Remove insecure QUIC support

net/quic/crypto/quic_crypto_client_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_client_config.h"
 
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
@@ skipping 32 matching lines @@
 // Tracks the state of the QUIC server information loaded from the disk cache.
 void RecordDiskCacheServerConfigState(
     QuicCryptoClientConfig::CachedState::ServerConfigState state) {
   UMA_HISTOGRAM_ENUMERATION(
       "Net.QuicServerInfo.DiskCacheState", state,
       QuicCryptoClientConfig::CachedState::SERVER_CONFIG_COUNT);
 }
 
 }  // namespace
 
-QuicCryptoClientConfig::QuicCryptoClientConfig()
-    : disable_ecdsa_(false) {
+QuicCryptoClientConfig::QuicCryptoClientConfig(ProofVerifier* proof_verifier)
+    : proof_verifier_(proof_verifier),
+      disable_ecdsa_(false) {
+  DCHECK(proof_verifier_.get());
   SetDefaults();
 }
 
 QuicCryptoClientConfig::~QuicCryptoClientConfig() {
   STLDeleteValues(&cached_states_);
 }
 
 QuicCryptoClientConfig::CachedState::CachedState()
     : server_config_valid_(false),
       generation_counter_(0) {}
@@ skipping 336 matching lines @@
   out->SetValue(kVER, QuicVersionToQuicTag(preferred_version));
 
   if (!user_agent_id_.empty()) {
     out->SetStringPiece(kUAID, user_agent_id_);
   }
 
   if (!cached->source_address_token().empty()) {
     out->SetStringPiece(kSourceAddressTokenTag, cached->source_address_token());
   }
 
-  if (server_id.is_https()) {
-    if (disable_ecdsa_) {
-      out->SetTaglist(kPDMD, kX59R, 0);
-    } else {
-      out->SetTaglist(kPDMD, kX509, 0);
-    }
+  if (disable_ecdsa_) {
+    out->SetTaglist(kPDMD, kX59R, 0);
+  } else {
+    out->SetTaglist(kPDMD, kX509, 0);
   }
 
   if (common_cert_sets) {
     out->SetStringPiece(kCCS, common_cert_sets->GetCommonHashes());
   }
 
   const vector<string>& certs = cached->certs();
   // We save |certs| in the QuicCryptoNegotiatedParameters so that, if the
   // client config is being used for multiple connections, another connection
   // doesn't update the cached certificates and cause us to be unable to
@@ skipping 106 matching lines @@
   }
 
   if (!out_params->client_key_exchange->CalculateSharedKey(
           public_value, &out_params->initial_premaster_secret)) {
     *error_details = "Key exchange failure";
     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
   }
   out->SetStringPiece(kPUBS, out_params->client_key_exchange->public_value());
 
   const vector<string>& certs = cached->certs();
-  if (preferred_version > QUIC_VERSION_25 && proof_verifier()) {
+  if (preferred_version > QUIC_VERSION_25) {
     if (certs.empty()) {
       *error_details = "No certs to calculate XLCT";
       return QUIC_CRYPTO_INTERNAL_ERROR;
     }
     out->SetValue(kXLCT, CryptoUtils::ComputeLeafCertHash(certs[0]));
   }
 
   if (channel_id_key) {
     // In order to calculate the encryption key for the CETV block we need to
     // serialise the client hello as it currently is (i.e. without the CETV
@@ skipping 56 matching lines @@
   // Set the following members of out_params:
   //   out_params->hkdf_input_suffix
   //   out_params->initial_crypters
   out_params->hkdf_input_suffix.clear();
   out_params->hkdf_input_suffix.append(reinterpret_cast<char*>(&connection_id),
                                        sizeof(connection_id));
   const QuicData& client_hello_serialized = out->GetSerialized();
   out_params->hkdf_input_suffix.append(client_hello_serialized.data(),
                                        client_hello_serialized.length());
   out_params->hkdf_input_suffix.append(cached->server_config());
-  if (preferred_version > QUIC_VERSION_25 && proof_verifier()) {
+  if (preferred_version > QUIC_VERSION_25) {
     if (certs.empty()) {
       *error_details = "No certs found to include in KDF";
       return QUIC_CRYPTO_INTERNAL_ERROR;
     }
     out_params->hkdf_input_suffix.append(certs[0]);
   }
 
   string hkdf_input;
   const size_t label_len = strlen(QuicCryptoConfig::kInitialLabel) + 1;
   hkdf_input.reserve(label_len + out_params->hkdf_input_suffix.size());
@@ skipping 48 matching lines @@
   if (has_proof && has_cert) {
     vector<string> certs;
     if (!CertCompressor::DecompressChain(cert_bytes, cached_certs,
                                          common_cert_sets, &certs)) {
       *error_details = "Certificate data invalid";
       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
     }
 
