FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: update ngtcp2 to 1.19.0 · nodejs/node@9a3f690 · GitHub

deps: update ngtcp2 to 1.19.0 · nodejs/node@9a3f690 · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 9a3f690

Browse files
nodejs-github-bot
authored and
aduh95
committed
deps: update ngtcp2 to 1.19.0
PR-URL: #61156 Backport-PR-URL: #64675 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent ff485a9 commit 9a3f690

138 files changed

Lines changed: 5616 additions & 18518 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/ngtcp2/ngtcp2.gyp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
'ngtcp2/lib/ngtcp2_cc.c',
1414
'ngtcp2/lib/ngtcp2_cid.c',
1515
'ngtcp2/lib/ngtcp2_conn.c',
16+
'ngtcp2/lib/ngtcp2_conn_info.c',
1617
'ngtcp2/lib/ngtcp2_conv.c',
1718
'ngtcp2/lib/ngtcp2_crypto.c',
1819
'ngtcp2/lib/ngtcp2_dcidtr.c',

‎deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
627627
* @macro
628628
*
629629
* :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
630-
* of a token generated by `ngtcp2_crypto_generate_regular_token`.
630+
* of a token generated by `ngtcp2_crypto_generate_regular_token`.
631+
* `ngtcp2_crypto_generate_regular_token2` generates a token of length
632+
* at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
633+
* length of the provided opaque data.
631634
*/
632635
#define NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
633636
(/* magic = */ 1 + sizeof(ngtcp2_tstamp) + /* aead tag = */ 16 + \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
787790
size_t secretlen, const ngtcp2_sockaddr *remote_addr,
788791
ngtcp2_socklen remote_addrlen, ngtcp2_duration timeout, ngtcp2_tstamp ts);
789792

793+
/**
794+
* @function
795+
*
796+
* `ngtcp2_crypto_generate_regular_token2` generates a token in the
797+
* buffer pointed by |token| that is sent with NEW_TOKEN frame. The
798+
* buffer pointed by |token| must have at least
799+
* :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
800+
* The successfully generated token starts with
801+
* :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
802+
* |secretlen| is a keying material to generate keys to encrypt the
803+
* token. |remote_addr| of length |remote_addrlen| is an address of
804+
* client. |ts| is the timestamp when the token is generated. |data|
805+
* of length |datalen| is an opaque data embedded in the token.
806+
* |datalen| must be less than or equal to 256.
807+
*
808+
* Calling this function with |datalen| = 0 is equivalent to calling
809+
* `ngtcp2_crypto_generate_regular_token`.
810+
*
811+
* To get the opaque data after successful verification, use
812+
* `ngtcp2_crypto_verify_regular_token2`.
813+
* `ngtcp2_crypto_verify_regular_token` can verify the token with
814+
* |datalen| > 0, but it discards the opaque data.
815+
*
816+
* This function returns the length of generated token if it succeeds,
817+
* or -1.
818+
*/
819+
NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_generate_regular_token2(
820+
uint8_t *token, const uint8_t *secret, size_t secretlen,
821+
const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen,
822+
const void *data, size_t datalen, ngtcp2_tstamp ts);
823+
824+
/**
825+
* @function
826+
*
827+
* `ngtcp2_crypto_verify_regular_token2` verifies a regular token
828+
* stored in the buffer pointed by |token| of length |tokenlen|.
829+
* |secret| of length |secretlen| is a keying material to generate
830+
* keys to decrypt the token. |remote_addr| of length
831+
* |remote_addrlen| is an address of client. |timeout| is the period
832+
* during which the token is valid. |ts| is the current timestamp.
833+
* |data| is the pointer to the buffer of length at least
834+
* |max_datalen| bytes. If the token is verified successfully, the
835+
* opaque data embedded in the token is copied to the buffer pointed
836+
* by |data|.
837+
*
838+
* If |tokenlen| is less than
839+
* :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
840+
* :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
841+
*
842+
* If the length of opaque data is larger than |max_datalen|, the
843+
* verification still succeeds, but nothing is written to the buffer
844+
* pointed by |data|, and this function returns 0. In other words,
845+
* the opaque data is discarded.
846+
*
847+
* This function returns the number of the opaque data written to the
848+
* buffer pointed by |data| if it succeeds, or one of the following
849+
* negative error codes:
850+
*
851+
* :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
852+
* A token is badly formatted; or verifying the integrity
853+
* protection failed.
854+
* :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
855+
* A token validity has expired.
856+
* :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
857+
* Internal error occurred.
858+
*/
859+
NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_verify_regular_token2(
860+
void *data, size_t max_datalen, const uint8_t *token, size_t tokenlen,
861+
const uint8_t *secret, size_t secretlen, const ngtcp2_sockaddr *remote_addr,
862+
ngtcp2_socklen remote_addrlen, ngtcp2_duration timeout, ngtcp2_tstamp ts);
863+
790864
/**
791865
* @function
792866
*

