diff --git a/bazel/external/quiche.BUILD b/bazel/external/quiche.BUILD index f8a1079ac93cd..662ae2cd1ef88 100644 --- a/bazel/external/quiche.BUILD +++ b/bazel/external/quiche.BUILD @@ -1266,6 +1266,7 @@ envoy_cc_library( visibility = ["//visibility:public"], deps = [ ":quic_core_arena_scoped_ptr_lib", + ":quic_core_connection_context_lib", ":quic_core_time_lib", ], ) diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl index b817e6efffab7..297be414866b1 100644 --- a/bazel/repository_locations.bzl +++ b/bazel/repository_locations.bzl @@ -821,13 +821,12 @@ REPOSITORY_LOCATIONS_SPEC = dict( project_name = "QUICHE", project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols", project_url = "https://github.com/google/quiche", - version = "8d5eb27ee2e3f009f7180e8ace0ff97830d9c3e9", - sha256 = "88cc71556b96bbec953a716a12c26f88b8af4d5e9a83cf3ec38aba4caed6bf52", - # Static snapshot of https://quiche.googlesource.com/quiche/+archive/{version}.tar.gz + version = "e8ddc3873182355137862b4d6417add2b2b8a31d", + sha256 = "f1d17b033a9e7449ef84f0c7392319061981439fa15c5be3007c4dea4b58ebc3", urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"], strip_prefix = "quiche-{version}", use_category = ["dataplane_core"], - release_date = "2021-08-31", + release_date = "2021-09-09", cpe = "N/A", ), com_googlesource_googleurl = dict( diff --git a/source/common/quic/envoy_quic_proof_source.cc b/source/common/quic/envoy_quic_proof_source.cc index 67d9e0ce3ce55..d755be071e9f5 100644 --- a/source/common/quic/envoy_quic_proof_source.cc +++ b/source/common/quic/envoy_quic_proof_source.cc @@ -16,7 +16,10 @@ namespace Quic { quic::QuicReferenceCountedPointer EnvoyQuicProofSource::GetCertChain(const quic::QuicSocketAddress& server_address, const quic::QuicSocketAddress& client_address, - const std::string& hostname) { + const std::string& hostname, bool* cert_matched_sni) { + // TODO(DavidSchinazi) parse the certificate to correctly fill in |cert_matched_sni|. + *cert_matched_sni = false; + CertConfigWithFilterChain res = getTlsCertConfigAndFilterChain(server_address, client_address, hostname); absl::optional> cert_config_ref = diff --git a/source/common/quic/envoy_quic_proof_source.h b/source/common/quic/envoy_quic_proof_source.h index fcf388c609140..69d62fd549184 100644 --- a/source/common/quic/envoy_quic_proof_source.h +++ b/source/common/quic/envoy_quic_proof_source.h @@ -22,7 +22,8 @@ class EnvoyQuicProofSource : public EnvoyQuicProofSourceBase { // quic::ProofSource quic::QuicReferenceCountedPointer GetCertChain(const quic::QuicSocketAddress& server_address, - const quic::QuicSocketAddress& client_address, const std::string& hostname) override; + const quic::QuicSocketAddress& client_address, const std::string& hostname, + bool* cert_matched_sni) override; protected: // quic::ProofSource diff --git a/source/common/quic/envoy_quic_server_connection.cc b/source/common/quic/envoy_quic_server_connection.cc index 963032e041f00..6a4d691009361 100644 --- a/source/common/quic/envoy_quic_server_connection.cc +++ b/source/common/quic/envoy_quic_server_connection.cc @@ -38,7 +38,8 @@ bool EnvoyQuicServerConnection::OnPacketHeader(const quic::QuicPacketHeader& hea std::unique_ptr EnvoyQuicServerConnection::MakeSelfIssuedConnectionIdManager() { return std::make_unique( - quic::kMinNumOfActiveConnectionIds, connection_id(), clock(), alarm_factory(), this); + quic::kMinNumOfActiveConnectionIds, connection_id(), clock(), alarm_factory(), this, + context()); } quic::QuicConnectionId EnvoyQuicSelfIssuedConnectionIdManager::GenerateNewConnectionId( diff --git a/test/common/quic/envoy_quic_alarm_test.cc b/test/common/quic/envoy_quic_alarm_test.cc index f90f8eb2a4e69..529902376d843 100644 --- a/test/common/quic/envoy_quic_alarm_test.cc +++ b/test/common/quic/envoy_quic_alarm_test.cc @@ -14,7 +14,7 @@ using quic::QuicTime; namespace Envoy { namespace Quic { -class TestDelegate : public