relnote: Adding FLAGS_require_handshake_confirmation to emergency-disable

net/quic/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 #include <algorithm>
 
 #include "base/stl_util.h"
@@ skipping 996 matching lines @@
     if (server_nonce_error == HANDSHAKE_OK) {
       info->unique = true;
     } else {
       info->reject_reasons.push_back(server_nonce_error);
       info->unique = false;
     }
     DVLOG(1) << "Using server nonce, unique: " << info->unique;
     helper.ValidationComplete(QUIC_NO_ERROR, "");
     return;
   }
+  // If we hit this block, the server nonce was empty.  If we're requiring
+  // handshake confirmation for DoS reasons and there's no server nonce present,
+  // reject the CHLO.
+  if (FLAGS_quic_require_handshake_confirmation) {
+    info->reject_reasons.push_back(SERVER_NONCE_REQUIRED_FAILURE);
+    helper.ValidationComplete(QUIC_NO_ERROR, "");
+    return;
+  }
 
   // We want to contact strike register only if there are no errors because it
   // is a RPC call and is expensive.
   if (found_error) {
     helper.ValidationComplete(QUIC_NO_ERROR, "");
     return;
   }
 
   // Use the client nonce to establish uniqueness.
   StrikeRegisterClient* strike_register_client;
@@ skipping 612 matching lines @@
 QuicCryptoServerConfig::Config::Config()
     : channel_id_enabled(false),
       is_primary(false),
       primary_time(QuicWallTime::Zero()),
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() { STLDeleteElements(&key_exchanges); }
 
 }  // namespace net