You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by ma...@apache.org on 2018/03/26 07:16:46 UTC
[trafficserver] branch quic-latest updated (9946719 -> d774873)
This is an automated email from the ASF dual-hosted git repository.
masaori pushed a change to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git.
from 9946719 Fix QUICAckFrameCreator::update() calling in unit tests
new bd09c19 Separate SSL_CTX for client and server
new 2389503 Add suported_group configs
new d774873 Fix unit tests
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
iocore/net/P_QUICNetProcessor.h | 2 -
iocore/net/P_QUICNetVConnection.h | 2 +-
iocore/net/P_QUICPacketHandler.h | 3 +-
iocore/net/QUICNetProcessor.cc | 43 +-------
iocore/net/QUICNetVConnection.cc | 9 +-
iocore/net/QUICPacketHandler.cc | 8 +-
iocore/net/quic/QUICConfig.cc | 111 +++++++++++++++++++++
iocore/net/quic/QUICConfig.h | 18 ++++
iocore/net/quic/QUICStream.cc | 1 -
iocore/net/quic/test/Makefile.am | 40 ++++++--
.../net/quic/test/stub_QUICConfig.cc | 23 ++++-
iocore/net/quic/test/test_QUICHandshake.cc | 3 -
mgmt/RecordsConfig.cc | 4 +
13 files changed, 194 insertions(+), 73 deletions(-)
copy proxy/hq/HQ.cc => iocore/net/quic/test/stub_QUICConfig.cc (72%)
--
To stop receiving notification emails like this one, please contact
masaori@apache.org.
[trafficserver] 03/03: Fix unit tests
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
masaori pushed a commit to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit d774873ebc8ed4edc51b822f78c4d7e1b1c87b4a
Author: Masaori Koshiba <ma...@apache.org>
AuthorDate: Mon Mar 26 16:15:41 2018 +0900
Fix unit tests
---
iocore/net/quic/QUICStream.cc | 1 -
iocore/net/quic/test/Makefile.am | 40 ++++++++++++++++++--------
iocore/net/quic/test/stub_QUICConfig.cc | 45 ++++++++++++++++++++++++++++++
iocore/net/quic/test/test_QUICHandshake.cc | 3 --
4 files changed, 74 insertions(+), 15 deletions(-)
diff --git a/iocore/net/quic/QUICStream.cc b/iocore/net/quic/QUICStream.cc
index fb69e58..9e78714 100644
--- a/iocore/net/quic/QUICStream.cc
+++ b/iocore/net/quic/QUICStream.cc
@@ -27,7 +27,6 @@
#include "P_VConnection.h"
#include "QUICStreamManager.h"
#include "QUICDebugNames.h"
-#include "QUICConfig.h"
#define QUICStreamDebug(fmt, ...) \
Debug("quic_stream", "[%" PRIx64 "] [%" PRIx64 "] [%s] " fmt, static_cast<uint64_t>(this->_connection_id), this->_id, \
diff --git a/iocore/net/quic/test/Makefile.am b/iocore/net/quic/test/Makefile.am
index d8e6a09..1c4b445 100644
--- a/iocore/net/quic/test/Makefile.am
+++ b/iocore/net/quic/test/Makefile.am
@@ -169,6 +169,7 @@ test_QUICFrameDispatcher_SOURCES = \
test_QUICFrameDispatcher.cc \
../QUICGlobals.cc \
../QUICConfig.cc \
+ stub_QUICConfig.cc \
../QUICVersionNegotiator.cc \
../QUICFrameDispatcher.cc \
../QUICTransportParameters.cc \
@@ -198,6 +199,7 @@ test_QUICFrameDispatcher_SOURCES = \
test_QUICFrameDispatcher_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/iocore/eventsystem/libinkevent.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
@@ -206,7 +208,6 @@ test_QUICFrameDispatcher_LDADD = \
@LIBTCL@ \
@HWLOC_LIBS@
-
#
# test_QUICStreamState
#
@@ -249,7 +250,8 @@ test_QUICStream_SOURCES = \
../QUICStreamManager.cc \
../QUICApplicationMap.cc \
../QUICCongestionController.cc \
- ../../SSLNextProtocolSet.cc
+ ../../SSLNextProtocolSet.cc \
+ stub_QUICConfig.cc
test_QUICStream_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
@@ -280,7 +282,9 @@ test_QUICStreamManager_SOURCES = \
../QUICStreamManager.cc \