quic::QuicAlarm::Delegate { +class TestDelegate : public quic::QuicAlarm::DelegateWithoutContext { public: TestDelegate() = default; diff --git a/test/common/quic/envoy_quic_proof_source_test.cc b/test/common/quic/envoy_quic_proof_source_test.cc index 75230db0f504f..a2deedcb29d16 100644 --- a/test/common/quic/envoy_quic_proof_source_test.cc +++ b/test/common/quic/envoy_quic_proof_source_test.cc @@ -193,8 +193,9 @@ class EnvoyQuicProofSourceTest : public ::testing::Test { TEST_F(EnvoyQuicProofSourceTest, TestGetCerChainAndSignatureAndVerify) { expectCertChainAndPrivateKey(expected_certs_, true); + bool cert_matched_sni; quic::QuicReferenceCountedPointer chain = - proof_source_.GetCertChain(server_address_, client_address_, hostname_); + proof_source_.GetCertChain(server_address_, client_address_, hostname_, &cert_matched_sni); EXPECT_EQ(2, chain->certs.size()); std::string error_details; @@ -216,7 +217,9 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailBadConfig) { EXPECT_CALL(listen_socket_, ioHandle()).Times(3); EXPECT_CALL(filter_chain_manager_, findFilterChain(_)) .WillOnce(Invoke([&](const Network::ConnectionSocket&) { return nullptr; })); - EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_)); + bool cert_matched_sni; + EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_, + &cert_matched_sni)); // Cert not ready. EXPECT_CALL(filter_chain_manager_, findFilterChain(_)) @@ -224,7 +227,8 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailBadConfig) { EXPECT_CALL(filter_chain_, transportSocketFactory()) .WillOnce(ReturnRef(*transport_socket_factory_)); EXPECT_CALL(*mock_context_config_, isReady()).WillOnce(Return(false)); - EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_)); + EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_, + &cert_matched_sni)); // No certs in config. EXPECT_CALL(filter_chain_manager_, findFilterChain(_)) @@ -242,7 +246,8 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailBadConfig) { EXPECT_CALL(*mock_context_config_, isReady()).WillOnce(Return(true)); std::vector> tls_cert_configs{}; EXPECT_CALL(*mock_context_config_, tlsCertificates()).WillOnce(Return(tls_cert_configs)); - EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_)); + EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_, + &cert_matched_sni)); } TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailInvalidCert) { @@ -250,7 +255,9 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailInvalidCert) { invalid certificate -----END CERTIFICATE-----)"}; expectCertChainAndPrivateKey(invalid_cert, false); - EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_)); + bool cert_matched_sni; + EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_, + &cert_matched_sni)); } TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailInvalidPublicKeyInCert) { @@ -275,7 +282,9 @@ x96rVeUbRJ/qU4//nNM/XQa9vIAIcTZ0jFhmb0c3R4rmoqqC3vkSDwtaE5yuS5T4 GUy+n0vQNB0cXGzgcGI= -----END CERTIFICATE-----)"}; expectCertChainAndPrivateKey(cert_with_rsa_1024, false); - EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_)); + bool cert_matched_sni; + EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_, + &cert_matched_sni)); } TEST_F(EnvoyQuicProofSourceTest, ComputeSignatureFailNoFilterChain) { diff --git a/test/common/quic/test_proof_source.h b/test/common/quic/test_proof_source.h index b4a8a8348223b..434c15fecada5 100644 --- a/test/common/quic/test_proof_source.h +++ b/test/common/quic/test_proof_source.h @@ -27,8 +27,9 @@ class TestProofSource : public EnvoyQuicProofSourceBase { public: quic::QuicReferenceCountedPointer GetCertChain(const quic::QuicSocketAddress& /*server_address*/, - const quic::QuicSocketAddress& /*client_address*/, - const std::string& /*hostname*/) override { + const quic::QuicSocketAddress& /*client_address*/, const std::string& /*hostname*/, + bool* cert_matched_sni) override { + *cert_matched_sni = true; return cert_chain_; }