Package io.github.mahmoudimus.quic.token

Class TokenValidator

java.lang.Object
io.github.mahmoudimus.quic.token.TokenValidator
public final class TokenValidator extends Object
Issues and checks a server's address validation tokens (RFC 9000 section 8.1): Retry tokens, bound to the client's address and port and valid for retryTokenLifetime, and NEW_TOKEN tokens, bound to its IP address, valid for validationTokenLifetime and logged against reuse.

A token the server cannot open is ignored, since it may come from another server or version (RFC 9000 section 8.1.3); but an authentic Retry token that does not match the client's address or has expired fails the connection with INVALID_TOKEN.

Wall-clock time comes from an injectable InstantSource, so tests can control expiry.

Threads. Safe to share if the TokenLog and random source are; the endpoint layer must serialize calls when they are not, as with BloomTokenLog.

  • Field Details

    • DEFAULT_RETRY_TOKEN_LIFETIME

      public static final Duration DEFAULT_RETRY_TOKEN_LIFETIME
      quinn's default Retry token lifetime, 15 seconds.

    • DEFAULT_VALIDATION_TOKEN_LIFETIME

      public static final Duration DEFAULT_VALIDATION_TOKEN_LIFETIME
      quinn's default NEW_TOKEN token lifetime, two weeks.

  • Constructor Details

    • TokenValidator

      public TokenValidator(TokenKey key, InstantSource clock, Duration retryTokenLifetime, Duration validationTokenLifetime, TokenLog log, RandomGenerator random)
      A validator.
      Parameters:
      key - the server's token key
      clock - the wall clock
      retryTokenLifetime - how long Retry tokens are valid
      validationTokenLifetime - how long NEW_TOKEN tokens are valid
      log - the reuse log for NEW_TOKEN tokens
      random - the source of nonces; a SecureRandom outside tests

  • Method Details

    • retryToken

      public byte[] retryToken(InetSocketAddress client, ConnectionId originalDestinationId)
      A token for a Retry packet.
      Parameters:
      client - the client's address and port
      originalDestinationId - the Destination Connection ID of the client's Initial
      Returns:
      the sealed token

    • validationToken

      public byte[] validationToken(InetAddress client)
      A token for a NEW_TOKEN frame. Send a fresh one when a NEW_TOKEN frame is lost, so a client that receives both cannot reuse one token twice.
      Parameters:
      client - the client's IP address
      Returns:
      the sealed token

    • validate

      public IncomingToken validate(byte[] token, ConnectionId destinationId, InetSocketAddress remote) throws QuicException
      Checks the token of a client's first Initial packet.
      Parameters:
      token - the token, empty if none
      destinationId - the Initial's Destination Connection ID
      remote - the client's address and port
      Returns:
      whether the address is validated, and the connection IDs to authenticate in the transport parameters
      Throws:
      QuicException - INVALID_TOKEN for an authentic Retry token from another address or past its lifetime