Remove insecure QUIC support from Chromium.

net/quic/quic_stream_factory.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_stream_factory.h"
 
 #include <algorithm>
 #include <set>
 
 #include "base/location.h"
@@ skipping 105 matching lines @@
 QuicPacketWriter* DefaultPacketWriterFactory::Create(
     QuicConnection* connection) const {
   scoped_ptr<QuicDefaultPacketWriter> writer(
       new QuicDefaultPacketWriter(socket_));
   writer->SetConnection(connection);
   return writer.release();
 }
 
 }  // namespace
 
-QuicStreamFactory::IpAliasKey::IpAliasKey() {}
-
-QuicStreamFactory::IpAliasKey::IpAliasKey(IPEndPoint ip_endpoint,
-                                          bool is_https)
-    : ip_endpoint(ip_endpoint),
-      is_https(is_https) {}
-
-QuicStreamFactory::IpAliasKey::~IpAliasKey() {}
-
-bool QuicStreamFactory::IpAliasKey::operator<(
-    const QuicStreamFactory::IpAliasKey& other) const {
-  if (!(ip_endpoint == other.ip_endpoint)) {
-    return ip_endpoint < other.ip_endpoint;
-  }
-  return is_https < other.is_https;
-}
-
-bool QuicStreamFactory::IpAliasKey::operator==(
-    const QuicStreamFactory::IpAliasKey& other) const {
-  return is_https == other.is_https &&
-      ip_endpoint == other.ip_endpoint;
-};
-
 // Responsible for creating a new QUIC session to the specified server, and
 // for notifying any associated requests when complete.
 class QuicStreamFactory::Job {
  public:
   Job(QuicStreamFactory* factory,
       HostResolver* host_resolver,
       const HostPortPair& host_port_pair,
       bool server_and_origin_have_same_host,
-      bool is_https,
       bool was_alternative_service_recently_broken,
       PrivacyMode privacy_mode,
       int cert_verify_flags,
       bool is_post,
       QuicServerInfo* server_info,
       const BoundNetLog& net_log);
 
   // Creates a new job to handle the resumption of for connecting an
   // existing session.
   Job(QuicStreamFactory* factory,
@@ skipping 56 matching lines @@
   base::TimeTicks dns_resolution_start_time_;
   base::TimeTicks dns_resolution_end_time_;
   base::WeakPtrFactory<Job> weak_factory_;
   DISALLOW_COPY_AND_ASSIGN(Job);
 };
 
 QuicStreamFactory::Job::Job(QuicStreamFactory* factory,
                             HostResolver* host_resolver,
                             const HostPortPair& host_port_pair,
                             bool server_and_origin_have_same_host,
-                            bool is_https,
                             bool was_alternative_service_recently_broken,
                             PrivacyMode privacy_mode,
                             int cert_verify_flags,
                             bool is_post,
                             QuicServerInfo* server_info,
                             const BoundNetLog& net_log)
     : io_state_(STATE_RESOLVE_HOST),
       factory_(factory),
       host_resolver_(host_resolver),
-      server_id_(host_port_pair, is_https, privacy_mode),
+      server_id_(host_port_pair, /*is_https=*/true, privacy_mode),
       cert_verify_flags_(cert_verify_flags),
       server_and_origin_have_same_host_(server_and_origin_have_same_host),
       is_post_(is_post),
       was_alternative_service_recently_broken_(
           was_alternative_service_recently_broken),
       server_info_(server_info),
       started_another_job_(false),
       net_log_(net_log),
       session_(nullptr),
-      weak_factory_(this) {
-}
+      weak_factory_(this) {}
 
 QuicStreamFactory::Job::Job(QuicStreamFactory* factory,
                             HostResolver* host_resolver,
                             QuicChromiumClientSession* session,
                             QuicServerId server_id)
     : io_state_(STATE_RESUME_CONNECT),
       factory_(factory),
       host_resolver_(host_resolver),  // unused
       server_id_(server_id),
       cert_verify_flags_(0),                            // unused
@@ skipping 242 matching lines @@
 
 QuicStreamRequest::QuicStreamRequest(QuicStreamFactory* factory)
     : factory_(factory) {}
 