../QUICApplicationMap.cc \
../QUICCongestionController.cc \
- ../../SSLNextProtocolSet.cc
+ ../../SSLNextProtocolSet.cc \
+ ../QUICConfig.cc \
+ stub_QUICConfig.cc
test_QUICStreamManager_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
@@ -307,6 +311,7 @@ test_QUICTransportParameters_SOURCES = \
test_QUICTransportParameters.cc \
../QUICGlobals.cc \
../QUICConfig.cc \
+ stub_QUICConfig.cc \
../QUICApplication.cc \
../QUICApplicationMap.cc \
../QUICHandshake.cc \
@@ -332,6 +337,7 @@ test_QUICTransportParameters_SOURCES = \
test_QUICTransportParameters_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/proxy/shared/libUglyLogStubs.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
@@ -345,8 +351,7 @@ test_QUICKeyGenerator_CPPFLAGS = \
$(AM_CPPFLAGS)
test_QUICKeyGenerator_LDFLAGS = \
- @AM_LDFLAGS@ \
- @OPENSSL_LDFLAGS@
+ @AM_LDFLAGS@
test_QUICKeyGenerator_LDADD = \
@OPENSSL_LIBS@ \
@@ -442,7 +447,9 @@ test_QUICLossDetector_SOURCES = \
../QUICHandshakeProtocol.cc \
../QUICTLS.cc \
$(QUICTLS_impl) \
- ../QUICFrame.cc
+ ../QUICFrame.cc \
+ ../../SSLNextProtocolSet.cc \
+ stub_QUICConfig.cc
#
# test_QUICTypeUtil
@@ -455,10 +462,12 @@ test_QUICTypeUtil_LDFLAGS = \
test_QUICTypeUtil_LDADD = \
$(top_builddir)/iocore/eventsystem/libinkevent.a \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
$(top_builddir)/proxy/shared/libUglyLogStubs.a \
- $(top_builddir)/lib/ts/libtsutil.la
+ $(top_builddir)/lib/ts/libtsutil.la \
+ @OPENSSL_LIBS@
test_QUICTypeUtil_SOURCES = \
main.cc \
@@ -477,7 +486,9 @@ test_QUICTypeUtil_SOURCES = \
../QUICTLS.cc \
$(QUICTLS_impl) \
../QUICIntUtil.cc \
- ../QUICTypes.cc
+ ../QUICTypes.cc \
+ ../../SSLNextProtocolSet.cc \
+ stub_QUICConfig.cc
#
# test_QUICAckFrameCreator
@@ -490,6 +501,7 @@ test_QUICAckFrameCreator_LDFLAGS = \
test_QUICAckFrameCreator_LDADD = \
$(top_builddir)/iocore/eventsystem/libinkevent.a \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
$(top_builddir)/proxy/shared/libUglyLogStubs.a \
@@ -515,7 +527,8 @@ test_QUICAckFrameCreator_SOURCES = \
../QUICHandshakeProtocol.cc \
../QUICTLS.cc \
$(QUICTLS_impl) \
- ../../SSLNextProtocolSet.cc
+ ../../SSLNextProtocolSet.cc \
+ stub_QUICConfig.cc
#
# test_QUICTypeUtil
@@ -529,6 +542,7 @@ test_QUICVersionNegotiator_LDFLAGS = \
test_QUICVersionNegotiator_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
$(top_builddir)/iocore/eventsystem/libinkevent.a \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
$(top_builddir)/lib/ts/libtsutil.la \
@@ -562,6 +576,7 @@ test_QUICVersionNegotiator_SOURCES = \
../QUICVersionNegotiator.cc \
../QUICTransportParameters.cc \
../QUICConfig.cc \
+ stub_QUICConfig.cc \
../../SSLNextProtocolSet.cc
#
@@ -576,6 +591,7 @@ test_QUICFlowController_LDFLAGS = \
test_QUICFlowController_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
$(top_builddir)/iocore/eventsystem/libinkevent.a \
+ $(top_builddir)/iocore/net/quic/libquic.a \
$(top_builddir)/lib/records/librecords_p.a \
$(top_builddir)/mgmt/libmgmt_p.la \
$(top_builddir)/lib/ts/libtsutil.la \
@@ -620,7 +636,8 @@ test_QUICIncomingFrameBuffer_SOURCES = \
../QUICCongestionController.cc \
../../SSLNextProtocolSet.cc \
../QUICIncomingFrameBuffer.cc \
- test_QUICIncomingFrameBuffer.cc
+ test_QUICIncomingFrameBuffer.cc \
+ stub_QUICConfig.cc
test_QUICIncomingFrameBuffer_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
@@ -646,7 +663,8 @@ test_QUICHandshake_SOURCES = \
event_processor_main.cc \
test_QUICHandshake.cc \
../QUICHandshake.cc \
- ../../SSLNextProtocolSet.cc
