Struct QuicConnection 

pub struct QuicConnection { /* private fields */ }

A TLS 1.3 handshake for a QUIC connection.

Implementations

impl QuicConnection

pub fn new_server( cfg: Arc<ServerConfig>, transport_params: Vec<u8>, ) -> QuicConnection

A server; transport_params is our encoded transport_parameters extension body.

Examples found in repository

examples/../tests/fuzzing/mod.rs (line 143)

pub fn corpus() -> Corpus {
    let ss = certgen::issue(&CertParams::server(&["localhost"]), PrivateKey::generate_ec(EcCurve::P256), None);
    let mut roots = RootStore::empty();
    roots.add_der(&ss.cert_der).unwrap();
    let scfg = Arc::new(ServerConfig::new(CertifiedKey::new(vec![ss.cert_der.clone()], ss.key.clone()).unwrap()).with_alpn(&[b"h3", b"http/1.1"]));
    let mut cc = ClientConfig::new(roots).with_alpn(&[b"h3", b"http/1.1"]);
    cc.sessions = None;
    let ccfg = Arc::new(cc);
    // a TLS handshake transcript
    let mut c = ClientConnection::new(ccfg.clone(), "localhost").unwrap();
    let mut s = ServerConnection::new(scfg.clone());
    let ch = c.tls_output().to_vec();
    c.consume_tls_output(ch.len());
    s.read_tls(&ch);
    s.process_new_packets().unwrap();
    let flight = s.tls_output().to_vec();
    let mut ch_plus = ch.clone();
    ch_plus.extend_from_slice(&[20, 3, 3, 0, 1, 1, 23, 3, 3, 0, 20]);
    ch_plus.extend(std::iter::repeat_n(0xaa, 20));
    // a QUIC handshake: the ClientHello message and the server's Handshake-level flight
    let mut qc = QuicConnection::new_client(ccfg.clone(), "localhost", vec![1, 2, 3]).unwrap();
    let mut qs = QuicConnection::new_server(scfg.clone(), vec![4, 5, 6]);
    let mut ch_msg = Vec::new();
    qc.write_handshake(&mut ch_msg);
    qs.read_handshake(Level::Initial, &ch_msg).unwrap();
    let mut sh = Vec::new();
    qs.write_handshake(&mut sh);
    let mut hs = Vec::new();
    qs.write_handshake(&mut hs);
    Corpus {
        scfg,
        ccfg,
        to_server: vec![ch, ch_plus],
        to_client: vec![flight],
        ch_msg,
        server_hs_flight: hs,
        key_der: ss.key_der.clone(),
        cert_der: ss.cert_der,
    }
}

/// Feeds `data` in random-sized pieces and processes after each; checks that errors stick.
fn feed(rng: &mut Rng, conn: &mut simoom_tls::Connection, data: &[u8]) {
    let mut off = 0;
    while off < data.len() {
        let k = 1 + rng.below(data.len() - off);
        let taken = conn.read_tls(&data[off..off + k]);
        off += taken;
        let r = conn.process_new_packets();
        if let Err(e) = r {
            assert_eq!(conn.process_new_packets().unwrap_err(), e, "errors must stick");
            assert!(conn.tls_output().len() < 64 * 1024, "output stays bounded");
            assert!(conn.write_plaintext(b"x").is_err(), "a failed connection refuses writes");
            return;
        }
        if taken == 0 {
            // buffer full: the application reads plaintext
            let n = conn.plaintext().len();
            if n == 0 {
                return;
            }
            conn.consume_plaintext(n);
        }
    }
}

pub fn server_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let seed = &c.to_server[rng.below(c.to_server.len())];
        let data = mutate(rng, seed, &c.to_client);
        let mut s = ServerConnection::new(c.scfg.clone());
        feed(rng, &mut s, &data);
    }
}

pub fn client_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let data = mutate(rng, &c.to_client[0], &c.to_server);
        let mut cl = ClientConnection::new(c.ccfg.clone(), "localhost").unwrap();
        let n = cl.tls_output().len();
        cl.consume_tls_output(n);
        feed(rng, &mut cl, &data);
    }
}