 QuicStreamRequest::~QuicStreamRequest() {
   if (factory_ && !callback_.is_null())
     factory_->CancelRequest(this);
 }
 
 int QuicStreamRequest::Request(const HostPortPair& host_port_pair,
-                               bool is_https,
                                PrivacyMode privacy_mode,
                                int cert_verify_flags,
                                base::StringPiece origin_host,
                                base::StringPiece method,
                                const BoundNetLog& net_log,
                                const CompletionCallback& callback) {
   DCHECK(!stream_);
   DCHECK(callback_.is_null());
   DCHECK(factory_);
   origin_host_ = origin_host.as_string();
   privacy_mode_ = privacy_mode;
-  int rv =
-      factory_->Create(host_port_pair, is_https, privacy_mode,
-                       cert_verify_flags, origin_host, method, net_log, this);
+  int rv = factory_->Create(host_port_pair, privacy_mode, cert_verify_flags,
+                            origin_host, method, net_log, this);
   if (rv == ERR_IO_PENDING) {
     host_port_pair_ = host_port_pair;
-    is_https_ = is_https;
     net_log_ = net_log;
     callback_ = callback;
   } else {
     factory_ = nullptr;
   }
   if (rv == OK)
     DCHECK(stream_);
   return rv;
 }
 
 void QuicStreamRequest::set_stream(scoped_ptr<QuicHttpStream> stream) {
   DCHECK(stream);
   stream_ = stream.Pass();
 }
 
 void QuicStreamRequest::OnRequestComplete(int rv) {
   factory_ = nullptr;
   callback_.Run(rv);
 }
 
 base::TimeDelta QuicStreamRequest::GetTimeDelayForWaitingJob() const {
   if (!factory_)
     return base::TimeDelta();
   return factory_->GetTimeDelayForWaitingJob(
-      QuicServerId(host_port_pair_, is_https_, privacy_mode_));
+      QuicServerId(host_port_pair_, /*is_https=*/true, privacy_mode_));
 }
 
 scoped_ptr<QuicHttpStream> QuicStreamRequest::ReleaseStream() {
   DCHECK(stream_);
   return stream_.Pass();
 }
 
 QuicStreamFactory::QuicStreamFactory(
     HostResolver* host_resolver,
     ClientSocketFactory* client_socket_factory,
@@ skipping 125 matching lines @@
   int64 srtt = 1.5 * GetServerNetworkStatsSmoothedRttInMicroseconds(server_id);
   // Picked 300ms based on mean time from
   // Net.QuicSession.HostResolution.HandshakeConfirmedTime histogram.
   const int kDefaultRTT = 300 * kNumMicrosPerMilli;
   if (!srtt)
     srtt = kDefaultRTT;
   return base::TimeDelta::FromMicroseconds(srtt);
 }
 
 int QuicStreamFactory::Create(const HostPortPair& host_port_pair,
-                              bool is_https,
                               PrivacyMode privacy_mode,
                               int cert_verify_flags,
                               base::StringPiece origin_host,
                               base::StringPiece method,
                               const BoundNetLog& net_log,
                               QuicStreamRequest* request) {
-  QuicServerId server_id(host_port_pair, is_https, privacy_mode);
+  QuicServerId server_id(host_port_pair, /*is_https=*/true, privacy_mode);
   SessionMap::iterator it = active_sessions_.find(server_id);
   if (it != active_sessions_.end()) {
     QuicChromiumClientSession* session = it->second;
     if (!session->CanPool(origin_host.as_string(), privacy_mode))
       return ERR_ALTERNATIVE_CERT_NOT_VALID_FOR_ORIGIN;
     request->set_stream(CreateFromSession(session));
     return OK;
   }
 
   if (HasActiveJob(server_id)) {
@@ skipping 19 matching lines @@
         // don't wait for Cache thread to load the data for that server.
         load_from_disk_cache = false;
       }
     }
     if (load_from_disk_cache && CryptoConfigCacheIsEmpty(server_id)) {
       quic_server_info = quic_server_info_factory_->GetForServer(server_id);
     }
   }
 
   bool server_and_origin_have_same_host = host_port_pair.host() == origin_host;
-  scoped_ptr<Job> job(new Job(this, host_resolver_, host_port_pair,
-                              server_and_origin_have_same_host, is_https,
-                              WasQuicRecentlyBroken(server_id), privacy_mode,
-                              cert_verify_flags, method == "POST" /* is_post */,
-                              quic_server_info, net_log));
+  scoped_ptr<Job> job(new Job(
+      this, host_resolver_, host_port_pair, server_and_origin_have_same_host,
+      WasQuicRecentlyBroken(server_id), privacy_mode, cert_verify_flags,
+      method == "POST" /* is_post */, quic_server_info, net_log));
   int rv = job->Run(base::Bind(&QuicStreamFactory::OnJobComplete,
                                base::Unretained(this), job.get()));
   if (rv == ERR_IO_PENDING) {
     active_requests_[request] = server_id;
     job_requests_map_[server_id].insert(request);
     active_jobs_[server_id].insert(job.release());
     return rv;
   }
   if (rv == OK) {
     it = active_sessions_.find(server_id);
     DCHECK(it != active_sessions_.end());
     QuicChromiumClientSession* session = it->second;
     if (!session->CanPool(origin_host.as_string(), privacy_mode))
       return ERR_ALTERNATIVE_CERT_NOT_VALID_FOR_ORIGIN;
     request->set_stream(CreateFromSession(session));
   }
   return rv;
 }
 
 void QuicStreamFactory::CreateAuxilaryJob(const QuicServerId server_id,
                                           int cert_verify_flags,
                                           bool server_and_origin_have_same_host,
                                           bool is_post,
                                           const BoundNetLog& net_log) {
-  Job* aux_job =
-      new Job(this, host_resolver_, server_id.host_port_pair(),
-              server_and_origin_have_same_host, server_id.is_https(),
-              WasQuicRecentlyBroken(server_id), server_id.privacy_mode(),
-              cert_verify_flags, is_post, nullptr, net_log);
+  Job* aux_job = new Job(
+      this, host_resolver_, server_id.host_port_pair(),
+      server_and_origin_have_same_host, WasQuicRecentlyBroken(server_id),
+      server_id.privacy_mode(), cert_verify_flags, is_post, nullptr, net_log);
   active_jobs_[server_id].insert(aux_job);
   task_runner_->PostTask(FROM_HERE,
                          base::Bind(&QuicStreamFactory::Job::RunAuxilaryJob,
                                     aux_job->GetWeakPtr()));
 }
 
 bool QuicStreamFactory::OnResolution(
     const QuicServerId& server_id,
     const AddressList& address_list) {
   DCHECK(!HasActiveSession(server_id));
   if (disable_connection_pooling_) {
     return false;
   }
   for (const IPEndPoint& address : address_list) {
-    const IpAliasKey ip_alias_key(address, server_id.is_https());
-    if (!ContainsKey(ip_aliases_, ip_alias_key))
+    if (!ContainsKey(ip_aliases_, address))
       continue;
 
-    const SessionSet& sessions = ip_aliases_[ip_alias_key];
+    const SessionSet& sessions = ip_aliases_[address];
     for (QuicChromiumClientSession* session : sessions) {
       if (!session->CanPool(server_id.host(), server_id.privacy_mode()))
         continue;
       active_sessions_[server_id] = session;
       session_aliases_[session].insert(server_id);
       return true;
     }
   }
   return false;
 }
@@ skipping 160 matching lines @@
     // port suggestions.
     if (session->goaway_received()) {
       gone_away_aliases_.insert(*it);
     }
 
     active_sessions_.erase(*it);
     ProcessGoingAwaySession(session, *it, true);
   }
   ProcessGoingAwaySession(session, all_sessions_[session], false);
   if (!aliases.empty()) {
-    const IpAliasKey ip_alias_key(session->connection()->peer_address(),
-                                  aliases.begin()->is_https());
-    ip_aliases_[ip_alias_key].erase(session);
-    if (ip_aliases_[ip_alias_key].empty()) {
-      ip_aliases_.erase(ip_alias_key);
+    const IPEndPoint peer_address = session->connection()->peer_address();
+    ip_aliases_[peer_address].erase(session);
+    if (ip_aliases_[peer_address].empty()) {
+      ip_aliases_.erase(peer_address);
     }
   }
   session_aliases_.erase(session);
 }
 
 void QuicStreamFactory::MaybeDisableQuic(QuicChromiumClientSession* session) {
   DCHECK(session);
   uint16 port = session->server_id().port();
   if (IsQuicDisabled(port))
     return;
@@ skipping 65 matching lines @@
        ++it) {
     DCHECK(active_sessions_.count(*it));
     DCHECK_EQ(session, active_sessions_[*it]);
     active_sessions_.erase(*it);
   }
 
   if (aliases.empty()) {
     return;
   }
 
-  const IpAliasKey ip_alias_key(session->connection()->peer_address(),
-                                aliases.begin()->is_https());
-  ip_aliases_[ip_alias_key].erase(session);
-  if (ip_aliases_[ip_alias_key].empty()) {
-    ip_aliases_.erase(ip_alias_key);
+  const IPEndPoint peer_address = session->connection()->peer_address();
+  ip_aliases_[peer_address].erase(session);
+  if (ip_aliases_[peer_address].empty()) {
+    ip_aliases_.erase(peer_address);
   }
   QuicServerId server_id = *aliases.begin();
   session_aliases_.erase(session);
   Job* job = new Job(this, host_resolver_, session, server_id);
   active_jobs_[server_id].insert(job);
   int rv = job->Run(base::Bind(&QuicStreamFactory::OnJobComplete,
                                base::Unretained(this), job));
   DCHECK_EQ(ERR_IO_PENDING, rv);
 }
 
@@ skipping 159 matching lines @@
   DefaultPacketWriterFactory packet_writer_factory(socket.get());
 
   if (!helper_.get()) {
     helper_.reset(
         new QuicConnectionHelper(base::ThreadTaskRunnerHandle::Get().get(),
                                  clock_.get(), random_generator_));
   }
 
   QuicConnection* connection = new QuicConnection(
       connection_id, addr, helper_.get(), packet_writer_factory,
-      true /* owns_writer */, Perspective::IS_CLIENT, server_id.is_https(),
+      true /* owns_writer */, Perspective::IS_CLIENT, /*is_https=*/true,
       supported_versions_);
   connection->SetMaxPacketLength(max_packet_length_);
 
   InitializeCachedStateInCryptoConfig(server_id, server_info);
 
   QuicConfig config = config_;
   config.SetSocketReceiveBufferToSend(socket_receive_buffer_size_);
   config.set_max_undecryptable_packets(kMaxUndecryptablePackets);
   config.SetInitialSessionFlowControlWindowToSend(
       kQuicSessionMaxRecvWindowSize);
@@ skipping 42 matching lines @@
   }
   return OK;
 }
 
 void QuicStreamFactory::ActivateSession(const QuicServerId& server_id,
                                         QuicChromiumClientSession* session) {
   DCHECK(!HasActiveSession(server_id));
   UMA_HISTOGRAM_COUNTS("Net.QuicActiveSessions", active_sessions_.size());
   active_sessions_[server_id] = session;
   session_aliases_[session].insert(server_id);
-  const IpAliasKey ip_alias_key(session->connection()->peer_address(),
-                                server_id.is_https());
-  DCHECK(!ContainsKey(ip_aliases_[ip_alias_key], session));
-  ip_aliases_[ip_alias_key].insert(session);
+  const IPEndPoint peer_address = session->connection()->peer_address();
+  DCHECK(!ContainsKey(ip_aliases_[peer_address], session));
+  ip_aliases_[peer_address].insert(session);
 }
 
 int64 QuicStreamFactory::GetServerNetworkStatsSmoothedRttInMicroseconds(
     const QuicServerId& server_id) const {
   if (!http_server_properties_)
     return 0;
   const ServerNetworkStats* stats =
       http_server_properties_->GetServerNetworkStats(
           server_id.host_port_pair());
   if (stats == nullptr)
@@ skipping 37 matching lines @@
     // If the AlternativeServiceMap contained an entry for this host, check if
     // the disk cache contained an entry for it.
     if (ContainsKey(quic_supported_servers_at_startup_,
                     server_id.host_port_pair())) {
       UMA_HISTOGRAM_BOOLEAN(
           "Net.QuicServerInfo.ExpectConfigMissingFromDiskCache",
           server_info->state().server_config.empty());
     }
   }
 
-  if (!cached->Initialize(server_info->state().server_config,
-                          server_info->state().source_address_token,
-                          server_info->state().certs,
-                          server_info->state().server_config_sig,
-                          clock_->WallNow()))
-    return;
-
-  if (!server_id.is_https()) {
-    // Don't check the certificates for insecure QUIC.
-    cached->SetProofValid();
-  }
+  cached->Initialize(server_info->state().server_config,
+                     server_info->state().source_address_token,
+                     server_info->state().certs,
+                     server_info->state().server_config_sig, clock_->WallNow());
 }
 
 void QuicStreamFactory::InitializeQuicSupportedServersAtStartup() {
   DCHECK(http_server_properties_);
   DCHECK(!quic_supported_servers_at_startup_initialzied_);
   quic_supported_servers_at_startup_initialzied_ = true;
   for (const std::pair<const HostPortPair, AlternativeServiceInfoVector>&
            key_value : http_server_properties_->alternative_service_map()) {
     for (const AlternativeServiceInfo& alternative_service_info :
          key_value.second) {
@@ skipping 41 matching lines @@
   // Since the session was active, there's no longer an
   // HttpStreamFactoryImpl::Job running which can mark it broken, unless the TCP
   // job also fails. So to avoid not using QUIC when we otherwise could, we mark
   // it as recently broken, which means that 0-RTT will be disabled but we'll
   // still race.
   http_server_properties_->MarkAlternativeServiceRecentlyBroken(
       alternative_service);
 }
 
 }  // namespace net