+ ../../SSLNextProtocolSet.cc \
+ stub_QUICConfig.cc
test_QUICHandshake_LDADD = \
$(top_builddir)/lib/ts/libtsutil.la \
diff --git a/iocore/net/quic/test/stub_QUICConfig.cc b/iocore/net/quic/test/stub_QUICConfig.cc
new file mode 100644
index 0000000..22f7f81
--- /dev/null
+++ b/iocore/net/quic/test/stub_QUICConfig.cc
@@ -0,0 +1,45 @@
+/** @file
+ *
+ * Stubs for QUICConfig
+ *
+ * @section license License
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "ts/ink_assert.h"
+
+#include "P_SSLConfig.h"
+
+bool
+SSLParseCertificateConfiguration(const SSLConfigParams *, SSL_CTX *)
+{
+ ink_assert(false);
+ return false;
+}
+
+SSLConfigParams *
+SSLConfig::acquire()
+{
+ ink_assert(false);
+ return nullptr;
+}
+
+void
+SSLConfig::release(SSLConfigParams *)
+{
+ ink_assert(false);
+}
diff --git a/iocore/net/quic/test/test_QUICHandshake.cc b/iocore/net/quic/test/test_QUICHandshake.cc
index 8e8ad8d..30268d4 100644
--- a/iocore/net/quic/test/test_QUICHandshake.cc
+++ b/iocore/net/quic/test/test_QUICHandshake.cc
@@ -25,14 +25,11 @@
#include "Mock.h"
#include "QUICHandshake.h"
-#include "QUICConfig.h"
#include "./server_cert.h"
TEST_CASE("1-RTT handshake ", "[quic]")
{
- QUICConfig::startup();
-
// setup client
QUICConnection *client_qc = new MockQUICConnection(NET_VCONNECTION_OUT);
--
To stop receiving notification emails like this one, please contact
masaori@apache.org.
[trafficserver] 01/03: Separate SSL_CTX for client and server
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
masaori pushed a commit to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit bd09c194af798c32306923bb637e4a0def946002
Author: Masaori Koshiba <ma...@apache.org>
AuthorDate: Mon Mar 26 12:46:03 2018 +0900
Separate SSL_CTX for client and server
As for client, add SSL_CTX* to QUICConfig, just like SSLConfig has SSL_CTX *client_ctx.
As for server, add SSL_CTX* to QUICConfig too for now. Probably this should be integrated with
SSLCertLookup or SNIConfigParams.
---
iocore/net/P_QUICNetProcessor.h | 2 -
iocore/net/P_QUICNetVConnection.h | 2 +-
iocore/net/P_QUICPacketHandler.h | 3 +-
iocore/net/QUICNetProcessor.cc | 45 +--------------------
iocore/net/QUICNetVConnection.cc | 9 +++--
iocore/net/QUICPacketHandler.cc | 8 ++--
iocore/net/quic/QUICConfig.cc | 83 +++++++++++++++++++++++++++++++++++++++
iocore/net/quic/QUICConfig.h | 13 ++++++
8 files changed, 110 insertions(+), 55 deletions(-)
diff --git a/iocore/net/P_QUICNetProcessor.h b/iocore/net/P_QUICNetProcessor.h
index c9d6c2a..59fb931 100644
--- a/iocore/net/P_QUICNetProcessor.h
+++ b/iocore/net/P_QUICNetProcessor.h
@@ -73,8 +73,6 @@ public:
private:
QUICNetProcessor(const QUICNetProcessor &);
QUICNetProcessor &operator=(const QUICNetProcessor &);
-
- SSL_CTX *_ssl_ctx = nullptr;
};
extern QUICNetProcessor quic_NetProcessor;
diff --git a/iocore/net/P_QUICNetVConnection.h b/iocore/net/P_QUICNetVConnection.h
index 83bef51..ba4a657 100644
--- a/iocore/net/P_QUICNetVConnection.h
+++ b/iocore/net/P_QUICNetVConnection.h
@@ -165,7 +165,7 @@ public:
int state_connection_closing(int event, Event *data);
int state_connection_draining(int event, Event *data);
int state_connection_closed(int event, Event *data);
- void start(SSL_CTX *);
+ void start();
void free(EThread *t) override;
void destroy(EThread *t);
diff --git a/iocore/net/P_QUICPacketHandler.h b/iocore/net/P_QUICPacketHandler.h
index 886ce70..8ffd36a 100644
--- a/iocore/net/P_QUICPacketHandler.h
+++ b/iocore/net/P_QUICPacketHandler.h
@@ -59,7 +59,7 @@ protected:
