OpenSSL/NSS implementation of ProofVerfifier.

net/quic/crypto/crypto_handshake.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/crypto_handshake.h"
 
 #include <ctype.h>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
@@ skipping 339 matching lines @@
 
 QuicCryptoConfig::~QuicCryptoConfig() {}
 
 QuicCryptoClientConfig::QuicCryptoClientConfig() {}
 
 QuicCryptoClientConfig::~QuicCryptoClientConfig() {
   STLDeleteValues(&cached_states_);
 }
 
 QuicCryptoClientConfig::CachedState::CachedState()
-    : server_config_valid_(false) {}
+    : server_config_valid_(false),
+      generation_counter_(0) {}
 
 QuicCryptoClientConfig::CachedState::~CachedState() {}
 
 bool QuicCryptoClientConfig::CachedState::IsComplete(QuicWallTime now) const {
   if (server_config_.empty() || !server_config_valid_) {
     return false;
   }
 
   const CryptoHandshakeMessage* scfg = GetServerConfig();
   if (!scfg) {
@@ skipping 52 matching lines @@
   }
 
   if (now.ToUNIXSeconds() >= expiry_seconds) {
     *error_details = "SCFG has expired";
     return QUIC_CRYPTO_SERVER_CONFIG_EXPIRED;
   }
 
   if (!matches_existing) {
     server_config_ = server_config.as_string();
     server_config_valid_ = false;
+    ++generation_counter_;
     scfg_.reset(new_scfg_storage.release());
   }
   return QUIC_NO_ERROR;
 }
 
 void QuicCryptoClientConfig::CachedState::InvalidateServerConfig() {
   server_config_.clear();
   scfg_.reset();
   server_config_valid_ = false;
+  ++generation_counter_;
 }
 
 void QuicCryptoClientConfig::CachedState::SetProof(const vector<string>& certs,
                                                    StringPiece signature) {
   bool has_changed =
       signature != server_config_sig_ || certs_.size() != certs.size();
 
   if (!has_changed) {
     for (size_t i = 0; i < certs_.size(); i++) {
       if (certs_[i] != certs[i]) {
         has_changed = true;
         break;
       }
     }
   }
 
   if (!has_changed) {
     return;
   }
 
   // If the proof has changed then it needs to be revalidated.
   server_config_valid_ = false;
+  ++generation_counter_;

[wtc, 2013/07/03 00:20:26]

It may be a good idea to create a function, say SetProofInvalid,
for these two lines (lines 466-467), so that server_config_valid_
and generation_counter_ are kept in sync.

[ramant (doing other things), 2013/07/03 05:46:34]

Done.

   certs_ = certs;
   server_config_sig_ = signature.as_string();
 }
 
 void QuicCryptoClientConfig::CachedState::SetProofValid() {
   server_config_valid_ = true;
 }
 
 const string& QuicCryptoClientConfig::CachedState::server_config() const {
   return server_config_;
 }
 
 const string&
 QuicCryptoClientConfig::CachedState::source_address_token() const {
   return source_address_token_;
 }
 
 const vector<string>& QuicCryptoClientConfig::CachedState::certs() const {
   return certs_;
 }
 
 const string& QuicCryptoClientConfig::CachedState::signature() const {
   return server_config_sig_;
 }
 
 bool QuicCryptoClientConfig::CachedState::proof_valid() const {
   return server_config_valid_;
 }
 
+uint64 QuicCryptoClientConfig::CachedState::generation_counter() const {
+  return generation_counter_;
+}
+
 void QuicCryptoClientConfig::CachedState::set_source_address_token(
     StringPiece token) {
   source_address_token_ = token.as_string();
 }
 
 void QuicCryptoClientConfig::SetDefaults() {
   // Version must be 0.
   // TODO(agl): this version stuff is obsolete now.
   version = QuicCryptoConfig::CONFIG_VERSION;
 
@@ skipping 326 matching lines @@
   hkdf_input.append(out_params->hkdf_input_suffix);
 
   CryptoUtils::DeriveKeys(
       out_params->forward_secure_premaster_secret, out_params->aead,
       out_params->client_nonce, out_params->server_nonce, hkdf_input,
       CryptoUtils::CLIENT, &out_params->forward_secure_crypters);
 
   return QUIC_NO_ERROR;
 }
 
-const ProofVerifier* QuicCryptoClientConfig::proof_verifier() const {
+ProofVerifier* QuicCryptoClientConfig::proof_verifier() const {
   return proof_verifier_.get();
 }
 
 void QuicCryptoClientConfig::SetProofVerifier(ProofVerifier* verifier) {
   proof_verifier_.reset(verifier);
 }
 
 ChannelIDSigner* QuicCryptoClientConfig::channel_id_signer() const {
   return channel_id_signer_.get();
 }
 
 void QuicCryptoClientConfig::SetChannelIDSigner(ChannelIDSigner* signer) {
   channel_id_signer_.reset(signer);
 }
 
 }  // namespace net