/// ClientHello parsing (and everything the server does with it) without the record layer.
pub fn quic_server_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let m = mutate(rng, &c.ch_msg, &[]);
        let mut s = QuicConnection::new_server(c.scfg.clone(), vec![9]);
        if s.read_handshake(Level::Initial, &m).is_err() {
            assert!(s.tls_alert().is_some());
        }
        let mut out = Vec::new();
        while s.write_handshake(&mut out).is_some() {}
    }
}

/// EncryptedExtensions, Certificate (X.509), CertificateVerify and Finished parsing on the
/// client: a real ServerHello, then a mutated Handshake-level flight.
pub fn quic_client_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let mut qc = QuicConnection::new_client(c.ccfg.clone(), "localhost", vec![1]).unwrap();
        let mut qs = QuicConnection::new_server(c.scfg.clone(), vec![2]);
        let mut ch = Vec::new();
        qc.write_handshake(&mut ch);
        qs.read_handshake(Level::Initial, &ch).unwrap();
        let mut sh = Vec::new();
        qs.write_handshake(&mut sh);
        let mut hs = Vec::new();
        qs.write_handshake(&mut hs);
        qc.read_handshake(Level::Initial, &sh).unwrap();
        let mut ignore = Vec::new();
        qc.write_handshake(&mut ignore);
        let m = mutate(rng, &hs, &[c.cert_der.clone()]);
        let _ = qc.read_handshake(Level::Handshake, &m);
    }
}

pub fn new_client( cfg: Arc<ClientConfig>, server_name: &str, transport_params: Vec<u8>, ) -> Result<QuicConnection>

A client; the ClientHello is ready for the first write_handshake. The configuration must have ALPN protocols.

Examples found in repository

examples/../tests/fuzzing/mod.rs (line 142)

pub fn corpus() -> Corpus {
    let ss = certgen::issue(&CertParams::server(&["localhost"]), PrivateKey::generate_ec(EcCurve::P256), None);
    let mut roots = RootStore::empty();
    roots.add_der(&ss.cert_der).unwrap();
    let scfg = Arc::new(ServerConfig::new(CertifiedKey::new(vec![ss.cert_der.clone()], ss.key.clone()).unwrap()).with_alpn(&[b"h3", b"http/1.1"]));
    let mut cc = ClientConfig::new(roots).with_alpn(&[b"h3", b"http/1.1"]);
    cc.sessions = None;
    let ccfg = Arc::new(cc);
    // a TLS handshake transcript
    let mut c = ClientConnection::new(ccfg.clone(), "localhost").unwrap();
    let mut s = ServerConnection::new(scfg.clone());
    let ch = c.tls_output().to_vec();
    c.consume_tls_output(ch.len());
    s.read_tls(&ch);
    s.process_new_packets().unwrap();
    let flight = s.tls_output().to_vec();
    let mut ch_plus = ch.clone();
    ch_plus.extend_from_slice(&[20, 3, 3, 0, 1, 1, 23, 3, 3, 0, 20]);
    ch_plus.extend(std::iter::repeat_n(0xaa, 20));
    // a QUIC handshake: the ClientHello message and the server's Handshake-level flight
    let mut qc = QuicConnection::new_client(ccfg.clone(), "localhost", vec![1, 2, 3]).unwrap();
    let mut qs = QuicConnection::new_server(scfg.clone(), vec![4, 5, 6]);
    let mut ch_msg = Vec::new();
    qc.write_handshake(&mut ch_msg);
    qs.read_handshake(Level::Initial, &ch_msg).unwrap();
    let mut sh = Vec::new();
    qs.write_handshake(&mut sh);
    let mut hs = Vec::new();
    qs.write_handshake(&mut hs);
    Corpus {
        scfg,
        ccfg,
        to_server: vec![ch, ch_plus],
        to_client: vec![flight],
        ch_msg,
        server_hs_flight: hs,
        key_der: ss.key_der.clone(),
        cert_der: ss.cert_der,
    }
}