class QUICPacketHandlerIn : public NetAccept, public QUICPacketHandler
{
public:
- QUICPacketHandlerIn(const NetProcessor::AcceptOptions &opt, SSL_CTX *);
+ QUICPacketHandlerIn(const NetProcessor::AcceptOptions &opt);
~QUICPacketHandlerIn();
// NetAccept
@@ -75,7 +75,6 @@ private:
void _recv_packet(int event, UDPPacket *udp_packet) override;
QUICConnectionTable *_ctable = nullptr;
- SSL_CTX *_ssl_ctx;
};
/*
diff --git a/iocore/net/QUICNetProcessor.cc b/iocore/net/QUICNetProcessor.cc
index 55c7b10..94d6fb6 100644
--- a/iocore/net/QUICNetProcessor.cc
+++ b/iocore/net/QUICNetProcessor.cc
@@ -27,8 +27,6 @@
#include "QUICGlobals.h"
#include "QUICConfig.h"
-#include "QUICTransportParameters.h"
-#include "QUICStatelessRetry.h"
//
// Global Data
@@ -48,7 +46,6 @@ QUICNetProcessor::~QUICNetProcessor()
void
QUICNetProcessor::cleanup()
{
- SSL_CTX_free(this->_ssl_ctx);
}
void
@@ -68,55 +65,17 @@ QUICNetProcessor::start(int, size_t stacksize)
// This initialization order matters ...
// QUICInitializeLibrary();
QUICConfig::startup();
- QUICStatelessRetry::init();
-
-#ifdef TLS1_3_VERSION_DRAFT_TXT
- // FIXME: remove this when TLS1_3_VERSION_DRAFT_TXT is removed
- Debug("quic_ps", "%s", TLS1_3_VERSION_DRAFT_TXT);
-#endif
-
- // Acquire a QUICConfigParams instance *after* we start QUIC up.
- // QUICConfig::scoped_config params;
// Initialize QUIC statistics. This depends on an initial set of certificates being loaded above.
// QUICInitializeStatistics();
- // TODO: separate SSL_CTX for client and server
- // TODO: load certs from SSLConfig
- this->_ssl_ctx = SSL_CTX_new(TLS_method());
- SSL_CTX_set_min_proto_version(this->_ssl_ctx, TLS1_3_VERSION);
- SSL_CTX_set_max_proto_version(this->_ssl_ctx, TLS1_3_VERSION);
-
- // FIXME: OpenSSL (1.1.1-alpha) enable this option by default. But this shoule be removed when OpenSSL disable this by default.
- SSL_CTX_clear_options(this->_ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
-
- SSL_CTX_set_alpn_select_cb(this->_ssl_ctx, QUIC::ssl_select_next_protocol, nullptr);
- SSL_CTX_set_max_early_data(this->_ssl_ctx, UINT32_C(0xFFFFFFFF));
- SSL_CTX_add_custom_ext(this->_ssl_ctx, QUICTransportParametersHandler::TRANSPORT_PARAMETER_ID,
- SSL_EXT_TLS_ONLY | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
- &QUICTransportParametersHandler::add, &QUICTransportParametersHandler::free, nullptr,
- &QUICTransportParametersHandler::parse, nullptr);
-
- // callbacks for cookie ext
- // Requires OpenSSL-1.1.1-pre3+ : https://github.com/openssl/openssl/pull/5463
- SSL_CTX_set_stateless_cookie_generate_cb(this->_ssl_ctx, QUICStatelessRetry::generate_cookie);
- SSL_CTX_set_stateless_cookie_verify_cb(this->_ssl_ctx, QUICStatelessRetry::verify_cookie);
-
- SSLConfig::scoped_config params;
- SSLParseCertificateConfiguration(params, this->_ssl_ctx);
-
- if (SSL_CTX_check_private_key(this->_ssl_ctx) != 1) {
- Error("check private key failed");
- // ink_assert(false);
- }
-
return 0;
}
NetAccept *
QUICNetProcessor::createNetAccept(const NetProcessor::AcceptOptions &opt)
{
- return (NetAccept *)new QUICPacketHandlerIn(opt, this->_ssl_ctx);
+ return (NetAccept *)new QUICPacketHandlerIn(opt);
}
NetVConnection *
@@ -195,7 +154,7 @@ QUICNetProcessor::connect_re(Continuation *cont, sockaddr const *remote_addr, Ne
SET_CONTINUATION_HANDLER(vc, &QUICNetVConnection::startEvent);
- vc->start(this->_ssl_ctx);
+ vc->start();
if (t->is_event_type(opt->etype)) {
MUTEX_TRY_LOCK(lock, cont->mutex, t);
diff --git a/iocore/net/QUICNetVConnection.cc b/iocore/net/QUICNetVConnection.cc