‎deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c‎

Lines changed: 41 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -41,70 +41,40 @@
4141
#include "ngtcp2_macro.h"
4242
#include "shared.h"
4343

44-
static int crypto_initialized;
44+
#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
45+
# define NGTCP2_NO_CHACHA_POLY1305
46+
#endif /* defined(OPENSSL_NO_CHACHA) || \
47+
defined(OPENSSL_NO_POLY1305) */
48+
4549
static EVP_CIPHER *crypto_aes_128_gcm;
4650
static EVP_CIPHER *crypto_aes_256_gcm;
47-
static EVP_CIPHER *crypto_chacha20_poly1305;
4851
static EVP_CIPHER *crypto_aes_128_ccm;
4952
static EVP_CIPHER *crypto_aes_128_ctr;
5053
static EVP_CIPHER *crypto_aes_256_ctr;
54+
#ifndef NGTCP2_NO_CHACHA_POLY1305
55+
static EVP_CIPHER *crypto_chacha20_poly1305;
5156
static EVP_CIPHER *crypto_chacha20;
57+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
5258
static EVP_MD *crypto_sha256;
5359
static EVP_MD *crypto_sha384;
5460
static EVP_KDF *crypto_hkdf;
5561

5662
int ngtcp2_crypto_ossl_init(void) {
63+
/* We do not care whether the pre-fetch succeeds or not. If it
64+
fails, it returns NULL, which is still the default value, and our
65+
code should still work with it. */
5766
crypto_aes_128_gcm = EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
58-
if (crypto_aes_128_gcm == NULL) {
59-
return -1;
60-
}
61-
6267
crypto_aes_256_gcm = EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
63-
if (crypto_aes_256_gcm == NULL) {
64-
return -1;
65-
}
66-
67-
crypto_chacha20_poly1305 = EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
68-
if (crypto_chacha20_poly1305 == NULL) {
69-
return -1;
70-
}
71-
7268
crypto_aes_128_ccm = EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
73-
if (crypto_aes_128_ccm == NULL) {
74-
return -1;
75-
}
76-
7769
crypto_aes_128_ctr = EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
78-
if (crypto_aes_128_ctr == NULL) {
79-
return -1;
80-
}
81-
8270
crypto_aes_256_ctr = EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
83-
if (crypto_aes_256_ctr == NULL) {
84-
return -1;
85-
}
86-
71+
#ifndef NGTCP2_NO_CHACHA_POLY1305
72+
crypto_chacha20_poly1305 = EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
8773
crypto_chacha20 = EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
88-
if (crypto_chacha20 == NULL) {
89-
return -1;
90-
}
91-
74+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
9275
crypto_sha256 = EVP_MD_fetch(NULL, "sha256", NULL);
93-
if (crypto_sha256 == NULL) {
94-
return -1;
95-
}
96-
9776
crypto_sha384 = EVP_MD_fetch(NULL, "sha384", NULL);
98-
if (crypto_sha384 == NULL) {
99-
return -1;
100-
}
101-
10277
crypto_hkdf = EVP_KDF_fetch(NULL, "hkdf", NULL);
103-
if (crypto_hkdf == NULL) {
104-
return -1;
105-
}
106-
107-
crypto_initialized = 1;
10878

10979
return 0;
11080
}
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
12595
return EVP_aes_256_gcm();
12696
}
12797

98+
#ifndef NGTCP2_NO_CHACHA_POLY1305
12899
static const EVP_CIPHER *crypto_aead_chacha20_poly1305(void) {
129100
if (crypto_chacha20_poly1305) {
130101
return crypto_chacha20_poly1305;
131102
}
132103

133104
return EVP_chacha20_poly1305();
134105
}
106+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
135107

136108
static const EVP_CIPHER *crypto_aead_aes_128_ccm(void) {
137109
if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
157129
return EVP_aes_256_ctr();
158130
}
159131

132+
#ifndef NGTCP2_NO_CHACHA_POLY1305
160133
static const EVP_CIPHER *crypto_cipher_chacha20(void) {
161134
if (crypto_chacha20) {
162135
return crypto_chacha20;
163136
}
164137