/// Feeds `data` in random-sized pieces and processes after each; checks that errors stick.
fn feed(rng: &mut Rng, conn: &mut simoom_tls::Connection, data: &[u8]) {
    let mut off = 0;
    while off < data.len() {
        let k = 1 + rng.below(data.len() - off);
        let taken = conn.read_tls(&data[off..off + k]);
        off += taken;
        let r = conn.process_new_packets();
        if let Err(e) = r {
            assert_eq!(conn.process_new_packets().unwrap_err(), e, "errors must stick");
            assert!(conn.tls_output().len() < 64 * 1024, "output stays bounded");
            assert!(conn.write_plaintext(b"x").is_err(), "a failed connection refuses writes");
            return;
        }
        if taken == 0 {
            // buffer full: the application reads plaintext
            let n = conn.plaintext().len();
            if n == 0 {
                return;
            }
            conn.consume_plaintext(n);
        }
    }
}

pub fn server_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let seed = &c.to_server[rng.below(c.to_server.len())];
        let data = mutate(rng, seed, &c.to_client);
        let mut s = ServerConnection::new(c.scfg.clone());
        feed(rng, &mut s, &data);
    }
}

pub fn client_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let data = mutate(rng, &c.to_client[0], &c.to_server);
        let mut cl = ClientConnection::new(c.ccfg.clone(), "localhost").unwrap();
        let n = cl.tls_output().len();
        cl.consume_tls_output(n);
        feed(rng, &mut cl, &data);
    }
}

/// ClientHello parsing (and everything the server does with it) without the record layer.
pub fn quic_server_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let m = mutate(rng, &c.ch_msg, &[]);
        let mut s = QuicConnection::new_server(c.scfg.clone(), vec![9]);
        if s.read_handshake(Level::Initial, &m).is_err() {
            assert!(s.tls_alert().is_some());
        }
        let mut out = Vec::new();
        while s.write_handshake(&mut out).is_some() {}
    }
}

/// EncryptedExtensions, Certificate (X.509), CertificateVerify and Finished parsing on the
/// client: a real ServerHello, then a mutated Handshake-level flight.
pub fn quic_client_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let mut qc = QuicConnection::new_client(c.ccfg.clone(), "localhost", vec![1]).unwrap();
        let mut qs = QuicConnection::new_server(c.scfg.clone(), vec![2]);
        let mut ch = Vec::new();
        qc.write_handshake(&mut ch);
        qs.read_handshake(Level::Initial, &ch).unwrap();
        let mut sh = Vec::new();
        qs.write_handshake(&mut sh);
        let mut hs = Vec::new();
        qs.write_handshake(&mut hs);
        qc.read_handshake(Level::Initial, &sh).unwrap();
        let mut ignore = Vec::new();
        qc.write_handshake(&mut ignore);
        let m = mutate(rng, &hs, &[c.cert_der.clone()]);
        let _ = qc.read_handshake(Level::Handshake, &m);
    }
}

pub fn set_version(&mut self, version: u32)

Selects the QUIC version whose key labels are used (default VERSION_1); set it before the first key change.

pub fn read_handshake(&mut self, level: Level, data: &[u8]) -> Result<()>

Feeds CRYPTO frame data received at level, in order.

