blob: 007bdbb1a175484d0dcd9f590a18723a561cdf45 [file] [log] [blame]
// Copyright (c) 2019 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "quic/core/crypto/tls_server_connection.h"
#include "absl/strings/string_view.h"
#include "third_party/boringssl/src/include/openssl/ssl.h"
#include "quic/core/crypto/proof_source.h"
#include "quic/core/quic_types.h"
#include "quic/platform/api/quic_flag_utils.h"
#include "quic/platform/api/quic_flags.h"
namespace quic {
TlsServerConnection::TlsServerConnection(SSL_CTX* ssl_ctx, Delegate* delegate,
QuicSSLConfig ssl_config)
: TlsConnection(ssl_ctx, delegate->ConnectionDelegate(),
std::move(ssl_config)),
delegate_(delegate) {
// By default, cert verify callback is not installed on ssl(), so only need to
// UpdateCertVerifyCallback() if client_cert_mode is not kNone.
if (TlsConnection::ssl_config().client_cert_mode != ClientCertMode::kNone) {
UpdateCertVerifyCallback();
}
}
// static
bssl::UniquePtr<SSL_CTX> TlsServerConnection::CreateSslCtx(
ProofSource* proof_source) {
bssl::UniquePtr<SSL_CTX> ssl_ctx = TlsConnection::CreateSslCtx();
// Server does not request/verify client certs by default. Individual server
// connections may call SSL_set_custom_verify on their SSL object to request
// client certs.
SSL_CTX_set_tlsext_servername_callback(ssl_ctx.get(),
&TlsExtServernameCallback);
SSL_CTX_set_alpn_select_cb(ssl_ctx.get(), &SelectAlpnCallback, nullptr);
// We don't actually need the TicketCrypter here, but we need to know
// whether it's set.
if (proof_source->GetTicketCrypter()) {
QUIC_CODE_COUNT(quic_session_tickets_enabled);
SSL_CTX_set_ticket_aead_method(ssl_ctx.get(),
&TlsServerConnection::kSessionTicketMethod);
} else {
QUIC_CODE_COUNT(quic_session_tickets_disabled);
}
SSL_CTX_set_early_data_enabled(ssl_ctx.get(), 1);
SSL_CTX_set_select_certificate_cb(
ssl_ctx.get(), &TlsServerConnection::EarlySelectCertCallback);
SSL_CTX_set_options(ssl_ctx.get(), SSL_OP_CIPHER_SERVER_PREFERENCE);
return ssl_ctx;
}
void TlsServerConnection::SetCertChain(
const std::vector<CRYPTO_BUFFER*>& cert_chain) {
SSL_set_chain_and_key(ssl(), cert_chain.data(), cert_chain.size(), nullptr,
&TlsServerConnection::kPrivateKeyMethod);
}
void TlsServerConnection::SetClientCertMode(ClientCertMode client_cert_mode) {
if (ssl_config().client_cert_mode == client_cert_mode) {
return;
}
mutable_ssl_config().client_cert_mode = client_cert_mode;
UpdateCertVerifyCallback();
}
void TlsServerConnection::UpdateCertVerifyCallback() {
const ClientCertMode client_cert_mode = ssl_config().client_cert_mode;
if (client_cert_mode == ClientCertMode::kNone) {
SSL_set_custom_verify(ssl(), SSL_VERIFY_NONE, nullptr);
return;
}
int mode = SSL_VERIFY_PEER;
if (client_cert_mode == ClientCertMode::kRequire) {
mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
} else {
QUICHE_DCHECK_EQ(client_cert_mode, ClientCertMode::kRequest);
}
SSL_set_custom_verify(ssl(), mode, &VerifyCallback);
}
const SSL_PRIVATE_KEY_METHOD TlsServerConnection::kPrivateKeyMethod{
&TlsServerConnection::PrivateKeySign,
nullptr, // decrypt
&TlsServerConnection::PrivateKeyComplete,
};
// static
TlsServerConnection* TlsServerConnection::ConnectionFromSsl(SSL* ssl) {
return static_cast<TlsServerConnection*>(
TlsConnection::ConnectionFromSsl(ssl));
}
// static
ssl_select_cert_result_t TlsServerConnection::EarlySelectCertCallback(
const SSL_CLIENT_HELLO* client_hello) {
return ConnectionFromSsl(client_hello->ssl)
->delegate_->EarlySelectCertCallback(client_hello);
}
// static
int TlsServerConnection::TlsExtServernameCallback(SSL* ssl,
int* out_alert,
void* /*arg*/) {
return ConnectionFromSsl(ssl)->delegate_->TlsExtServernameCallback(out_alert);
}
// static
int TlsServerConnection::SelectAlpnCallback(SSL* ssl,
const uint8_t** out,
uint8_t* out_len,
const uint8_t* in,
unsigned in_len,
void* /*arg*/) {
return ConnectionFromSsl(ssl)->delegate_->SelectAlpn(out, out_len, in,
in_len);
}
// static
ssl_private_key_result_t TlsServerConnection::PrivateKeySign(SSL* ssl,
uint8_t* out,
size_t* out_len,
size_t max_out,
uint16_t sig_alg,
const uint8_t* in,
size_t in_len) {
return ConnectionFromSsl(ssl)->delegate_->PrivateKeySign(
out, out_len, max_out, sig_alg,
absl::string_view(reinterpret_cast<const char*>(in), in_len));
}
// static
ssl_private_key_result_t TlsServerConnection::PrivateKeyComplete(
SSL* ssl,
uint8_t* out,
size_t* out_len,
size_t max_out) {
return ConnectionFromSsl(ssl)->delegate_->PrivateKeyComplete(out, out_len,
max_out);
}
// static
const SSL_TICKET_AEAD_METHOD TlsServerConnection::kSessionTicketMethod{
TlsServerConnection::SessionTicketMaxOverhead,
TlsServerConnection::SessionTicketSeal,
TlsServerConnection::SessionTicketOpen,
};
// static
size_t TlsServerConnection::SessionTicketMaxOverhead(SSL* ssl) {
return ConnectionFromSsl(ssl)->delegate_->SessionTicketMaxOverhead();
}
// static
int TlsServerConnection::SessionTicketSeal(SSL* ssl,
uint8_t* out,
size_t* out_len,
size_t max_out_len,
const uint8_t* in,
size_t in_len) {
return ConnectionFromSsl(ssl)->delegate_->SessionTicketSeal(
out, out_len, max_out_len,
absl::string_view(reinterpret_cast<const char*>(in), in_len));
}
// static
enum ssl_ticket_aead_result_t TlsServerConnection::SessionTicketOpen(
SSL* ssl,
uint8_t* out,
size_t* out_len,
size_t max_out_len,
const uint8_t* in,
size_t in_len) {
return ConnectionFromSsl(ssl)->delegate_->SessionTicketOpen(
out, out_len, max_out_len,
absl::string_view(reinterpret_cast<const char*>(in), in_len));
}
} // namespace quic