mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-08-17 04:27:00 +02:00
1b03f8016d
Highly inspired from nginx openssl wrapper code. This wrapper implement this list of functions: SSL_set_quic_method(), SSL_quic_read_level(), SSL_quic_write_level(), SSL_set_quic_transport_params(), SSL_provide_quic_data(), SSL_process_quic_post_handshake() and SSL_QUIC_METHOD QUIC specific bio method which are also implemented by quictls to support QUIC from OpenSSL. So, its aims is to support QUIC from a standard OpenSSL stack without QUIC support. It relies on the OpenSSL keylog feature to retreive the secrets derived by the OpenSSL stack during a handshake and to pass them to the ->set_encryption_secrets() callback as this is done by quictls. It makes usage of a callback (quic_tls_compat_msg_callback()) to handle some TLS messages only on the receipt path. Some of them must be passed to the ->add_handshake_data() callback as this is done with quictls to be sent to the peer as CRYPTO data. quic_tls_compat_msg_callback() callback also sends the received TLS alert with ->send_alert() callback. AES 128-bits with CCM mode is not supported at this time. It is often disabled by the OpenSSL stack, but as it can be enabled by "ssl-default-bind-ciphersuites", the wrapper will send a TLS alerts (Handhshake failure) if this algorithm is negotiated between the client and the server. 0rtt is also not supported by this wrapper.
65 lines
1.7 KiB
C
65 lines
1.7 KiB
C
#ifndef _HAPROXY_QUIC_OPENSSL_COMPAT_T_H_
|
|
#define _HAPROXY_QUIC_OPENSSL_COMPAT_T_H_
|
|
|
|
#ifdef USE_QUIC_OPENSSL_COMPAT
|
|
#ifndef USE_OPENSSL
|
|
#error "Must define USE_OPENSSL"
|
|
#endif
|
|
|
|
#define QUIC_OPENSSL_COMPAT_TLS_SECRET_LEN 48
|
|
#define QUIC_OPENSSL_COMPAT_TLS_IV_LEN 12
|
|
|
|
/* Highly inspired from nginx QUIC TLS compatibilty code */
|
|
|
|
enum ssl_encryption_level_t {
|
|
ssl_encryption_initial = 0,
|
|
ssl_encryption_early_data,
|
|
ssl_encryption_handshake,
|
|
ssl_encryption_application
|
|
};
|
|
|
|
typedef struct ssl_quic_method_st {
|
|
int (*set_encryption_secrets)(SSL *ssl, enum ssl_encryption_level_t level,
|
|
const uint8_t *rsecret, const uint8_t *wsecret,
|
|
size_t secret_len);
|
|
int (*add_handshake_data)(SSL *ssl, enum ssl_encryption_level_t level,
|
|
const uint8_t *data, size_t len);
|
|
int (*flush_flight)(SSL *ssl);
|
|
int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level,
|
|
uint8_t alert);
|
|
} SSL_QUIC_METHOD;
|
|
|
|
struct quic_tls_md {
|
|
unsigned char data[QUIC_OPENSSL_COMPAT_TLS_SECRET_LEN];
|
|
size_t len;
|
|
};
|
|
|
|
struct quic_tls_iv {
|
|
unsigned char data[QUIC_OPENSSL_COMPAT_TLS_IV_LEN];
|
|
size_t len;
|
|
};
|
|
|
|
struct quic_tls_secret {
|
|
struct quic_tls_md secret;
|
|
struct quic_tls_md key;
|
|
struct quic_tls_iv iv;
|
|
};
|
|
|
|
struct quic_tls_compat_keys {
|
|
struct quic_tls_secret secret;
|
|
const EVP_CIPHER *cipher;
|
|
};
|
|
|
|
struct quic_openssl_compat {
|
|
BIO *rbio;
|
|
BIO *wbio;
|
|
const SSL_QUIC_METHOD *method;
|
|
enum ssl_encryption_level_t write_level;
|
|
enum ssl_encryption_level_t read_level;
|
|
uint64_t read_record;
|
|
struct quic_tls_compat_keys keys;
|
|
};
|
|
|
|
#endif /* USE_QUIC_OPENSSL_COMPAT */
|
|
#endif /* _HAPROXY_QUIC_OPENSSL_COMPAT_T_H_ */
|