Examples found in repository

examples/../tests/fuzzing/mod.rs (line 146)

pub fn corpus() -> Corpus {
    let ss = certgen::issue(&CertParams::server(&["localhost"]), PrivateKey::generate_ec(EcCurve::P256), None);
    let mut roots = RootStore::empty();
    roots.add_der(&ss.cert_der).unwrap();
    let scfg = Arc::new(ServerConfig::new(CertifiedKey::new(vec![ss.cert_der.clone()], ss.key.clone()).unwrap()).with_alpn(&[b"h3", b"http/1.1"]));
    let mut cc = ClientConfig::new(roots).with_alpn(&[b"h3", b"http/1.1"]);
    cc.sessions = None;
    let ccfg = Arc::new(cc);
    // a TLS handshake transcript
    let mut c = ClientConnection::new(ccfg.clone(), "localhost").unwrap();
    let mut s = ServerConnection::new(scfg.clone());
    let ch = c.tls_output().to_vec();
    c.consume_tls_output(ch.len());
    s.read_tls(&ch);
    s.process_new_packets().unwrap();
    let flight = s.tls_output().to_vec();
    let mut ch_plus = ch.clone();
    ch_plus.extend_from_slice(&[20, 3, 3, 0, 1, 1, 23, 3, 3, 0, 20]);
    ch_plus.extend(std::iter::repeat_n(0xaa, 20));
    // a QUIC handshake: the ClientHello message and the server's Handshake-level flight
    let mut qc = QuicConnection::new_client(ccfg.clone(), "localhost", vec![1, 2, 3]).unwrap();
    let mut qs = QuicConnection::new_server(scfg.clone(), vec![4, 5, 6]);
    let mut ch_msg = Vec::new();
    qc.write_handshake(&mut ch_msg);
    qs.read_handshake(Level::Initial, &ch_msg).unwrap();
    let mut sh = Vec::new();
    qs.write_handshake(&mut sh);
    let mut hs = Vec::new();
    qs.write_handshake(&mut hs);
    Corpus {
        scfg,
        ccfg,
        to_server: vec![ch, ch_plus],
        to_client: vec![flight],
        ch_msg,
        server_hs_flight: hs,
        key_der: ss.key_der.clone(),
        cert_der: ss.cert_der,
    }
}

/// Feeds `data` in random-sized pieces and processes after each; checks that errors stick.
fn feed(rng: &mut Rng, conn: &mut simoom_tls::Connection, data: &[u8]) {
    let mut off = 0;
    while off < data.len() {
        let k = 1 + rng.below(data.len() - off);
        let taken = conn.read_tls(&data[off..off + k]);
        off += taken;
        let r = conn.process_new_packets();
        if let Err(e) = r {
            assert_eq!(conn.process_new_packets().unwrap_err(), e, "errors must stick");
            assert!(conn.tls_output().len() < 64 * 1024, "output stays bounded");
            assert!(conn.write_plaintext(b"x").is_err(), "a failed connection refuses writes");
            return;
        }
        if taken == 0 {
            // buffer full: the application reads plaintext
            let n = conn.plaintext().len();
            if n == 0 {
                return;
            }
            conn.consume_plaintext(n);
        }
    }
}

pub fn server_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let seed = &c.to_server[rng.below(c.to_server.len())];
        let data = mutate(rng, seed, &c.to_client);
        let mut s = ServerConnection::new(c.scfg.clone());
        feed(rng, &mut s, &data);
    }
}

pub fn client_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let data = mutate(rng, &c.to_client[0], &c.to_server);
        let mut cl = ClientConnection::new(c.ccfg.clone(), "localhost").unwrap();
        let n = cl.tls_output().len();
        cl.consume_tls_output(n);
        feed(rng, &mut cl, &data);
    }
}

/// ClientHello parsing (and everything the server does with it) without the record layer.
pub fn quic_server_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let m = mutate(rng, &c.ch_msg, &[]);
        let mut s = QuicConnection::new_server(c.scfg.clone(), vec![9]);
        if s.read_handshake(Level::Initial, &m).is_err() {
            assert!(s.tls_alert().is_some());
        }
        let mut out = Vec::new();
        while s.write_handshake(&mut out).is_some() {}
    }
}