index 8e22c80..cc8e72b 100644
--- a/iocore/net/QUICNetVConnection.cc
+++ b/iocore/net/QUICNetVConnection.cc
@@ -174,16 +174,17 @@ QUICNetVConnection::startEvent(int event, Event *e)
// XXX This might be called on ET_UDP thread
void
-QUICNetVConnection::start(SSL_CTX *ssl_ctx)
+QUICNetVConnection::start()
{
+ QUICConfig::scoped_config params;
+
this->_five_tuple.update(this->local_addr, this->remote_addr, SOCK_DGRAM);
// Version 0x00000001 uses stream 0 for cryptographic handshake with TLS 1.3, but newer version may not
if (this->direction() == NET_VCONNECTION_IN) {
- QUICConfig::scoped_config params;
this->_reset_token.generate(this->_quic_connection_id, params->server_id());
- this->_handshake_handler = new QUICHandshake(this, ssl_ctx, this->_reset_token, params->stateless_retry());
+ this->_handshake_handler = new QUICHandshake(this, params->server_ssl_ctx(), this->_reset_token, params->stateless_retry());
} else {
- this->_handshake_handler = new QUICHandshake(this, ssl_ctx);
+ this->_handshake_handler = new QUICHandshake(this, params->client_ssl_ctx());
this->_handshake_handler->start(&this->_packet_factory);
}
this->_application_map = new QUICApplicationMap();
diff --git a/iocore/net/QUICPacketHandler.cc b/iocore/net/QUICPacketHandler.cc
index 2561005..5bbb4a5 100644
--- a/iocore/net/QUICPacketHandler.cc
+++ b/iocore/net/QUICPacketHandler.cc
@@ -23,6 +23,8 @@
#include "P_Net.h"
#include "P_QUICClosedConCollector.h"
+
+#include "QUICGlobals.h"
#include "QUICConfig.h"
#include "QUICPacket.h"
#include "QUICDebugNames.h"
@@ -88,7 +90,7 @@ QUICPacketHandler::_read_connection_id(IOBufferBlock *block)
//
// QUICPacketHandlerIn
//
-QUICPacketHandlerIn::QUICPacketHandlerIn(const NetProcessor::AcceptOptions &opt, SSL_CTX *ctx) : NetAccept(opt), _ssl_ctx(ctx)
+QUICPacketHandlerIn::QUICPacketHandlerIn(const NetProcessor::AcceptOptions &opt) : NetAccept(opt)
{
this->mutex = new_ProxyMutex();
// create Connection Table
@@ -112,7 +114,7 @@ NetAccept *
QUICPacketHandlerIn::clone() const
{
NetAccept *na;
- na = new QUICPacketHandlerIn(opt, this->_ssl_ctx);
+ na = new QUICPacketHandlerIn(opt);
*na = *this;
return na;
}
@@ -218,7 +220,7 @@ QUICPacketHandlerIn::_recv_packet(int event, UDPPacket *udp_packet)
vc->action_ = *this->action_;
vc->set_is_transparent(this->opt.f_inbound_transparent);
vc->set_context(NET_VCONNECTION_IN);
- vc->start(this->_ssl_ctx);
+ vc->start();
vc->options.ip_proto = NetVCOptions::USE_UDP;
vc->options.ip_family = udp_packet->from.sa.sa_family;
diff --git a/iocore/net/quic/QUICConfig.cc b/iocore/net/quic/QUICConfig.cc
index 0b8c00c..f440d59 100644
--- a/iocore/net/quic/QUICConfig.cc
+++ b/iocore/net/quic/QUICConfig.cc
@@ -23,14 +23,80 @@
#include "QUICConfig.h"
+#include <openssl/ssl.h>
#include <records/I_RecHttp.h>
+#include "P_SSLConfig.h"
+
+#include "QUICGlobals.h"
+#include "QUICTransportParameters.h"
+#include "QUICStatelessRetry.h"
+
int QUICConfig::_config_id = 0;
int QUICConfigParams::_connection_table_size = 65521;
+static SSL_CTX *
+quic_new_ssl_ctx()
+{
+#ifdef TLS1_3_VERSION_DRAFT_TXT
+ // FIXME: remove this when TLS1_3_VERSION_DRAFT_TXT is removed
+ Debug("quic_ps", "%s", TLS1_3_VERSION_DRAFT_TXT);
+#endif
+
+ SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method());
+
+ SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION);
+ SSL_CTX_set_max_proto_version(ssl_ctx, TLS1_3_VERSION);
+
+ // FIXME: OpenSSL (1.1.1-alpha) enable this option by default. But this shoule be removed when OpenSSL disable this by default.
