Skip to content

Update QUICHE to e8ddc3873182355137862b4d6417add2b2b8a31d #18060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggreenway merged 2 commits into from
Sep 13, 2021
Merged

Update QUICHE to e8ddc3873182355137862b4d6417add2b2b8a31d #18060

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14a47b4
QUICHE roll to e8ddc3873182355137862b4d6417add2b2b8a31d
DavidSchinazi Sep 9, 2021
e9d50ba
fix release date
DavidSchinazi Sep 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions bazel/external/quiche.BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1266,6 +1266,7 @@ envoy_cc_library(
visibility = ["//visibility:public"],
deps = [
":quic_core_arena_scoped_ptr_lib",
":quic_core_connection_context_lib",
":quic_core_time_lib",
],
)
Expand Down
7 changes: 3 additions & 4 deletions bazel/repository_locations.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -821,13 +821,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
project_name = "QUICHE",
project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols",
project_url = "https://github.com/google/quiche",
version = "8d5eb27ee2e3f009f7180e8ace0ff97830d9c3e9",
sha256 = "88cc71556b96bbec953a716a12c26f88b8af4d5e9a83cf3ec38aba4caed6bf52",
# Static snapshot of https://quiche.googlesource.com/quiche/+archive/{version}.tar.gz
version = "e8ddc3873182355137862b4d6417add2b2b8a31d",
sha256 = "f1d17b033a9e7449ef84f0c7392319061981439fa15c5be3007c4dea4b58ebc3",
urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"],
strip_prefix = "quiche-{version}",
use_category = ["dataplane_core"],
release_date = "2021-08-31",
release_date = "2021-09-09",
cpe = "N/A",
),
com_googlesource_googleurl = dict(
Expand Down
5 changes: 4 additions & 1 deletion source/common/quic/envoy_quic_proof_source.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,10 @@ namespace Quic {
quic::QuicReferenceCountedPointer<quic::ProofSource::Chain>
EnvoyQuicProofSource::GetCertChain(const quic::QuicSocketAddress& server_address,
const quic::QuicSocketAddress& client_address,
const std::string& hostname) {
const std::string& hostname, bool* cert_matched_sni) {
// TODO(DavidSchinazi) parse the certificate to correctly fill in |cert_matched_sni|.
*cert_matched_sni = false;

@ggreenway ggreenway Sep 13, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the impact of setting this to false?

@DavidSchinazi DavidSchinazi Sep 13, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There isn't any, the core library simply plumbs this value through (another user needed it) and Envoy doesn't read it on the other side so this is a no-op


CertConfigWithFilterChain res =
getTlsCertConfigAndFilterChain(server_address, client_address, hostname);
absl::optional<std::reference_wrapper<const Envoy::Ssl::TlsCertificateConfig>> cert_config_ref =
Expand Down
3 changes: 2 additions & 1 deletion source/common/quic/envoy_quic_proof_source.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,8 @@ class EnvoyQuicProofSource : public EnvoyQuicProofSourceBase {
// quic::ProofSource
quic::QuicReferenceCountedPointer<quic::ProofSource::Chain>
GetCertChain(const quic::QuicSocketAddress& server_address,
const quic::QuicSocketAddress& client_address, const std::string& hostname) override;
const quic::QuicSocketAddress& client_address, const std::string& hostname,
bool* cert_matched_sni) override;

protected:
// quic::ProofSource
Expand Down
3 changes: 2 additions & 1 deletion source/common/quic/envoy_quic_server_connection.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ bool EnvoyQuicServerConnection::OnPacketHeader(const quic::QuicPacketHeader& hea
std::unique_ptr<quic::QuicSelfIssuedConnectionIdManager>
EnvoyQuicServerConnection::MakeSelfIssuedConnectionIdManager() {
return std::make_unique<EnvoyQuicSelfIssuedConnectionIdManager>(
quic::kMinNumOfActiveConnectionIds, connection_id(), clock(), alarm_factory(), this);
quic::kMinNumOfActiveConnectionIds, connection_id(), clock(), alarm_factory(), this,
context());
}

quic::QuicConnectionId EnvoyQuicSelfIssuedConnectionIdManager::GenerateNewConnectionId(
Expand Down
2 changes: 1 addition & 1 deletion test/common/quic/envoy_quic_alarm_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ using quic::QuicTime;
namespace Envoy {
namespace Quic {

class TestDelegate : public quic::QuicAlarm::Delegate {
class TestDelegate : public quic::QuicAlarm::DelegateWithoutContext {
public:
TestDelegate() = default;