/// EncryptedExtensions, Certificate (X.509), CertificateVerify and Finished parsing on the
/// client: a real ServerHello, then a mutated Handshake-level flight.
pub fn quic_client_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let mut qc = QuicConnection::new_client(c.ccfg.clone(), "localhost", vec![1]).unwrap();
        let mut qs = QuicConnection::new_server(c.scfg.clone(), vec![2]);
        let mut ch = Vec::new();
        qc.write_handshake(&mut ch);
        qs.read_handshake(Level::Initial, &ch).unwrap();
        let mut sh = Vec::new();
        qs.write_handshake(&mut sh);
        let mut hs = Vec::new();
        qs.write_handshake(&mut hs);
        qc.read_handshake(Level::Initial, &sh).unwrap();
        let mut ignore = Vec::new();
        qc.write_handshake(&mut ignore);
        let m = mutate(rng, &hs, &[c.cert_der.clone()]);
        let _ = qc.read_handshake(Level::Handshake, &m);
    }
}

pub fn write_level(&self) -> Level

The level of the bytes the next write_handshake appends.

pub fn write_handshake(&mut self, out: &mut Vec<u8>) -> Option<KeyChange>

Appends handshake bytes to send at write_level; returns a key change when one is due, after which the write level has advanced.

Examples found in repository

examples/../tests/fuzzing/mod.rs (line 145)

pub fn corpus() -> Corpus {
    let ss = certgen::issue(&CertParams::server(&["localhost"]), PrivateKey::generate_ec(EcCurve::P256), None);
    let mut roots = RootStore::empty();
    roots.add_der(&ss.cert_der).unwrap();
    let scfg = Arc::new(ServerConfig::new(CertifiedKey::new(vec![ss.cert_der.clone()], ss.key.clone()).unwrap()).with_alpn(&[b"h3", b"http/1.1"]));
    let mut cc = ClientConfig::new(roots).with_alpn(&[b"h3", b"http/1.1"]);
    cc.sessions = None;
    let ccfg = Arc::new(cc);
    // a TLS handshake transcript
    let mut c = ClientConnection::new(ccfg.clone(), "localhost").unwrap();
    let mut s = ServerConnection::new(scfg.clone());
    let ch = c.tls_output().to_vec();
    c.consume_tls_output(ch.len());
    s.read_tls(&ch);
    s.process_new_packets().unwrap();
    let flight = s.tls_output().to_vec();
    let mut ch_plus = ch.clone();
    ch_plus.extend_from_slice(&[20, 3, 3, 0, 1, 1, 23, 3, 3, 0, 20]);
    ch_plus.extend(std::iter::repeat_n(0xaa, 20));
    // a QUIC handshake: the ClientHello message and the server's Handshake-level flight
    let mut qc = QuicConnection::new_client(ccfg.clone(), "localhost", vec![1, 2, 3]).unwrap();
    let mut qs = QuicConnection::new_server(scfg.clone(), vec![4, 5, 6]);
    let mut ch_msg = Vec::new();
    qc.write_handshake(&mut ch_msg);
    qs.read_handshake(Level::Initial, &ch_msg).unwrap();
    let mut sh = Vec::new();
    qs.write_handshake(&mut sh);
    let mut hs = Vec::new();
    qs.write_handshake(&mut hs);
    Corpus {
        scfg,
        ccfg,
        to_server: vec![ch, ch_plus],
        to_client: vec![flight],
        ch_msg,
        server_hs_flight: hs,
        key_der: ss.key_der.clone(),
        cert_der: ss.cert_der,
    }
}