+ SSL_CTX_clear_options(ssl_ctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
+
+ SSL_CTX_set_max_early_data(ssl_ctx, UINT32_C(0xFFFFFFFF));
+
+ SSL_CTX_add_custom_ext(ssl_ctx, QUICTransportParametersHandler::TRANSPORT_PARAMETER_ID,
+ SSL_EXT_TLS_ONLY | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
+ &QUICTransportParametersHandler::add, &QUICTransportParametersHandler::free, nullptr,
+ &QUICTransportParametersHandler::parse, nullptr);
+ return ssl_ctx;
+}
+
+static SSL_CTX *
+quic_init_server_ssl_ctx(SSL_CTX *ssl_ctx)
+{
+ SSLConfig::scoped_config ssl_params;
+ SSLParseCertificateConfiguration(ssl_params, ssl_ctx);
+
+ if (SSL_CTX_check_private_key(ssl_ctx) != 1) {
+ Error("check private key failed");
+ }
+
+ // callbacks for cookie ext
+ // Requires OpenSSL-1.1.1-pre3+ : https://github.com/openssl/openssl/pull/5463
+ SSL_CTX_set_stateless_cookie_generate_cb(ssl_ctx, QUICStatelessRetry::generate_cookie);
+ SSL_CTX_set_stateless_cookie_verify_cb(ssl_ctx, QUICStatelessRetry::verify_cookie);
+
+ SSL_CTX_set_alpn_select_cb(ssl_ctx, QUIC::ssl_select_next_protocol, nullptr);
+
+ return ssl_ctx;
+}
+
+static SSL_CTX *
+quic_init_client_ssl_ctx(SSL_CTX *ssl_ctx)
+{
+ // SSL_CTX_set_alpn_protos()
+
+ return ssl_ctx;
+}
+
//
// QUICConfigParams
//
+QUICConfigParams::~QUICConfigParams()
+{
+ SSL_CTX_free(this->_server_ssl_ctx);
+ SSL_CTX_free(this->_client_ssl_ctx);
+};
+
void
QUICConfigParams::initialize()
{
@@ -41,6 +107,11 @@ QUICConfigParams::initialize()
REC_EstablishStaticConfigInt32U(this->_server_id, "proxy.config.quic.server_id");
REC_EstablishStaticConfigInt32(this->_connection_table_size, "proxy.config.quic.connection_table.size");
REC_EstablishStaticConfigInt32U(this->_stateless_retry, "proxy.config.quic.stateless_retry");
+
+ QUICStatelessRetry::init();
+
+ this->_server_ssl_ctx = quic_init_server_ssl_ctx(quic_new_ssl_ctx());
+ this->_client_ssl_ctx = quic_init_client_ssl_ctx(quic_new_ssl_ctx());
}
uint32_t
@@ -109,6 +180,18 @@ QUICConfigParams::initial_max_stream_id_uni_out() const
return this->_initial_max_stream_id_uni_out;
}
+SSL_CTX *
+QUICConfigParams::server_ssl_ctx() const
+{
+ return this->_server_ssl_ctx;
+}
+
+SSL_CTX *
+QUICConfigParams::client_ssl_ctx() const
+{
+ return this->_client_ssl_ctx;
+}
+
//
// QUICConfig
//
diff --git a/iocore/net/quic/QUICConfig.h b/iocore/net/quic/QUICConfig.h
index 4ae7721..43bac32 100644
--- a/iocore/net/quic/QUICConfig.h
+++ b/iocore/net/quic/QUICConfig.h
@@ -23,10 +23,16 @@
#pragma once
+#include <openssl/ssl.h>
+
#include "ProxyConfig.h"
+
class QUICConfigParams : public ConfigInfo
{
public:
+ QUICConfigParams(){};
+ ~QUICConfigParams();
+
void initialize();
uint32_t no_activity_timeout_in() const;
@@ -41,6 +47,9 @@ public:
static int connection_table_size();
uint32_t stateless_retry() const;
+ SSL_CTX *server_ssl_ctx() const;
+ SSL_CTX *client_ssl_ctx() const;
+
private:
// FIXME Fill appropriate default values in RecordsConfig.cc
uint32_t _no_activity_timeout_in = 0;
@@ -55,6 +64,10 @@ private:
uint32_t _initial_max_stream_id_bidi_out = 101;
uint32_t _initial_max_stream_id_uni_in = 102;
uint32_t _initial_max_stream_id_uni_out = 103;
+
+ // TODO: integrate with SSLCertLookup or SNIConfigParams
+ SSL_CTX *_server_ssl_ctx = nullptr;
+ SSL_CTX *_client_ssl_ctx = nullptr;
};
class QUICConfig
--
To stop receiving notification emails like this one, please contact
masaori@apache.org.