Expand Down
21 changes: 15 additions & 6 deletions test/common/quic/envoy_quic_proof_source_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,8 +193,9 @@ class EnvoyQuicProofSourceTest : public ::testing::Test {

TEST_F(EnvoyQuicProofSourceTest, TestGetCerChainAndSignatureAndVerify) {
expectCertChainAndPrivateKey(expected_certs_, true);
bool cert_matched_sni;
quic::QuicReferenceCountedPointer<quic::ProofSource::Chain> chain =
proof_source_.GetCertChain(server_address_, client_address_, hostname_);
proof_source_.GetCertChain(server_address_, client_address_, hostname_, &cert_matched_sni);
EXPECT_EQ(2, chain->certs.size());

std::string error_details;
Expand All @@ -216,15 +217,18 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailBadConfig) {
EXPECT_CALL(listen_socket_, ioHandle()).Times(3);
EXPECT_CALL(filter_chain_manager_, findFilterChain(_))
.WillOnce(Invoke([&](const Network::ConnectionSocket&) { return nullptr; }));
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_));
bool cert_matched_sni;
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_,
&cert_matched_sni));

// Cert not ready.
EXPECT_CALL(filter_chain_manager_, findFilterChain(_))
.WillOnce(Invoke([&](const Network::ConnectionSocket&) { return &filter_chain_; }));
EXPECT_CALL(filter_chain_, transportSocketFactory())
.WillOnce(ReturnRef(*transport_socket_factory_));
EXPECT_CALL(*mock_context_config_, isReady()).WillOnce(Return(false));
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_));
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_,
&cert_matched_sni));

// No certs in config.
EXPECT_CALL(filter_chain_manager_, findFilterChain(_))
Expand All @@ -242,15 +246,18 @@ TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailBadConfig) {
EXPECT_CALL(*mock_context_config_, isReady()).WillOnce(Return(true));
std::vector<std::reference_wrapper<const Envoy::Ssl::TlsCertificateConfig>> tls_cert_configs{};
EXPECT_CALL(*mock_context_config_, tlsCertificates()).WillOnce(Return(tls_cert_configs));
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_));
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_,
&cert_matched_sni));
}

TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailInvalidCert) {
std::string invalid_cert{R"(-----BEGIN CERTIFICATE-----
invalid certificate
-----END CERTIFICATE-----)"};
expectCertChainAndPrivateKey(invalid_cert, false);
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_));
bool cert_matched_sni;
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_,
&cert_matched_sni));
}

TEST_F(EnvoyQuicProofSourceTest, GetCertChainFailInvalidPublicKeyInCert) {
Expand All @@ -275,7 +282,9 @@ x96rVeUbRJ/qU4//nNM/XQa9vIAIcTZ0jFhmb0c3R4rmoqqC3vkSDwtaE5yuS5T4
GUy+n0vQNB0cXGzgcGI=
-----END CERTIFICATE-----)"};
expectCertChainAndPrivateKey(cert_with_rsa_1024, false);
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_));
bool cert_matched_sni;
EXPECT_EQ(nullptr, proof_source_.GetCertChain(server_address_, client_address_, hostname_,
&cert_matched_sni));
}

TEST_F(EnvoyQuicProofSourceTest, ComputeSignatureFailNoFilterChain) {
Expand Down
5 changes: 3 additions & 2 deletions test/common/quic/test_proof_source.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,9 @@ class TestProofSource : public EnvoyQuicProofSourceBase {
public:
quic::QuicReferenceCountedPointer<quic::ProofSource::Chain>
GetCertChain(const quic::QuicSocketAddress& /*server_address*/,
const quic::QuicSocketAddress& /*client_address*/,
const std::string& /*hostname*/) override {
const quic::QuicSocketAddress& /*client_address*/, const std::string& /*hostname*/,
bool* cert_matched_sni) override {
*cert_matched_sni = true;
return cert_chain_;
}

Expand Down