blob: d1450f7bedb9e8f242d303205e561eac8dd178ac [file] [log] [blame]
// Copyright (c) 2021 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_
#define QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_
#include <memory>
#include "absl/container/flat_hash_map.h"
#include "quiche/quic/core/crypto/certificate_view.h"
#include "quiche/quic/core/crypto/proof_source.h"
namespace quic {
// ClientProofSource is the interface for a QUIC client to provide client certs
// and keys based on server hostname. It is only used by TLS handshakes.
class QUIC_EXPORT_PRIVATE ClientProofSource {
public:
using Chain = ProofSource::Chain;
virtual ~ClientProofSource() {}
struct QUIC_EXPORT_PRIVATE CertAndKey {
CertAndKey(quiche::QuicheReferenceCountedPointer<Chain> chain,
CertificatePrivateKey private_key)
: chain(std::move(chain)), private_key(std::move(private_key)) {}
quiche::QuicheReferenceCountedPointer<Chain> chain;
CertificatePrivateKey private_key;
};
// Get the client certificate to be sent to the server with |server_hostname|
// and its corresponding private key. It returns nullptr if the cert and key
// can not be found.
//
// |server_hostname| is typically a full domain name(www.foo.com), but it
// could also be a wildcard domain(*.foo.com), or a "*" which will return the
// default cert.
virtual const CertAndKey* GetCertAndKey(
absl::string_view server_hostname) const = 0;
};
// DefaultClientProofSource is an implementation that simply keeps an in memory
// map of server hostnames to certs.
class QUIC_EXPORT_PRIVATE DefaultClientProofSource : public ClientProofSource {
public:
~DefaultClientProofSource() override {}
// Associate all hostnames in |server_hostnames| with {|chain|,|private_key|}.
// Elements of |server_hostnames| can be full domain names(www.foo.com),
// wildcard domains(*.foo.com), or "*" which means the given cert chain is the
// default one.
// If any element of |server_hostnames| is already associated with a cert
// chain, it will be updated to be associated with the new cert chain.
bool AddCertAndKey(std::vector<std::string> server_hostnames,
quiche::QuicheReferenceCountedPointer<Chain> chain,
CertificatePrivateKey private_key);
// ClientProofSource implementation
const CertAndKey* GetCertAndKey(absl::string_view hostname) const override;
private:
const CertAndKey* LookupExact(absl::string_view map_key) const;
absl::flat_hash_map<std::string, std::shared_ptr<CertAndKey>> cert_and_keys_;
};
} // namespace quic
#endif // QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_