Home | History | Annotate | Download | only in crypto 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_QUIC_CRYPTO_CRYPTO_PROTOCOL_H_
      6 #define NET_QUIC_CRYPTO_CRYPTO_PROTOCOL_H_
      7 
      8 #include <string>
      9 
     10 #include "net/base/net_export.h"
     11 #include "net/quic/quic_protocol.h"
     12 
     13 // Version and Crypto tags are written to the wire with a big-endian
     14 // representation of the name of the tag.  For example
     15 // the client hello tag (CHLO) will be written as the
     16 // following 4 bytes: 'C' 'H' 'L' 'O'.  Since it is
     17 // stored in memory as a little endian uint32, we need
     18 // to reverse the order of the bytes.
     19 //
     20 // We use a macro to ensure that no static initialisers are created. Use the
     21 // MakeQuicTag function in normal code.
     22 #define TAG(a, b, c, d) ((d << 24) + (c << 16) + (b << 8) + a)
     23 
     24 namespace net {
     25 
     26 typedef std::string ServerConfigID;
     27 
     28 const QuicTag kCHLO = TAG('C', 'H', 'L', 'O');   // Client hello
     29 const QuicTag kSHLO = TAG('S', 'H', 'L', 'O');   // Server hello
     30 const QuicTag kSCFG = TAG('S', 'C', 'F', 'G');   // Server config
     31 const QuicTag kREJ  = TAG('R', 'E', 'J', '\0');  // Reject
     32 const QuicTag kCETV = TAG('C', 'E', 'T', 'V');   // Client encrypted tag-value
     33                                                  // pairs
     34 const QuicTag kPRST = TAG('P', 'R', 'S', 'T');   // Public reset
     35 
     36 // Key exchange methods
     37 const QuicTag kP256 = TAG('P', '2', '5', '6');   // ECDH, Curve P-256
     38 const QuicTag kC255 = TAG('C', '2', '5', '5');   // ECDH, Curve25519
     39 
     40 // AEAD algorithms
     41 const QuicTag kNULL = TAG('N', 'U', 'L', 'N');   // null algorithm
     42 const QuicTag kAESG = TAG('A', 'E', 'S', 'G');   // AES128 + GCM-12
     43 const QuicTag kCC12 = TAG('C', 'C', '1', '2');   // ChaCha20 + Poly1305
     44 
     45 // Congestion control feedback types
     46 const QuicTag kQBIC = TAG('Q', 'B', 'I', 'C');   // TCP cubic
     47 const QuicTag kPACE = TAG('P', 'A', 'C', 'E');   // Paced TCP cubic
     48 const QuicTag kINAR = TAG('I', 'N', 'A', 'R');   // Inter arrival
     49 
     50 // Congestion control options
     51 const QuicTag kTBBR = TAG('T', 'B', 'B', 'R');   // Reduced Buffer Bloat TCP
     52 
     53 // Loss detection algorithm types
     54 const QuicTag kNACK = TAG('N', 'A', 'C', 'K');   // TCP style nack counting
     55 const QuicTag kTIME = TAG('T', 'I', 'M', 'E');   // Time based
     56 
     57 // Proof types (i.e. certificate types)
     58 // NOTE: although it would be silly to do so, specifying both kX509 and kX59R
     59 // is allowed and is equivalent to specifying only kX509.
     60 const QuicTag kX509 = TAG('X', '5', '0', '9');   // X.509 certificate, all key
     61                                                  // types
     62 const QuicTag kX59R = TAG('X', '5', '9', 'R');   // X.509 certificate, RSA keys
     63                                                  // only
     64 const QuicTag kCHID = TAG('C', 'H', 'I', 'D');   // Channel ID.
     65 
     66 // Client hello tags
     67 const QuicTag kVER  = TAG('V', 'E', 'R', '\0');  // Version (new)
     68 const QuicTag kNONC = TAG('N', 'O', 'N', 'C');   // The client's nonce
     69 const QuicTag kKEXS = TAG('K', 'E', 'X', 'S');   // Key exchange methods
     70 const QuicTag kAEAD = TAG('A', 'E', 'A', 'D');   // Authenticated
     71                                                  // encryption algorithms
     72 const QuicTag kCGST = TAG('C', 'G', 'S', 'T');   // Congestion control
     73                                                  // feedback types
     74 const QuicTag kCOPT = TAG('C', 'O', 'P', 'T');   // Congestion control options
     75 // kLOSS was 'L', 'O', 'S', 'S', but was changed from a tag vector to a tag.
     76 const QuicTag kLOSS = TAG('L', 'O', 'S', 'A');   // Loss detection algorithms
     77 const QuicTag kICSL = TAG('I', 'C', 'S', 'L');   // Idle connection state
     78                                                  // lifetime
     79 const QuicTag kKATO = TAG('K', 'A', 'T', 'O');   // Keepalive timeout
     80 const QuicTag kMSPC = TAG('M', 'S', 'P', 'C');   // Max streams per connection.
