Interface QuicTokenHandler

All Known Implementing Classes:
InsecureQuicTokenHandler
public interface QuicTokenHandler
Handle token related operations.

  • Method Details

    • writeToken

      boolean writeToken(ByteBuf out, ByteBuf dcid, InetSocketAddress address)
      Generate a new token for the given destination connection id and address. This token is written to out. If no token should be generated and so no token validation should take place at all this method should return false.
      Parameters:
      out - ByteBuf into which the token will be written.
      dcid - the destination connection id. The ByteBuf.readableBytes() will be at most Quic.MAX_CONN_ID_LEN.
      address - the InetSocketAddress of the sender.
      Returns:
      true if a token was written and so validation should happen, false otherwise.

    • validateToken

      int validateToken(ByteBuf token, InetSocketAddress address)
      Validate the token and return the offset, -1 is returned if the token is not valid. The returned offset identifies where the ODCID starts in the token. Implementations that support tokens from NEW_TOKEN frames should override validateToken(ByteBuf, InetSocketAddress, ByteBuf).
      Parameters:
      token - the ByteBuf that contains the token. The caller retains ownership of the buffer: implementations must not release it and must retain, duplicate or copy it before using it after this method returns.
      address - the InetSocketAddress of the sender.
      Returns:
      the start index after the token or -1 if the token was not valid.

    • validateToken

      default QuicTokenHandler.TokenValidationResult validateToken(ByteBuf token, InetSocketAddress address, ByteBuf dcid)
      Validate the token and return a structured result that determines how the ODCID should be derived.

      RFC 9000 distinguishes tokens sent in Retry packets from tokens sent in NEW_TOKEN frames, and requires token construction to let the server identify how the token was provided to the client; see RFC 9000 Sections 8.1.1, 8.1.2 and 8.1.3.

      A token from a Retry packet, as described in RFC 9000 Section 8.1.2 and carried by the Retry packet in Section 17.2.5, validates the same connection attempt after the server selected a new connection id. In this case the result should identify the original destination connection id from the client's first Initial packet. Use QuicTokenHandler.TokenValidationResult.odcidFromToken(int) if the token stores that connection id as a suffix, which is the convention used by the legacy validateToken(ByteBuf, InetSocketAddress) method.

      A token from a NEW_TOKEN frame, as described in RFC 9000 Section 8.1.3, validates a future connection attempt. No Retry packet has been sent for that new attempt, so the original destination connection id is the destination connection id of the current Initial packet as described in RFC 9000 Section 7.2. Use QuicTokenHandler.TokenValidationResult.odcidFromDestinationConnectionId() for this case.

      Parameters:
      token - the ByteBuf that contains the token. The caller retains ownership of the buffer: implementations must not release it and must retain, duplicate or copy it before using it after this method returns.
      address - the InetSocketAddress of the sender.
      dcid - the destination connection id of the current Initial packet. The caller retains ownership of the buffer: implementations must not release it and must retain, duplicate or copy it before using it after this method returns.
      Returns:
      the validation result.

    • maxTokenLength

      int maxTokenLength()
      Return the maximal token length.
      Returns:
      the maximal supported token length.