Merging upstream version 1.62.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 47 insertions, 40 deletions

diff --git a/src/shrpx_quic.cc b/src/shrpx_quic.cc
index c52eee4..1ffd217 100644
--- a/src/shrpx_quic.cc
+++ b/src/shrpx_quic.cc
@@ -58,8 +58,10 @@ ngtcp2_tstamp quic_timestamp() {
 int quic_send_packet(const UpstreamAddr *faddr, const sockaddr *remote_sa,
                      size_t remote_salen, const sockaddr *local_sa,
                      size_t local_salen, const ngtcp2_pkt_info &pi,
-                     const uint8_t *data, size_t datalen, size_t gso_size) {
-  iovec msg_iov = {const_cast<uint8_t *>(data), datalen};
+                     std::span<const uint8_t> data, size_t gso_size) {
+  assert(gso_size);
+
+  iovec msg_iov = {const_cast<uint8_t *>(data.data()), data.size()};
   msghdr msg{};
   msg.msg_name = const_cast<sockaddr *>(remote_sa);
   msg.msg_namelen = remote_salen;
@@ -113,7 +115,7 @@ int quic_send_packet(const UpstreamAddr *faddr, const sockaddr *remote_sa,
   }
 
 #ifdef UDP_SEGMENT
-  if (gso_size && datalen > gso_size) {
+  if (data.size() > gso_size) {
     controllen += CMSG_SPACE(sizeof(uint16_t));
     cm = CMSG_NXTHDR(&msg, cm);
     cm->cmsg_level = SOL_UDP;
@@ -170,6 +172,8 @@ int quic_send_packet(const UpstreamAddr *faddr, const sockaddr *remote_sa,
               << " bytes";
   }
 
+  assert(static_cast<size_t>(nwrite) == data.size());
+
   return 0;
 }
 
@@ -267,87 +271,90 @@ int generate_quic_stateless_reset_token(uint8_t *token, const ngtcp2_cid &cid,
   return 0;
 }
 
-int generate_retry_token(uint8_t *token, size_t &tokenlen, uint32_t version,
-                         const sockaddr *sa, socklen_t salen,
-                         const ngtcp2_cid &retry_scid, const ngtcp2_cid &odcid,
-                         const uint8_t *secret, size_t secretlen) {
+std::optional<std::span<const uint8_t>>
+generate_retry_token(std::span<uint8_t> token, uint32_t version,
+                     const sockaddr *sa, socklen_t salen,
+                     const ngtcp2_cid &retry_scid, const ngtcp2_cid &odcid,
+                     std::span<const uint8_t> secret) {
   auto t = std::chrono::duration_cast<std::chrono::nanoseconds>(
                std::chrono::system_clock::now().time_since_epoch())
                .count();
 
-  auto stokenlen = ngtcp2_crypto_generate_retry_token(
-      token, secret, secretlen, version, sa, salen, &retry_scid, &odcid, t);
-  if (stokenlen < 0) {
-    return -1;
+  auto tokenlen = ngtcp2_crypto_generate_retry_token(
+      token.data(), secret.data(), secret.size(), version, sa, salen,
+      &retry_scid, &odcid, t);
+  if (tokenlen < 0) {
+    return {};
   }
 
-  tokenlen = stokenlen;
-
-  return 0;
+  return {{std::begin(token), static_cast<size_t>(tokenlen)}};
 }
 
-int verify_retry_token(ngtcp2_cid &odcid, const uint8_t *token, size_t tokenlen,
+int verify_retry_token(ngtcp2_cid &odcid, std::span<const uint8_t> token,
                        uint32_t version, const ngtcp2_cid &dcid,
                        const sockaddr *sa, socklen_t salen,
-                       const uint8_t *secret, size_t secretlen) {
-
+                       std::span<const uint8_t> secret) {
   auto t = std::chrono::duration_cast<std::chrono::nanoseconds>(
                std::chrono::system_clock::now().time_since_epoch())
                .count();
 
-  if (ngtcp2_crypto_verify_retry_token(&odcid, token, tokenlen, secret,
-                                       secretlen, version, sa, salen, &dcid,
-                                       10 * NGTCP2_SECONDS, t) != 0) {
+  if (ngtcp2_crypto_verify_retry_token(
+          &odcid, token.data(), token.size(), secret.data(), secret.size(),
+          version, sa, salen, &dcid, 10 * NGTCP2_SECONDS, t) != 0) {
     return -1;
   }
 
   return 0;
 }
 
-int generate_token(uint8_t *token, size_t &tokenlen, const sockaddr *sa,
-                   size_t salen, const uint8_t *secret, size_t secretlen) {
+std::optional<std::span<const uint8_t>>
+generate_token(std::span<uint8_t> token, const sockaddr *sa, size_t salen,
+               std::span<const uint8_t> secret, uint8_t km_id) {
   auto t = std::chrono::duration_cast<std::chrono::nanoseconds>(
                std::chrono::system_clock::now().time_since_epoch())
                .count();
 
-  auto stokenlen = ngtcp2_crypto_generate_regular_token(
-      token, secret, secretlen, sa, salen, t);
-  if (stokenlen < 0) {
-    return -1;
+  auto tokenlen = ngtcp2_crypto_generate_regular_token(
+      token.data(), secret.data(), secret.size(), sa, salen, t);
+  if (tokenlen < 0) {
+    return {};
   }
 
-  tokenlen = stokenlen;
+  token[tokenlen++] = km_id;
 
-  return 0;
+  return {{std::begin(token), static_cast<size_t>(tokenlen)}};
 }
 
-int verify_token(const uint8_t *token, size_t tokenlen, const sockaddr *sa,
-                 socklen_t salen, const uint8_t *secret, size_t secretlen) {
+int verify_token(std::span<const uint8_t> token, const sockaddr *sa,
+                 socklen_t salen, std::span<const uint8_t> secret) {
+  if (token.empty()) {
+    return -1;
+  }
+
   auto t = std::chrono::duration_cast<std::chrono::nanoseconds>(
                std::chrono::system_clock::now().time_since_epoch())
                .count();
 
-  if (ngtcp2_crypto_verify_regular_token(token, tokenlen, secret, secretlen, sa,
-                                         salen, 3600 * NGTCP2_SECONDS,
-                                         t) != 0) {
+  if (ngtcp2_crypto_verify_regular_token(
+          token.data(), token.size() - 1, secret.data(), secret.size(), sa,
+          salen, 3600 * NGTCP2_SECONDS, t) != 0) {
     return -1;
   }
 
   return 0;
 }
 
-int generate_quic_connection_id_encryption_key(uint8_t *key, size_t keylen,
-                                               const uint8_t *secret,
-                                               size_t secretlen,
-                                               const uint8_t *salt,
-                                               size_t saltlen) {
+int generate_quic_connection_id_encryption_key(std::span<uint8_t> key,
+                                               std::span<const uint8_t> secret,
+                                               std::span<const uint8_t> salt) {
   constexpr uint8_t info[] = "connection id encryption key";
   ngtcp2_crypto_md sha256;
   ngtcp2_crypto_md_init(
       &sha256, reinterpret_cast<void *>(const_cast<EVP_MD *>(EVP_sha256())));
 
-  if (ngtcp2_crypto_hkdf(key, keylen, &sha256, secret, secretlen, salt, saltlen,
-                         info, str_size(info)) != 0) {
+  if (ngtcp2_crypto_hkdf(key.data(), key.size(), &sha256, secret.data(),
+                         secret.size(), salt.data(), salt.size(), info,
+                         str_size(info)) != 0) {
     return -1;
   }