     cached->SetProof(certs, proof);
   } else {
-    if (proof_verifier() != nullptr) {
-      // Secure QUIC: clear existing proof as we have been sent a new SCFG
-      // without matching proof/certs.
-      cached->ClearProof();
-    }
+    // Secure QUIC: clear existing proof as we have been sent a new SCFG
+    // without matching proof/certs.
+    cached->ClearProof();
 
     if (has_proof && !has_cert) {
       *error_details = "Certificate missing";
       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
     }
 
     if (!has_proof && has_cert) {
       *error_details = "Proof missing";
       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
     }
   }
 
   return QUIC_NO_ERROR;
 }
 
 QuicErrorCode QuicCryptoClientConfig::ProcessRejection(
     const CryptoHandshakeMessage& rej,
     QuicWallTime now,
     CachedState* cached,
-    bool is_https,
     QuicCryptoNegotiatedParameters* out_params,
     string* error_details) {
   DCHECK(error_details != nullptr);
 
   if ((rej.tag() != kREJ) && (rej.tag() != kSREJ)) {
     *error_details = "Message is not REJ or SREJ";
     return QUIC_CRYPTO_INTERNAL_ERROR;
   }
 
   QuicErrorCode error = CacheNewServerConfig(rej, now, out_params->cached_certs,
@@ skipping 16 matching lines @@
     for (size_t i = 0; i < num_reject_reasons; ++i) {
       // HANDSHAKE_OK is 0 and don't report that as error.
       if (reject_reasons[i] == HANDSHAKE_OK || reject_reasons[i] >= 32) {
         continue;
       }
       HandshakeFailureReason reason =
           static_cast<HandshakeFailureReason>(reject_reasons[i]);
       packed_error |= 1 << (reason - 1);
     }
     DVLOG(1) << "Reasons for rejection: " << packed_error;
-    if (is_https) {
-      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Secure",
-                                  packed_error);
-    } else {
-      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Insecure",
-                                  packed_error);
-    }
+    UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Secure",
+                                packed_error);
   }
 
   if (rej.tag() == kSREJ) {
     QuicConnectionId connection_id;
     if (rej.GetUint64(kRCID, &connection_id) != QUIC_NO_ERROR) {
       *error_details = "Missing kRCID";
       return QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND;
     }
     cached->add_server_designated_connection_id(connection_id);
     if (!nonce.empty()) {
@@ skipping 104 matching lines @@
   }
 
   return CacheNewServerConfig(server_config_update, now,
                               out_params->cached_certs, cached, error_details);
 }
 
 ProofVerifier* QuicCryptoClientConfig::proof_verifier() const {
   return proof_verifier_.get();
 }
 
-void QuicCryptoClientConfig::SetProofVerifier(ProofVerifier* verifier) {
-  proof_verifier_.reset(verifier);
-}
-
 ChannelIDSource* QuicCryptoClientConfig::channel_id_source() const {
   return channel_id_source_.get();
 }
 
 void QuicCryptoClientConfig::SetChannelIDSource(ChannelIDSource* source) {
   channel_id_source_.reset(source);
 }
 
 void QuicCryptoClientConfig::InitializeFrom(
     const QuicServerId& server_id,
@@ skipping 37 matching lines @@
     if (base::EndsWith(server_id.host(), canonical_suffixes_[i],
                        base::CompareCase::INSENSITIVE_ASCII)) {
       break;
     }
   }
   if (i == canonical_suffixes_.size()) {
     return false;
   }
 
   QuicServerId suffix_server_id(canonical_suffixes_[i], server_id.port(),
-                                server_id.is_https(),
                                 server_id.privacy_mode());
   if (!ContainsKey(canonical_server_map_, suffix_server_id)) {
     // This is the first host we've seen which matches the suffix, so make it
     // canonical.
     canonical_server_map_[suffix_server_id] = server_id;
     return false;
   }
 
   const QuicServerId& canonical_server_id =
       canonical_server_map_[suffix_server_id];
   CachedState* canonical_state = cached_states_[canonical_server_id];
   if (!canonical_state->proof_valid()) {
     return false;
   }
 
   // Update canonical version to point at the "most recent" entry.
   canonical_server_map_[suffix_server_id] = server_id;
 
   server_state->InitializeFrom(*canonical_state);
   return true;
 }
 
 }  // namespace net