165138
return EVP_chacha20();
166139
}
140+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
167141

168142
static const EVP_MD *crypto_md_sha256(void) {
169143
if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
189163
return EVP_KDF_fetch(NULL, "hkdf", NULL);
190164
}
191165

166+
static void crypto_kdf_hkdf_free(EVP_KDF *kdf) {
167+
if (kdf && crypto_hkdf != kdf) {
168+
EVP_KDF_free(kdf);
169+
}
170+
}
171+
192172
static size_t crypto_aead_max_overhead(const EVP_CIPHER *aead) {
193173
switch (EVP_CIPHER_nid(aead)) {
194174
case NID_aes_128_gcm:
195175
case NID_aes_256_gcm:
196176
return EVP_GCM_TLS_TAG_LEN;
177+
#ifndef NGTCP2_NO_CHACHA_POLY1305
197178
case NID_chacha20_poly1305:
198179
return EVP_CHACHAPOLY_TLS_TAG_LEN;
180+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
199181
case NID_aes_128_ccm:
200182
return EVP_CCM_TLS_TAG_LEN;
201183
default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
239221
return crypto_aead_aes_128_gcm();
240222
case TLS1_3_CK_AES_256_GCM_SHA384:
241223
return crypto_aead_aes_256_gcm();
224+
#ifndef NGTCP2_NO_CHACHA_POLY1305
242225
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
243226
return crypto_aead_chacha20_poly1305();
227+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
244228
case TLS1_3_CK_AES_128_CCM_SHA256:
245229
return crypto_aead_aes_128_ccm();
246230
default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
253237
case TLS1_3_CK_AES_128_GCM_SHA256:
254238
case TLS1_3_CK_AES_256_GCM_SHA384:
255239
return NGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
240+
#ifndef NGTCP2_NO_CHACHA_POLY1305
256241
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
257242
return NGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
243+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
258244
case TLS1_3_CK_AES_128_CCM_SHA256:
259245
return NGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
260246
default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
268254
case TLS1_3_CK_AES_128_GCM_SHA256:
269255
case TLS1_3_CK_AES_256_GCM_SHA384:
270256
return NGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
257+
#ifndef NGTCP2_NO_CHACHA_POLY1305
271258
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
272259
return NGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
260+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
273261
case TLS1_3_CK_AES_128_CCM_SHA256:
274262
return NGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
275263
default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
284272
return crypto_cipher_aes_128_ctr();
285273
case TLS1_3_CK_AES_256_GCM_SHA384:
286274
return crypto_cipher_aes_256_ctr();
275+
#ifndef NGTCP2_NO_CHACHA_POLY1305
287276
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
288277
return crypto_cipher_chacha20();
278+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
289279
default:
290280
return NULL;
291281
}
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
294284
static const EVP_MD *crypto_cipher_id_get_md(uint32_t cipher_id) {
295285
switch (cipher_id) {
296286
case TLS1_3_CK_AES_128_GCM_SHA256:
287+
#ifndef NGTCP2_NO_CHACHA_POLY1305
297288
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
289+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
298290
case TLS1_3_CK_AES_128_CCM_SHA256:
299291
return crypto_md_sha256();
300292
case TLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
308300
switch (cipher_id) {
309301
case TLS1_3_CK_AES_128_GCM_SHA256:
310302
case TLS1_3_CK_AES_256_GCM_SHA384:
303+
#ifndef NGTCP2_NO_CHACHA_POLY1305
311304
case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
305+
#endif /* !defined(NGTCP2_NO_CHACHA_POLY1305) */
312306
case TLS1_3_CK_AES_128_CCM_SHA256:
313307
return 1;
314308
default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
697691
};
698692
int rv = 0;
699693

700-
if (!crypto_initialized) {
701-
EVP_KDF_free(kdf);
702-
}
694+
crypto_kdf_hkdf_free(kdf);
703695

704696
if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
705697
rv = -1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
730722
};
731723
int rv = 0;
732724

733-
if (!crypto_initialized) {
734-
EVP_KDF_free(kdf);
735-
}
725+
crypto_kdf_hkdf_free(kdf);
736726

737727
if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
738728
rv = -1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
763753
};
764754
int rv = 0;
765755

766-
if (!crypto_initialized) {
767-
EVP_KDF_free(kdf);
768-
}
756+
crypto_kdf_hkdf_free(kdf);
769757

770758
if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
771759
rv = -1;

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL