mirror of
https://github.com/facebookincubator/mvfst.git
synced 2025-08-09 20:42:44 +03:00
bcbe5adce4
Summary: See title Reviewed By: kvtsoy Differential Revision: D73444489 fbshipit-source-id: f83566ce023e8237335d3bb43d89fc471f053afa
70 lines
1.8 KiB
C++
70 lines
1.8 KiB
C++
/*
|
|
* Copyright (c) Meta Platforms, Inc. and affiliates.
|
|
*
|
|
* This source code is licensed under the MIT license found in the
|
|
* LICENSE file in the root directory of this source tree.
|
|
*/
|
|
|
|
#include <folly/io/IOBuf.h>
|
|
#include <quic/server/handshake/TokenGenerator.h>
|
|
|
|
#include <folly/Range.h>
|
|
#include <quic/codec/Decode.h>
|
|
|
|
namespace {
|
|
|
|
const std::vector<std::string> kCipherContexts = {"RetryToken_V2"};
|
|
|
|
} // namespace
|
|
|
|
namespace quic {
|
|
|
|
TokenGenerator::TokenGenerator(TokenSecret secret) : cipher_(kCipherContexts) {
|
|
std::vector<ByteRange> secrets;
|
|
secrets.emplace_back(folly::range(secret));
|
|
cipher_.setSecrets(secrets);
|
|
}
|
|
|
|
Optional<BufPtr> TokenGenerator::encryptToken(
|
|
const QuicAddrValidationToken& token) {
|
|
// Generate the retry token in plaintext
|
|
auto plainTextToken = token.getPlaintextToken();
|
|
|
|
// Try to encrypt it
|
|
auto maybeEncryptedToken = cipher_.encrypt(
|
|
std::move(plainTextToken), token.genAeadAssocData().get());
|
|
if (!maybeEncryptedToken) {
|
|
LOG(ERROR) << "Failed to encypt addr validation token with IP "
|
|
<< token.clientIp.str();
|
|
}
|
|
|
|
// If the encryption failed, this will be empty optional
|
|
return maybeEncryptedToken;
|
|
}
|
|
|
|
uint64_t TokenGenerator::decryptToken(
|
|
BufPtr encryptedToken,
|
|
BufPtr aeadAssocData) {
|
|
auto maybeDecryptedToken =
|
|
cipher_.decrypt(std::move(encryptedToken), aeadAssocData.get());
|
|
|
|
if (!maybeDecryptedToken) {
|
|
return 0;
|
|
}
|
|
|
|
// Try to parse the decrypted token
|
|
auto decryptedToken = (*maybeDecryptedToken).get();
|
|
folly::io::Cursor cursor(decryptedToken);
|
|
|
|
auto parseResult = parsePlaintextRetryOrNewToken(cursor);
|
|
|
|
if (parseResult.hasError()) {
|
|
LOG(ERROR) << "Failed to parse decrypted retry token";
|
|
return 0;
|
|
}
|
|
|
|
return parseResult.value();
|
|
}
|
|
|
|
} // namespace quic
|