forked from envoyproxy/envoy
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
quic: add private key provider support (envoyproxy#65) (envoyproxy#75)
* quic: add private key provider support (envoyproxy#65) * add integration test Signed-off-by: He Jie Xu <[email protected]>
- Loading branch information
Showing
13 changed files
with
225 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75 changes: 75 additions & 0 deletions
75
source/extensions/quic/crypto_stream/envoy_tls_server_handshaker.cc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| #include "envoy_tls_server_handshaker.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Quic { | ||
|
|
||
| EnvoyTlsServerHandshaker::EnvoyTlsServerHandshaker( | ||
| quic::QuicSession* session, const quic::QuicCryptoServerConfig* crypto_config, | ||
| OptRef<const Network::DownstreamTransportSocketFactory> transport_socket_factory, | ||
| Envoy::Event::Dispatcher& dispatcher) | ||
| : quic::TlsServerHandshaker(session, crypto_config) { | ||
| if (transport_socket_factory != absl::nullopt) { | ||
| transport_socket_factory_.emplace( | ||
| dynamic_cast<const QuicServerTransportSocketFactory&>(transport_socket_factory.ref())); | ||
| for (auto cert_config : transport_socket_factory_->getTlsCertificates()) { | ||
| if (cert_config.get().privateKeyMethod()) { | ||
| cert_config.get().privateKeyMethod()->registerPrivateKeyMethod(GetSsl(), *this, dispatcher); | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| ssl_private_key_result_t EnvoyTlsServerHandshaker::PrivateKeySign(uint8_t* out, size_t* out_len, | ||
| size_t max_out, uint16_t sig_alg, | ||
| absl::string_view in) { | ||
| if (transport_socket_factory_->getTlsCertificates().size() > 0) { | ||
| // TODO(soulxu): Currently the QUIC transport socket only support one certificate. After | ||
| // QUIC transport socket with multiple certificates, we will figure out how to support | ||
| // multiple certificates for private key provider also. | ||
| auto private_key_method = | ||
| transport_socket_factory_->getTlsCertificates()[0].get().privateKeyMethod(); | ||
| if (private_key_method != nullptr) { | ||
| auto ret = private_key_method->getBoringSslPrivateKeyMethod()->sign( | ||
| GetSsl(), out, out_len, max_out, sig_alg, reinterpret_cast<const uint8_t*>(in.data()), | ||
| in.size()); | ||
| if (ret == ssl_private_key_retry) { | ||
| set_expected_ssl_error(SSL_ERROR_WANT_PRIVATE_KEY_OPERATION); | ||
| } | ||
| return ret; | ||
| } | ||
| } | ||
| return quic::TlsServerHandshaker::PrivateKeySign(out, out_len, max_out, sig_alg, in); | ||
| } | ||
|
|
||
| ssl_private_key_result_t EnvoyTlsServerHandshaker::PrivateKeyComplete(uint8_t* out, size_t* out_len, | ||
| size_t max_out) { | ||
| if (transport_socket_factory_->getTlsCertificates().size() > 0) { | ||
| auto private_key_method = | ||
| transport_socket_factory_->getTlsCertificates()[0].get().privateKeyMethod(); | ||
| if (private_key_method != nullptr) { | ||
| auto ret = private_key_method->getBoringSslPrivateKeyMethod()->complete(GetSsl(), out, | ||
| out_len, max_out); | ||
| if (ret == ssl_private_key_success) { | ||
| set_expected_ssl_error(SSL_ERROR_WANT_READ); | ||
| } | ||
| return ret; | ||
| } | ||
| } | ||
| return quic::TlsServerHandshaker::PrivateKeyComplete(out, out_len, max_out); | ||
| } | ||
|
|
||
| void EnvoyTlsServerHandshaker::onPrivateKeyMethodComplete() { AdvanceHandshakeFromCallback(); } | ||
|
|
||
| void EnvoyTlsServerHandshaker::FinishHandshake() { | ||
| quic::TlsServerHandshaker::FinishHandshake(); | ||
| if (transport_socket_factory_ != absl::nullopt) { | ||
| for (auto cert_config : transport_socket_factory_->getTlsCertificates()) { | ||
| if (cert_config.get().privateKeyMethod()) { | ||
| cert_config.get().privateKeyMethod()->unregisterPrivateKeyMethod(GetSsl()); | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| } // namespace Quic | ||
| } // namespace Envoy |
34 changes: 34 additions & 0 deletions
34
source/extensions/quic/crypto_stream/envoy_tls_server_handshaker.h
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| #pragma once | ||
|
|
||
| #include "envoy/ssl/private_key/private_key_callbacks.h" | ||
|
|
||
| #include "source/common/quic/quic_server_transport_socket_factory.h" | ||
|
|
||
| #include "quiche/quic/core/tls_server_handshaker.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Quic { | ||
|
|
||
| class EnvoyTlsServerHandshaker : public quic::TlsServerHandshaker, | ||
| public Envoy::Ssl::PrivateKeyConnectionCallbacks { | ||
| public: | ||
| EnvoyTlsServerHandshaker( | ||
| quic::QuicSession* session, const quic::QuicCryptoServerConfig* crypto_config, | ||
| OptRef<const Network::DownstreamTransportSocketFactory> transport_socket_factory, | ||
| Envoy::Event::Dispatcher& dispatcher); | ||
|
|
||
| ssl_private_key_result_t PrivateKeySign(uint8_t* out, size_t* out_len, size_t max_out, | ||
| uint16_t sig_alg, absl::string_view in) override; | ||
| ssl_private_key_result_t PrivateKeyComplete(uint8_t* out, size_t* out_len, | ||
| size_t max_out) override; | ||
| void onPrivateKeyMethodComplete() override; | ||
|
|
||
| protected: | ||
| void FinishHandshake() override; | ||
|
|
||
| private: | ||
| OptRef<const QuicServerTransportSocketFactory> transport_socket_factory_; | ||
| }; | ||
|
|
||
| } // namespace Quic | ||
| } // namespace Envoy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.