Add QUIC 31 in which the server's proof covers both the static server config as well as a hash of t…

net/quic/quic_crypto_client_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_crypto_client_stream.h"
 
 #include <vector>
 
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/stringprintf.h"
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/crypto/crypto_utils.h"
 #include "net/quic/crypto/null_encrypter.h"
 #include "net/quic/quic_flags.h"
 #include "net/quic/quic_protocol.h"
 #include "net/quic/quic_session.h"
+#include "net/quic/quic_utils.h"
 
 using std::string;
 using std::vector;
 
 namespace net {
 
 namespace {
 
 void AppendFixed(CryptoHandshakeMessage* message) {
   vector<QuicTag> tags;
@@ skipping 148 matching lines @@
 }
 
 void QuicCryptoClientStream::HandleServerConfigUpdateMessage(
     const CryptoHandshakeMessage& server_config_update) {
   DCHECK(server_config_update.tag() == kSCUP);
   string error_details;
   QuicCryptoClientConfig::CachedState* cached =
       crypto_config_->LookupOrCreate(server_id_);
   QuicErrorCode error = crypto_config_->ProcessServerConfigUpdate(
       server_config_update, session()->connection()->clock()->WallNow(),
-      session()->connection()->version(), cached, &crypto_negotiated_params_,
-      &error_details);
+      session()->connection()->version(), cached->chlo_hash(), cached,
+      &crypto_negotiated_params_, &error_details);
 
   if (error != QUIC_NO_ERROR) {
     CloseConnectionWithDetails(
         error, "Server config update invalid: " + error_details);
     return;
   }
 
   DCHECK(handshake_confirmed());
   if (proof_verify_callback_) {
     proof_verify_callback_->Cancel();
@@ skipping 55 matching lines @@
 void QuicCryptoClientStream::DoInitialize(
     QuicCryptoClientConfig::CachedState* cached) {
   if (!cached->IsEmpty() && !cached->signature().empty()) {
     // Note that we verify the proof even if the cached proof is valid.
     // This allows us to respond to CA trust changes or certificate
     // expiration because it may have been a while since we last verified
     // the proof.
     DCHECK(crypto_config_->proof_verifier());
     // Track proof verification time when cached server config is used.
     proof_verify_start_time_ = base::TimeTicks::Now();
+    chlo_hash_ = cached->chlo_hash();
     // If the cached state needs to be verified, do it now.
     next_state_ = STATE_VERIFY_PROOF;
   } else {
     next_state_ = STATE_GET_CHANNEL_ID;
   }
 }
 
 void QuicCryptoClientStream::DoSendCHLO(
     QuicCryptoClientConfig::CachedState* cached) {
   if (stateless_reject_received_) {
@@ skipping 48 matching lines @@
       return;
     }
     if (kClientHelloMinimumSize > max_packet_size - kFramingOverhead) {
       DLOG(DFATAL) << "Client hello won't fit in a single packet.";
       CloseConnectionWithDetails(QUIC_INTERNAL_ERROR, "CHLO too large");
       return;
     }
     out.set_minimum_size(
         static_cast<size_t>(max_packet_size - kFramingOverhead));
     next_state_ = STATE_RECV_REJ;
+    CryptoUtils::HashHandshakeMessage(out, &chlo_hash_);
     SendHandshakeMessage(out);
     return;
   }
 
   // If the server nonce is empty, copy over the server nonce from a previous
   // SREJ, if there is one.
   if (FLAGS_enable_quic_stateless_reject_support &&
       crypto_negotiated_params_.server_nonce.empty() &&
       cached->has_server_nonce()) {
     crypto_negotiated_params_.server_nonce = cached->GetNextServerNonce();
     DCHECK(!crypto_negotiated_params_.server_nonce.empty());
   }
 
   string error_details;
   QuicErrorCode error = crypto_config_->FillClientHello(
       server_id_, session()->connection()->connection_id(),
       session()->connection()->supported_versions().front(), cached,
       session()->connection()->clock()->WallNow(),
       session()->connection()->random_generator(), channel_id_key_.get(),
       &crypto_negotiated_params_, &out, &error_details);
   if (error != QUIC_NO_ERROR) {
     // Flush the cached config so that, if it's bad, the server has a
     // chance to send us another in the future.
     cached->InvalidateServerConfig();
     CloseConnectionWithDetails(error, error_details);
     return;
   }
+  CryptoUtils::HashHandshakeMessage(out, &chlo_hash_);
   channel_id_sent_ = (channel_id_key_.get() != nullptr);
   if (cached->proof_verify_details()) {
     proof_handler_->OnProofVerifyDetailsAvailable(
         *cached->proof_verify_details());
   }
   next_state_ = STATE_RECV_SHLO;
   SendHandshakeMessage(out);
   // Be prepared to decrypt with the new server write key.
   session()->connection()->SetAlternativeDecrypter(
       ENCRYPTION_INITIAL,
@@ skipping 49 matching lines @@
                                   packed_error);
     }
     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Secure",
                                 packed_error);
   }
 
   stateless_reject_received_ = in->tag() == kSREJ;
   string error_details;
   QuicErrorCode error = crypto_config_->ProcessRejection(
       *in, session()->connection()->clock()->WallNow(),
-      session()->connection()->version(), cached, &crypto_negotiated_params_,
-      &error_details);
+      session()->connection()->version(), chlo_hash_, cached,
+      &crypto_negotiated_params_, &error_details);
 
   if (error != QUIC_NO_ERROR) {
     next_state_ = STATE_NONE;
     CloseConnectionWithDetails(error, error_details);
     return;
   }
   if (!cached->proof_valid()) {
     if (!cached->signature().empty()) {
       // Note that we only verify the proof if the cached proof is not
       // valid. If the cached proof is valid here, someone else must have
@@ skipping 13 matching lines @@
   DCHECK(verifier);
   next_state_ = STATE_VERIFY_PROOF_COMPLETE;
   generation_counter_ = cached->generation_counter();
 
   ProofVerifierCallbackImpl* proof_verify_callback =
       new ProofVerifierCallbackImpl(this);
 
   verify_ok_ = false;
 
   QuicAsyncStatus status = verifier->VerifyProof(
-      server_id_.host(), cached->server_config(), cached->certs(),
+      server_id_.host(), cached->server_config(),
+      session()->connection()->version(), chlo_hash_, cached->certs(),
       cached->cert_sct(), cached->signature(), verify_context_.get(),
       &verify_error_details_, &verify_details_, proof_verify_callback);
 
   switch (status) {
     case QUIC_PENDING:
       proof_verify_callback_ = proof_verify_callback;
       DVLOG(1) << "Doing VerifyProof";
       break;
     case QUIC_FAILURE:
       delete proof_verify_callback;
@@ skipping 198 matching lines @@
   }
   for (size_t i = 0; i < num_their_proof_demands; i++) {
     if (their_proof_demands[i] == kCHID) {
       return true;
     }
   }
   return false;
 }
 
 }  // namespace net