171 additions and 211 deletions.
150 changes: 88 additions & 62 deletions src/node_quic_crypto.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -818,38 +818,63 @@ bool InstallEarlyKeys(
ivlen) == 0;
}

const char* GetEncryptionLevelName(int level) {
switch (level) {
case ssl_encryption_initial:
return "Initial";
case ssl_encryption_early_data:
return "Early";
case ssl_encryption_handshake:
return "Handshake";
case ssl_encryption_application:
return "Application";
default:
return "<unknown>";
}
}

bool InstallHandshakeKeys(
ngtcp2_conn* conn,
const ngtcp2_crypto_ctx* ctx,
std::unique_ptr<KeyStorage> ks) {
SessionKey* rx_key,
SessionIV* rx_iv,
SessionKey* rx_hp,
SessionKey* tx_key,
SessionIV* tx_iv,
SessionKey* tx_hp) {
size_t keylen = aead_key_length(&ctx->aead);
size_t ivlen = packet_protection_ivlen(ctx);
return ngtcp2_conn_install_handshake_key(
conn,
ks->rx_key.data(),
ks->rx_iv.data(),
ks->rx_hp.data(),
ks->tx_key.data(),
ks->tx_iv.data(),
ks->tx_hp.data(),
rx_key->data(),
rx_iv->data(),
rx_hp->data(),
tx_key->data(),
tx_iv->data(),
tx_hp->data(),
keylen,
ivlen) == 0;
}

bool InstallSessionKeys(
ngtcp2_conn* conn,
const ngtcp2_crypto_ctx* ctx,
std::unique_ptr<KeyStorage> ks) {
SessionKey* rx_key,
SessionIV* rx_iv,
SessionKey* rx_hp,
SessionKey* tx_key,
SessionIV* tx_iv,
SessionKey* tx_hp) {
size_t keylen = aead_key_length(&ctx->aead);
size_t ivlen = packet_protection_ivlen(ctx);
return ngtcp2_conn_install_key(
conn,
ks->rx_key.data(),
ks->rx_iv.data(),
ks->rx_hp.data(),
ks->tx_key.data(),
ks->tx_iv.data(),
ks->tx_hp.data(),
rx_key->data(),
rx_iv->data(),
rx_hp->data(),
tx_key->data(),
tx_iv->data(),
tx_hp->data(),
keylen,
ivlen) == 0;
}
Expand Down Expand Up @@ -885,63 +910,64 @@ void MessageCB(
}
}

void LogSecret(
SSL* ssl,
int name,
const unsigned char* secret,
size_t secretlen) {
if (auto keylog_cb = SSL_CTX_get_keylog_callback(SSL_get_SSL_CTX(ssl))) {
unsigned char crandom[32];
if (SSL_get_client_random(ssl, crandom, 32) != 32)
return;
std::string line;
switch (name) {
case SSL_KEY_CLIENT_EARLY_TRAFFIC:
line = "QUIC_CLIENT_EARLY_TRAFFIC_SECRET";
break;
case SSL_KEY_CLIENT_HANDSHAKE_TRAFFIC:
line = "QUIC_CLIENT_HANDSHAKE_TRAFFIC_SECRET";
break;
case SSL_KEY_CLIENT_APPLICATION_TRAFFIC:
line = "QUIC_CLIENT_TRAFFIC_SECRET_0";
break;
case SSL_KEY_SERVER_HANDSHAKE_TRAFFIC:
line = "QUIC_SERVER_HANDSHAKE_TRAFFIC_SECRET";
break;
case SSL_KEY_SERVER_APPLICATION_TRAFFIC:
line = "QUIC_SERVER_TRAFFIC_SECRET_0";
break;
default:
return;
}

