OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/crypto/quic_crypto_client_config.h" | 5 #include "net/quic/crypto/quic_crypto_client_config.h" |
6 | 6 |
7 #include "base/metrics/histogram_macros.h" | 7 #include "base/metrics/histogram_macros.h" |
8 #include "base/metrics/sparse_histogram.h" | 8 #include "base/metrics/sparse_histogram.h" |
9 #include "base/stl_util.h" | 9 #include "base/stl_util.h" |
10 #include "base/strings/string_util.h" | 10 #include "base/strings/string_util.h" |
(...skipping 755 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
766 QuicErrorCode QuicCryptoClientConfig::ProcessServerHello( | 766 QuicErrorCode QuicCryptoClientConfig::ProcessServerHello( |
767 const CryptoHandshakeMessage& server_hello, | 767 const CryptoHandshakeMessage& server_hello, |
768 QuicConnectionId connection_id, | 768 QuicConnectionId connection_id, |
769 QuicVersion version, | 769 QuicVersion version, |
770 const QuicVersionVector& negotiated_versions, | 770 const QuicVersionVector& negotiated_versions, |
771 CachedState* cached, | 771 CachedState* cached, |
772 QuicCryptoNegotiatedParameters* out_params, | 772 QuicCryptoNegotiatedParameters* out_params, |
773 string* error_details) { | 773 string* error_details) { |
774 DCHECK(error_details != nullptr); | 774 DCHECK(error_details != nullptr); |
775 | 775 |
776 if (server_hello.tag() != kSHLO) { | |
777 *error_details = "Bad tag"; | |
778 return QUIC_INVALID_CRYPTO_MESSAGE_TYPE; | |
779 } | |
780 | 776 |
781 const QuicTag* supported_version_tags; | 777 QuicErrorCode valid = CryptoUtils::ValidateServerHello( |
782 size_t num_supported_versions; | 778 server_hello, negotiated_versions, error_details); |
783 | 779 if (valid != QUIC_NO_ERROR) { |
784 if (server_hello.GetTaglist(kVER, &supported_version_tags, | 780 return valid; |
785 &num_supported_versions) != QUIC_NO_ERROR) { | |
786 *error_details = "server hello missing version list"; | |
787 return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; | |
788 } | |
789 if (!negotiated_versions.empty()) { | |
790 bool mismatch = num_supported_versions != negotiated_versions.size(); | |
791 for (size_t i = 0; i < num_supported_versions && !mismatch; ++i) { | |
792 mismatch = QuicTagToQuicVersion(supported_version_tags[i]) != | |
793 negotiated_versions[i]; | |
794 } | |
795 // The server sent a list of supported versions, and the connection | |
796 // reports that there was a version negotiation during the handshake. | |
797 // Ensure that these two lists are identical. | |
798 if (mismatch) { | |
799 *error_details = "Downgrade attack detected"; | |
800 return QUIC_VERSION_NEGOTIATION_MISMATCH; | |
801 } | |
802 } | 781 } |
803 | 782 |
804 // Learn about updated source address tokens. | 783 // Learn about updated source address tokens. |
805 StringPiece token; | 784 StringPiece token; |
806 if (server_hello.GetStringPiece(kSourceAddressTokenTag, &token)) { | 785 if (server_hello.GetStringPiece(kSourceAddressTokenTag, &token)) { |
807 cached->set_source_address_token(token); | 786 cached->set_source_address_token(token); |
808 } | 787 } |
809 | 788 |
810 StringPiece shlo_nonce; | 789 StringPiece shlo_nonce; |
811 if (version > QUIC_VERSION_26 && | 790 if (version > QUIC_VERSION_26 && |
(...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
942 } | 921 } |
943 | 922 |
944 // Update canonical version to point at the "most recent" entry. | 923 // Update canonical version to point at the "most recent" entry. |
945 canonical_server_map_[suffix_server_id] = server_id; | 924 canonical_server_map_[suffix_server_id] = server_id; |
946 | 925 |
947 server_state->InitializeFrom(*canonical_state); | 926 server_state->InitializeFrom(*canonical_state); |
948 return true; | 927 return true; |
949 } | 928 } |
950 | 929 |
951 } // namespace net | 930 } // namespace net |
OLD | NEW |