/// Feeds `data` in random-sized pieces and processes after each; checks that errors stick.
fn feed(rng: &mut Rng, conn: &mut simoom_tls::Connection, data: &[u8]) {
    let mut off = 0;
    while off < data.len() {
        let k = 1 + rng.below(data.len() - off);
        let taken = conn.read_tls(&data[off..off + k]);
        off += taken;
        let r = conn.process_new_packets();
        if let Err(e) = r {
            assert_eq!(conn.process_new_packets().unwrap_err(), e, "errors must stick");
            assert!(conn.tls_output().len() < 64 * 1024, "output stays bounded");
            assert!(conn.write_plaintext(b"x").is_err(), "a failed connection refuses writes");
            return;
        }
        if taken == 0 {
            // buffer full: the application reads plaintext
            let n = conn.plaintext().len();
            if n == 0 {
                return;
            }
            conn.consume_plaintext(n);
        }
    }
}

pub fn server_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let seed = &c.to_server[rng.below(c.to_server.len())];
        let data = mutate(rng, seed, &c.to_client);
        let mut s = ServerConnection::new(c.scfg.clone());
        feed(rng, &mut s, &data);
    }
}

pub fn client_records(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let data = mutate(rng, &c.to_client[0], &c.to_server);
        let mut cl = ClientConnection::new(c.ccfg.clone(), "localhost").unwrap();
        let n = cl.tls_output().len();
        cl.consume_tls_output(n);
        feed(rng, &mut cl, &data);
    }
}

/// ClientHello parsing (and everything the server does with it) without the record layer.
pub fn quic_server_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let m = mutate(rng, &c.ch_msg, &[]);
        let mut s = QuicConnection::new_server(c.scfg.clone(), vec![9]);
        if s.read_handshake(Level::Initial, &m).is_err() {
            assert!(s.tls_alert().is_some());
        }
        let mut out = Vec::new();
        while s.write_handshake(&mut out).is_some() {}
    }
}

/// EncryptedExtensions, Certificate (X.509), CertificateVerify and Finished parsing on the
/// client: a real ServerHello, then a mutated Handshake-level flight.
pub fn quic_client_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let mut qc = QuicConnection::new_client(c.ccfg.clone(), "localhost", vec![1]).unwrap();
        let mut qs = QuicConnection::new_server(c.scfg.clone(), vec![2]);
        let mut ch = Vec::new();
        qc.write_handshake(&mut ch);
        qs.read_handshake(Level::Initial, &ch).unwrap();
        let mut sh = Vec::new();
        qs.write_handshake(&mut sh);
        let mut hs = Vec::new();
        qs.write_handshake(&mut hs);
        qc.read_handshake(Level::Initial, &sh).unwrap();
        let mut ignore = Vec::new();
        qc.write_handshake(&mut ignore);
        let m = mutate(rng, &hs, &[c.cert_der.clone()]);
        let _ = qc.read_handshake(Level::Handshake, &m);
    }
}

pub fn is_handshaking(&self) -> bool

pub fn peer_transport_params(&self) -> Option<&[u8]>

The peer’s transport_parameters extension body.

pub fn alpn_protocol(&self) -> Option<&[u8]>

pub fn negotiated_cipher_suite(&self) -> Option<CipherSuite>

pub fn server_name(&self) -> Option<&str>

pub fn peer_certificates(&self) -> &[Vec<u8>]

pub fn is_resumed(&self) -> bool

pub fn tls_alert(&self) -> Option<u64>

The QUIC CRYPTO_ERROR code (0x100 + TLS alert) after a handshake failure.

Examples found in repository

examples/../tests/fuzzing/mod.rs (line 213)

pub fn quic_server_messages(rng: &mut Rng, c: &Corpus, iters: usize) {
    for _ in 0..iters {
        let m = mutate(rng, &c.ch_msg, &[]);
        let mut s = QuicConnection::new_server(c.scfg.clone(), vec![9]);
        if s.read_handshake(Level::Initial, &m).is_err() {
            assert!(s.tls_alert().is_some());
        }
        let mut out = Vec::new();
        while s.write_handshake(&mut out).is_some() {}
    }
}

Trait Implementations

impl Debug for QuicConnection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.