deps: update ngtcp2 to 1.19.0

PR-URL: #61156
Backport-PR-URL: #64675
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Author: nodejs-github-bot

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;

deps/ngtcp2/ngtcp2.gyp

@@ -13,6 +13,7 @@
 'ngtcp2/lib/ngtcp2_cc.c',
 'ngtcp2/lib/ngtcp2_cid.c',
 'ngtcp2/lib/ngtcp2_conn.c',
+'ngtcp2/lib/ngtcp2_conn_info.c',
 'ngtcp2/lib/ngtcp2_conv.c',
 'ngtcp2/lib/ngtcp2_crypto.c',
 'ngtcp2/lib/ngtcp2_dcidtr.c',

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -627,7 +627,10 @@ NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token(
  * @macro
  *
  * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length
- * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * of a token generated by `ngtcp2_crypto_generate_regular_token`.
+ * `ngtcp2_crypto_generate_regular_token2` generates a token of length
+ * at most :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes + the
+ * length of the provided opaque data.
  */
 #defineNGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \
  (/* magic = */1+sizeof(ngtcp2_tstamp) +/* aead tag = */16+ \
@@ -787,6 +790,77 @@ NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token(
 size_tsecretlen, constngtcp2_sockaddr*remote_addr,
 ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
 
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_generate_regular_token2` generates a token in the
+ * buffer pointed by |token| that is sent with NEW_TOKEN frame. The
+ * buffer pointed by |token| must have at least
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` + |datalen| bytes long.
+ * The successfully generated token starts with
+ * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length
+ * |secretlen| is a keying material to generate keys to encrypt the
+ * token. |remote_addr| of length |remote_addrlen| is an address of
+ * client. |ts| is the timestamp when the token is generated. |data|
+ * of length |datalen| is an opaque data embedded in the token.
+ * |datalen| must be less than or equal to 256.
+ *
+ * Calling this function with |datalen| = 0 is equivalent to calling
+ * `ngtcp2_crypto_generate_regular_token`.
+ *
+ * To get the opaque data after successful verification, use
+ * `ngtcp2_crypto_verify_regular_token2`.
+ * `ngtcp2_crypto_verify_regular_token` can verify the token with
+ * |datalen| > 0, but it discards the opaque data.
+ *
+ * This function returns the length of generated token if it succeeds,
+ * or -1.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_generate_regular_token2(
+uint8_t*token, constuint8_t*secret, size_tsecretlen,
+constngtcp2_sockaddr*remote_addr, ngtcp2_socklenremote_addrlen,
+constvoid*data, size_tdatalen, ngtcp2_tstampts);
+
+/**
+ * @function
+ *
+ * `ngtcp2_crypto_verify_regular_token2` verifies a regular token
+ * stored in the buffer pointed by |token| of length |tokenlen|.
+ * |secret| of length |secretlen| is a keying material to generate
+ * keys to decrypt the token. |remote_addr| of length
+ * |remote_addrlen| is an address of client. |timeout| is the period
+ * during which the token is valid. |ts| is the current timestamp.
+ * |data| is the pointer to the buffer of length at least
+ * |max_datalen| bytes. If the token is verified successfully, the
+ * opaque data embedded in the token is copied to the buffer pointed
+ * by |data|.
+ *
+ * If |tokenlen| is less than
+ * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN`, this function returns
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`.
+ *
+ * If the length of opaque data is larger than |max_datalen|, the
+ * verification still succeeds, but nothing is written to the buffer
+ * pointed by |data|, and this function returns 0. In other words,
+ * the opaque data is discarded.
+ *
+ * This function returns the number of the opaque data written to the
+ * buffer pointed by |data| if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN`
+ * A token is badly formatted; or verifying the integrity
+ * protection failed.
+ * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN`
+ * A token validity has expired.
+ * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL`
+ * Internal error occurred.
+ */
+NGTCP2_EXTERNngtcp2_ssizengtcp2_crypto_verify_regular_token2(
+void*data, size_tmax_datalen, constuint8_t*token, size_ttokenlen,
+constuint8_t*secret, size_tsecretlen, constngtcp2_sockaddr*remote_addr,
+ngtcp2_socklenremote_addrlen, ngtcp2_durationtimeout, ngtcp2_tstampts);
+
 /**
  * @function
  *

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -41,70 +41,40 @@
 #include"ngtcp2_macro.h"
 #include"shared.h"
 