[trafficserver] 02/03: Add suported_group configs
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
masaori pushed a commit to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 2389503983f52fc0914d473489e768596eb51321
Author: Masaori Koshiba <ma...@apache.org>
AuthorDate: Mon Mar 26 14:45:11 2018 +0900
Add suported_group configs
---
iocore/net/QUICNetProcessor.cc | 6 ++++--
iocore/net/quic/QUICConfig.cc | 46 +++++++++++++++++++++++++++++++++---------
iocore/net/quic/QUICConfig.h | 5 +++++
mgmt/RecordsConfig.cc | 4 ++++
4 files changed, 50 insertions(+), 11 deletions(-)
diff --git a/iocore/net/QUICNetProcessor.cc b/iocore/net/QUICNetProcessor.cc
index 94d6fb6..e580a62 100644
--- a/iocore/net/QUICNetProcessor.cc
+++ b/iocore/net/QUICNetProcessor.cc
@@ -66,8 +66,10 @@ QUICNetProcessor::start(int, size_t stacksize)
// QUICInitializeLibrary();
QUICConfig::startup();
- // Initialize QUIC statistics. This depends on an initial set of certificates being loaded above.
- // QUICInitializeStatistics();
+#ifdef TLS1_3_VERSION_DRAFT_TXT
+ // FIXME: remove this when TLS1_3_VERSION_DRAFT_TXT is removed
+ Debug("quic_ps", "%s", TLS1_3_VERSION_DRAFT_TXT);
+#endif
return 0;
}
diff --git a/iocore/net/quic/QUICConfig.cc b/iocore/net/quic/QUICConfig.cc
index f440d59..84d8e9e 100644
--- a/iocore/net/quic/QUICConfig.cc
+++ b/iocore/net/quic/QUICConfig.cc
@@ -38,11 +38,6 @@ int QUICConfigParams::_connection_table_size = 65521;
static SSL_CTX *
quic_new_ssl_ctx()
{
-#ifdef TLS1_3_VERSION_DRAFT_TXT
- // FIXME: remove this when TLS1_3_VERSION_DRAFT_TXT is removed
- Debug("quic_ps", "%s", TLS1_3_VERSION_DRAFT_TXT);
-#endif
-
SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION);
@@ -61,8 +56,10 @@ quic_new_ssl_ctx()
}
static SSL_CTX *
-quic_init_server_ssl_ctx(SSL_CTX *ssl_ctx)
+quic_init_server_ssl_ctx(const QUICConfigParams *params)
{
+ SSL_CTX *ssl_ctx = quic_new_ssl_ctx();
+
SSLConfig::scoped_config ssl_params;
SSLParseCertificateConfiguration(ssl_params, ssl_ctx);
@@ -77,14 +74,28 @@ quic_init_server_ssl_ctx(SSL_CTX *ssl_ctx)
SSL_CTX_set_alpn_select_cb(ssl_ctx, QUIC::ssl_select_next_protocol, nullptr);
+ if (params->server_supported_groups() != nullptr) {
+ if (SSL_CTX_set1_groups_list(ssl_ctx, params->server_supported_groups()) != 1) {
+ Error("SSL_CTX_set1_groups_list failed");
+ }
+ }
+
return ssl_ctx;
}
static SSL_CTX *
-quic_init_client_ssl_ctx(SSL_CTX *ssl_ctx)
+quic_init_client_ssl_ctx(const QUICConfigParams *params)
{
+ SSL_CTX *ssl_ctx = quic_new_ssl_ctx();
+
// SSL_CTX_set_alpn_protos()
+ if (params->client_supported_groups() != nullptr) {
+ if (SSL_CTX_set1_groups_list(ssl_ctx, params->client_supported_groups()) != 1) {
+ Error("SSL_CTX_set1_groups_list failed");
+ }
+ }
+
return ssl_ctx;
}
@@ -93,6 +104,9 @@ quic_init_client_ssl_ctx(SSL_CTX *ssl_ctx)
//
QUICConfigParams::~QUICConfigParams()
{
+ this->_server_supported_groups = (char *)ats_free_null(this->_server_supported_groups);
+ this->_client_supported_groups = (char *)ats_free_null(this->_client_supported_groups);
+