line += " " + StringBytes::hex_encode(
reinterpret_cast<const char*>(crandom), 32);
line += " " + StringBytes::hex_encode(
reinterpret_cast<const char*>(secret), secretlen);
keylog_cb(ssl, line.c_str());
}
}
// void LogSecrets(
// SSL* ssl,
// int level,
// const uint8_t* rx_secret,
// const uint8_t* tx_secret,
// size_t secretlen) {
// if (auto keylog_cb = SSL_CTX_get_keylog_callback(SSL_get_SSL_CTX(ssl))) {
// unsigned char crandom[32];
// if (SSL_get_client_random(ssl, crandom, 32) != 32)
// return;
// std::string line;
// switch (name) {
// case SSL_KEY_CLIENT_EARLY_TRAFFIC:
// line = "QUIC_CLIENT_EARLY_TRAFFIC_SECRET";
// break;
// case SSL_KEY_CLIENT_HANDSHAKE_TRAFFIC:
// line = "QUIC_CLIENT_HANDSHAKE_TRAFFIC_SECRET";
// break;
// case SSL_KEY_CLIENT_APPLICATION_TRAFFIC:
// line = "QUIC_CLIENT_TRAFFIC_SECRET_0";
// break;
// case SSL_KEY_SERVER_HANDSHAKE_TRAFFIC:
// line = "QUIC_SERVER_HANDSHAKE_TRAFFIC_SECRET";
// break;
// case SSL_KEY_SERVER_APPLICATION_TRAFFIC:
// line = "QUIC_SERVER_TRAFFIC_SECRET_0";
// break;
// default:
// return;
// }

// line += " " + StringBytes::hex_encode(
// reinterpret_cast<const char*>(crandom), 32);
// line += " " + StringBytes::hex_encode(
// reinterpret_cast<const char*>(secret), secretlen);
// keylog_cb(ssl, line.c_str());
// }
// }

int CertCB(SSL* ssl, void* arg) {
QuicSession* session = static_cast<QuicSession*>(arg);
return session->OnCert();
}

// KeyCB provides a hook into the keying process of the TLS handshake,
// triggering registration of the keys associated with the TLS session.
int KeyCB(
int EncryptionSecretsCB(
SSL* ssl,
int name,
const unsigned char* secret,
size_t secretlen,
int level,
const uint8_t* read_secret,
const uint8_t* write_secret,
size_t secret_len,
void* arg) {
QuicSession* session = static_cast<QuicSession*>(arg);

// Output the secret to the keylog
LogSecret(ssl, name, secret, secretlen);

return session->OnKey(name, secret, secretlen) ? 1 : 0;
// Log secrets???
return session->OnSecrets(
level,
read_secret,
write_secret,
secret_len) ? 1 : 0;
}

int HandleTLSError(SSL* ssl, int err = 0) {
Expand Down
30 changes: 22 additions & 8 deletions src/node_quic_crypto.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -157,12 +157,22 @@ bool InstallEarlyKeys(
bool InstallHandshakeKeys(
ngtcp2_conn* conn,
const ngtcp2_crypto_ctx* ctx,
std::unique_ptr<KeyStorage> ks);
SessionKey* rx_key,
SessionIV* rx_iv,
SessionKey* rx_hp,
SessionKey* tx_key,
SessionIV* tx_iv,
SessionKey* tx_hp);

bool InstallSessionKeys(
ngtcp2_conn* conn,
const ngtcp2_crypto_ctx* ctx,
std::unique_ptr<KeyStorage> ks);
SessionKey* rx_key,
SessionIV* rx_iv,
SessionKey* rx_hp,
SessionKey* tx_key,
SessionIV* tx_iv,
SessionKey* tx_hp);

// MessageCB provides a hook into the TLS handshake dataflow. Currently, it
// is used to capture TLS alert codes (errors) and to collect the TLS handshake
Expand All @@ -178,15 +188,19 @@ void MessageCB(

int CertCB(SSL* ssl, void* arg);

// KeyCB provides a hook into the keying process of the TLS handshake,
// triggering registration of the keys associated with the TLS session.
int KeyCB(
// EncryptionSecretsCB provides a hook into the keying process of the
// TLS handshake, triggering registration of the keys associated with
// the TLS session.
int EncryptionSecretsCB(
SSL* ssl,
int name,
const unsigned char* secret,
size_t secretlen,
int level,
const uint8_t* read_secret,
const uint8_t* write_secret,
size_t secret_len,
void* arg);

const char* GetEncryptionLevelName(int level);

bool ClearTLS(SSL* ssl);

int DoTLSHandshake(SSL* ssl);
Expand Down
Loading

0 comments on commit 578b286

Please sign in to comment.