-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
quiche: implement certificate verification (#12063)
Implement quic::ProofVerifier which consists of cert verification and signature verification. Cert verification: Share cert verification code with Extensions::TransportSockets::Tls::ClientContextImpl. And initialize ProofVerifier using Envoy::Ssl::ClientContextConfig protobuf. Signature verification: Use quic::CertificateViewer to verify signature. Part of #9434 #2557 Signed-off-by: Dan Zhang <danzh@google.com>
- Loading branch information
Showing
24 changed files
with
1,072 additions
and
191 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 0 additions & 61 deletions
61
source/extensions/quic_listeners/quiche/envoy_quic_fake_proof_verifier.h
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
81 changes: 81 additions & 0 deletions
81
source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.cc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| #include "extensions/quic_listeners/quiche/envoy_quic_proof_source_base.h" | ||
|
|
||
| #pragma GCC diagnostic push | ||
|
|
||
| // QUICHE allows unused parameters. | ||
| #pragma GCC diagnostic ignored "-Wunused-parameter" | ||
| #include "quiche/quic/core/quic_data_writer.h" | ||
|
|
||
| #pragma GCC diagnostic pop | ||
|
|
||
| #include "extensions/quic_listeners/quiche/envoy_quic_utils.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Quic { | ||
|
|
||
| void EnvoyQuicProofSourceBase::GetProof(const quic::QuicSocketAddress& server_address, | ||
| const quic::QuicSocketAddress& client_address, | ||
| const std::string& hostname, | ||
| const std::string& server_config, | ||
| quic::QuicTransportVersion /*transport_version*/, | ||
| quiche::QuicheStringPiece chlo_hash, | ||
| std::unique_ptr<quic::ProofSource::Callback> callback) { | ||
| quic::QuicReferenceCountedPointer<quic::ProofSource::Chain> chain = | ||
| GetCertChain(server_address, client_address, hostname); | ||
|
|
||
| if (chain == nullptr || chain->certs.empty()) { | ||
| quic::QuicCryptoProof proof; | ||
| callback->Run(/*ok=*/false, nullptr, proof, nullptr); | ||
| return; | ||
| } | ||
| size_t payload_size = sizeof(quic::kProofSignatureLabel) + sizeof(uint32_t) + chlo_hash.size() + | ||
| server_config.size(); | ||
| auto payload = std::make_unique<char[]>(payload_size); | ||
| quic::QuicDataWriter payload_writer(payload_size, payload.get(), | ||
| quiche::Endianness::HOST_BYTE_ORDER); | ||
| bool success = | ||
| payload_writer.WriteBytes(quic::kProofSignatureLabel, sizeof(quic::kProofSignatureLabel)) && | ||
| payload_writer.WriteUInt32(chlo_hash.size()) && payload_writer.WriteStringPiece(chlo_hash) && | ||
| payload_writer.WriteStringPiece(server_config); | ||
| if (!success) { | ||
| quic::QuicCryptoProof proof; | ||
| callback->Run(/*ok=*/false, nullptr, proof, nullptr); | ||
| return; | ||
| } | ||
|
|
||
| std::string error_details; | ||
| bssl::UniquePtr<X509> cert = parseDERCertificate(chain->certs[0], &error_details); | ||
| if (cert == nullptr) { | ||
| ENVOY_LOG(warn, absl::StrCat("Invalid leaf cert: ", error_details)); | ||
| quic::QuicCryptoProof proof; | ||
| callback->Run(/*ok=*/false, nullptr, proof, nullptr); | ||
| return; | ||
| } | ||
|
|
||
| bssl::UniquePtr<EVP_PKEY> pub_key(X509_get_pubkey(cert.get())); | ||
| int sign_alg = deduceSignatureAlgorithmFromPublicKey(pub_key.get(), &error_details); | ||
| if (sign_alg == 0) { | ||
| ENVOY_LOG(warn, absl::StrCat("Failed to deduce signature algorithm from public key: ", | ||
| error_details)); | ||
| quic::QuicCryptoProof proof; | ||
| callback->Run(/*ok=*/false, nullptr, proof, nullptr); | ||
| return; | ||
| } | ||
|
|
||
| auto signature_callback = std::make_unique<SignatureCallback>(std::move(callback), chain); | ||
|
|
||
| signPayload(server_address, client_address, hostname, sign_alg, | ||
| quiche::QuicheStringPiece(payload.get(), payload_size), | ||
| std::move(signature_callback)); | ||
| } | ||
|
|
||
| void EnvoyQuicProofSourceBase::ComputeTlsSignature( | ||
| const quic::QuicSocketAddress& server_address, const quic::QuicSocketAddress& client_address, | ||
| const std::string& hostname, uint16_t signature_algorithm, quiche::QuicheStringPiece in, | ||
| std::unique_ptr<quic::ProofSource::SignatureCallback> callback) { | ||
| signPayload(server_address, client_address, hostname, signature_algorithm, in, | ||
| std::move(callback)); | ||
| } | ||
|
|
||
| } // namespace Quic | ||
| } // namespace Envoy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.