     81 const QuicTag kIRTT = TAG('I', 'R', 'T', 'T');   // Estimated initial RTT in us.
     82 const QuicTag kSWND = TAG('S', 'W', 'N', 'D');   // Server's Initial congestion
     83                                                  // window.
     84 const QuicTag kSNI  = TAG('S', 'N', 'I', '\0');  // Server name
     85                                                  // indication
     86 const QuicTag kPUBS = TAG('P', 'U', 'B', 'S');   // Public key values
     87 const QuicTag kSCID = TAG('S', 'C', 'I', 'D');   // Server config id
     88 const QuicTag kORBT = TAG('O', 'B', 'I', 'T');   // Server orbit.
     89 const QuicTag kPDMD = TAG('P', 'D', 'M', 'D');   // Proof demand.
     90 const QuicTag kPROF = TAG('P', 'R', 'O', 'F');   // Proof (signature).
     91 const QuicTag kCCS  = TAG('C', 'C', 'S', 0);     // Common certificate set
     92 const QuicTag kCCRT = TAG('C', 'C', 'R', 'T');   // Cached certificate
     93 const QuicTag kEXPY = TAG('E', 'X', 'P', 'Y');   // Expiry
     94 // TODO(rjshade): Remove kIFCW when removing QUIC_VERSION_19.
     95 const QuicTag kIFCW = TAG('I', 'F', 'C', 'W');   // Initial flow control receive
     96                                                  // window.
     97 const QuicTag kSFCW = TAG('S', 'F', 'C', 'W');   // Initial stream flow control
     98                                                  // receive window.
     99 const QuicTag kCFCW = TAG('C', 'F', 'C', 'W');   // Initial session/connection
    100                                                  // flow control receive window.
    101 const QuicTag kUAID = TAG('U', 'A', 'I', 'D');   // Client's User Agent ID.
    102 
    103 // Server hello tags
    104 const QuicTag kCADR = TAG('C', 'A', 'D', 'R');   // Client IP address and port
    105 
    106 // CETV tags
    107 const QuicTag kCIDK = TAG('C', 'I', 'D', 'K');   // ChannelID key
    108 const QuicTag kCIDS = TAG('C', 'I', 'D', 'S');   // ChannelID signature
    109 
    110 // Public reset tags
    111 const QuicTag kRNON = TAG('R', 'N', 'O', 'N');   // Public reset nonce proof
    112 const QuicTag kRSEQ = TAG('R', 'S', 'E', 'Q');   // Rejected sequence number
    113 
    114 // Universal tags
    115 const QuicTag kPAD  = TAG('P', 'A', 'D', '\0');  // Padding
    116 
    117 // Reasons for server sending rejection message tag.
    118 const QuicTag kRREJ = TAG('R', 'R', 'E', 'J');
    119 
    120 // These tags have a special form so that they appear either at the beginning
    121 // or the end of a handshake message. Since handshake messages are sorted by
    122 // tag value, the tags with 0 at the end will sort first and those with 255 at
    123 // the end will sort last.
    124 //
    125 // The certificate chain should have a tag that will cause it to be sorted at
    126 // the end of any handshake messages because it's likely to be large and the
    127 // client might be able to get everything that it needs from the small values at
    128 // the beginning.
    129 //
    130 // Likewise tags with random values should be towards the beginning of the
    131 // message because the server mightn't hold state for a rejected client hello
    132 // and therefore the client may have issues reassembling the rejection message
    133 // in the event that it sent two client hellos.
    134 const QuicTag kServerNonceTag =
    135     TAG('S', 'N', 'O', 0);  // The server's nonce
    136 const QuicTag kSourceAddressTokenTag =
    137     TAG('S', 'T', 'K', 0);  // Source-address token
    138 const QuicTag kCertificateTag =
    139     TAG('C', 'R', 'T', 255);  // Certificate chain
    140 
    141 #undef TAG
    142 
    143 const size_t kMaxEntries = 128;  // Max number of entries in a message.
    144 
    145 const size_t kNonceSize = 32;  // Size in bytes of the connection nonce.
    146 
    147 const size_t kOrbitSize = 8;  // Number of bytes in an orbit value.
    148 
    149 // kProofSignatureLabel is prepended to server configs before signing to avoid
    150 // any cross-protocol attacks on the signature.
    151 const char kProofSignatureLabel[] = "QUIC server config signature";
    152 
    153 // kClientHelloMinimumSize is the minimum size of a client hello. Client hellos
    154 // will have PAD tags added in order to ensure this minimum is met and client
    155 // hellos smaller than this will be an error. This minimum size reduces the
    156 // amplification factor of any mirror DoS attack.
    157 //
    158 // A client may pad an inchoate client hello to a size larger than
    159 // kClientHelloMinimumSize to make it more likely to receive a complete
    160 // rejection message.
    161 const size_t kClientHelloMinimumSize = 1024;
    162 
    163 }  // namespace net
    164 
    165 #endif  // NET_QUIC_CRYPTO_CRYPTO_PROTOCOL_H_
    166