SSL_CTX_free(this->_server_ssl_ctx);
SSL_CTX_free(this->_client_ssl_ctx);
};
@@ -107,11 +121,13 @@ QUICConfigParams::initialize()
REC_EstablishStaticConfigInt32U(this->_server_id, "proxy.config.quic.server_id");
REC_EstablishStaticConfigInt32(this->_connection_table_size, "proxy.config.quic.connection_table.size");
REC_EstablishStaticConfigInt32U(this->_stateless_retry, "proxy.config.quic.stateless_retry");
+ REC_ReadConfigStringAlloc(this->_server_supported_groups, "proxy.config.quic.server.supported_groups");
+ REC_ReadConfigStringAlloc(this->_client_supported_groups, "proxy.config.quic.client.supported_groups");
QUICStatelessRetry::init();
- this->_server_ssl_ctx = quic_init_server_ssl_ctx(quic_new_ssl_ctx());
- this->_client_ssl_ctx = quic_init_client_ssl_ctx(quic_new_ssl_ctx());
+ this->_server_ssl_ctx = quic_init_server_ssl_ctx(this);
+ this->_client_ssl_ctx = quic_init_client_ssl_ctx(this);
}
uint32_t
@@ -180,6 +196,18 @@ QUICConfigParams::initial_max_stream_id_uni_out() const
return this->_initial_max_stream_id_uni_out;
}
+const char *
+QUICConfigParams::server_supported_groups() const
+{
+ return this->_server_supported_groups;
+}
+
+const char *
+QUICConfigParams::client_supported_groups() const
+{
+ return this->_client_supported_groups;
+}
+
SSL_CTX *
QUICConfigParams::server_ssl_ctx() const
{
diff --git a/iocore/net/quic/QUICConfig.h b/iocore/net/quic/QUICConfig.h
index 43bac32..1fc1797 100644
--- a/iocore/net/quic/QUICConfig.h
+++ b/iocore/net/quic/QUICConfig.h
@@ -46,6 +46,8 @@ public:
uint32_t server_id() const;
static int connection_table_size();
uint32_t stateless_retry() const;
+ const char *server_supported_groups() const;
+ const char *client_supported_groups() const;
SSL_CTX *server_ssl_ctx() const;
SSL_CTX *client_ssl_ctx() const;
@@ -65,6 +67,9 @@ private:
uint32_t _initial_max_stream_id_uni_in = 102;
uint32_t _initial_max_stream_id_uni_out = 103;
+ char *_server_supported_groups;
+ char *_client_supported_groups;
+
// TODO: integrate with SSLCertLookup or SNIConfigParams
SSL_CTX *_server_ssl_ctx = nullptr;
SSL_CTX *_client_ssl_ctx = nullptr;
diff --git a/mgmt/RecordsConfig.cc b/mgmt/RecordsConfig.cc
index 89df43c..5032858 100644
--- a/mgmt/RecordsConfig.cc
+++ b/mgmt/RecordsConfig.cc
@@ -1330,6 +1330,10 @@ static const RecordElement RecordsConfig[] =
,
{RECT_CONFIG, "proxy.config.quic.stateless_retry", RECD_INT, "0", RECU_RESTART_TS, RR_NULL, RECC_INT, "[0-1]", RECA_NULL}
,
+ {RECT_CONFIG, "proxy.config.quic.server.supported_groups", RECD_STRING, "P-256:X25519:P-384:P-521" , RECU_RESTART_TS, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
+ ,
+ {RECT_CONFIG, "proxy.config.quic.client.supported_groups", RECD_STRING, "P-256:X25519:P-384:P-521" , RECU_RESTART_TS, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
+ ,
//# Add LOCAL Records Here
{RECT_LOCAL, "proxy.local.incoming_ip_to_bind", RECD_STRING, nullptr, RECU_NULL, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
--
To stop receiving notification emails like this one, please contact
masaori@apache.org.