-staticintcrypto_initialized;
+#if defined(OPENSSL_NO_CHACHA) || defined(OPENSSL_NO_POLY1305)
+# defineNGTCP2_NO_CHACHA_POLY1305
+#endif/* defined(OPENSSL_NO_CHACHA) || \
+ defined(OPENSSL_NO_POLY1305) */
+
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
-staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_aes_128_ccm;
 staticEVP_CIPHER*crypto_aes_128_ctr;
 staticEVP_CIPHER*crypto_aes_256_ctr;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+staticEVP_CIPHER*crypto_chacha20_poly1305;
 staticEVP_CIPHER*crypto_chacha20;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 staticEVP_MD*crypto_sha256;
 staticEVP_MD*crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_ossl_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
-crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ctr=EVP_CIPHER_fetch(NULL, "AES-128-CTR", NULL);
-if (crypto_aes_128_ctr==NULL) {
-return-1;
- }
-
 crypto_aes_256_ctr=EVP_CIPHER_fetch(NULL, "AES-256-CTR", NULL);
-if (crypto_aes_256_ctr==NULL) {
-return-1;
- }
-
+#ifndefNGTCP2_NO_CHACHA_POLY1305
+crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -125,13 +95,15 @@ static const EVP_CIPHER *crypto_aead_aes_256_gcm(void) {
 returnEVP_aes_256_gcm();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_aead_chacha20_poly1305(void) {
 if (crypto_chacha20_poly1305) {
 returncrypto_chacha20_poly1305;
  }
 
 returnEVP_chacha20_poly1305();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_CIPHER*crypto_aead_aes_128_ccm(void) {
 if (crypto_aes_128_ccm) {
@@ -157,13 +129,15 @@ static const EVP_CIPHER *crypto_cipher_aes_256_ctr(void) {
 returnEVP_aes_256_ctr();
 }
 
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 staticconstEVP_CIPHER*crypto_cipher_chacha20(void) {
 if (crypto_chacha20) {
 returncrypto_chacha20;
  }
 
 returnEVP_chacha20();
 }
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 
 staticconstEVP_MD*crypto_md_sha256(void) {
 if (crypto_sha256) {
@@ -189,13 +163,21 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
 
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
+
 staticsize_tcrypto_aead_max_overhead(constEVP_CIPHER*aead) {
 switch (EVP_CIPHER_nid(aead)) {
 caseNID_aes_128_gcm:
 caseNID_aes_256_gcm:
 returnEVP_GCM_TLS_TAG_LEN;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseNID_chacha20_poly1305:
 returnEVP_CHACHAPOLY_TLS_TAG_LEN;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseNID_aes_128_ccm:
 returnEVP_CCM_TLS_TAG_LEN;
 default:
@@ -239,8 +221,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_aead(uint32_t cipher_id) {
 returncrypto_aead_aes_128_gcm();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_aead_aes_256_gcm();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_aead_chacha20_poly1305();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_aead_aes_128_ccm();
 default:
@@ -253,8 +237,10 @@ static uint64_t crypto_cipher_id_get_aead_max_encryption(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_ENCRYPTION_AES_CCM;
 default:
@@ -268,8 +254,10 @@ crypto_cipher_id_get_aead_max_decryption_failure(uint32_t cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_GCM;
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_CHACHA20_POLY1305;
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returnNGTCP2_CRYPTO_MAX_DECRYPTION_FAILURE_AES_CCM;
 default:
@@ -284,8 +272,10 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 returncrypto_cipher_aes_128_ctr();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
 returncrypto_cipher_aes_256_ctr();
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
 returncrypto_cipher_chacha20();
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 default:
 returnNULL;
  }
@@ -294,7 +284,9 @@ static const EVP_CIPHER *crypto_cipher_id_get_hp(uint32_t cipher_id) {
 staticconstEVP_MD*crypto_cipher_id_get_md(uint32_tcipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 returncrypto_md_sha256();
 caseTLS1_3_CK_AES_256_GCM_SHA384:
@@ -308,7 +300,9 @@ static int supported_cipher_id(uint32_t cipher_id) {
 switch (cipher_id) {
 caseTLS1_3_CK_AES_128_GCM_SHA256:
 caseTLS1_3_CK_AES_256_GCM_SHA384:
+#ifndefNGTCP2_NO_CHACHA_POLY1305
 caseTLS1_3_CK_CHACHA20_POLY1305_SHA256:
+#endif/* !defined(NGTCP2_NO_CHACHA_POLY1305) */
 caseTLS1_3_CK_AES_128_CCM_SHA256:
 return1;
 default:
@@ -697,9 +691,7 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
@@ -730,9 +722,7 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
@@ -763,9 +753,7 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
- }
+crypto_kdf_hkdf_free(kdf);
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;