Landing Recent QUIC changes until 5/14/2016 02:25:25 UTC

net/quic/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 1142 matching lines @@
   }
 
   strike_register_client->VerifyNonceIsValidAndUnique(
       info->client_nonce, info->now,
       new VerifyNonceIsValidAndUniqueCallback(client_hello_state, done_cb));
   helper.StartedAsyncCallback();
 }
 
 bool QuicCryptoServerConfig::BuildServerConfigUpdateMessage(
     QuicVersion version,
+    StringPiece chlo_hash,
     const SourceAddressTokens& previous_source_address_tokens,
     const IPAddress& server_ip,
     const IPAddress& client_ip,
     const QuicClock* clock,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
     const CachedNetworkParameters* cached_network_params,
     CryptoHandshakeMessage* out) const {
   base::AutoLock locked(configs_lock_);
   out->set_tag(kSCUP);
   out->SetStringPiece(kSCFG, primary_config_->serialized);
   out->SetStringPiece(
       kSourceAddressTokenTag,
       NewSourceAddressToken(*primary_config_.get(),
                             previous_source_address_tokens, client_ip, rand,
                             clock->WallNow(), cached_network_params));
 
   scoped_refptr<ProofSource::Chain> chain;
   string signature;
   string cert_sct;
-  if (!proof_source_->GetProof(server_ip, params.sni,
-                               primary_config_->serialized, version,
-                               params.client_nonce, params.x509_ecdsa_supported,
-                               &chain, &signature, &cert_sct)) {
-    DVLOG(1) << "Server: failed to get proof.";
-    return false;
+  if (FLAGS_quic_use_hash_in_scup) {
+    if (!proof_source_->GetProof(server_ip, params.sni,
+                                 primary_config_->serialized, version,
+                                 chlo_hash, params.x509_ecdsa_supported, &chain,
+                                 &signature, &cert_sct)) {
+      DVLOG(1) << "Server: failed to get proof.";
+      return false;
+    }
+  } else {
+    if (!proof_source_->GetProof(
+            server_ip, params.sni, primary_config_->serialized, version,
+            params.client_nonce, params.x509_ecdsa_supported, &chain,
+            &signature, &cert_sct)) {
+      DVLOG(1) << "Server: failed to get proof.";
+      return false;
+    }
   }
 
   const string compressed = CompressChain(
       compressed_certs_cache, chain, params.client_common_set_hashes,
       params.client_cached_cert_hashes, primary_config_->common_cert_sets);
 
   out->SetStringPiece(kCertificateTag, compressed);
   out->SetStringPiece(kPROF, signature);
   if (params.sct_supported_by_client && version > QUIC_VERSION_29 &&
       enable_serving_sct_) {
@@ skipping 622 matching lines @@
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {
   STLDeleteElements(&key_exchanges);
 }
 
 QuicCryptoProof::QuicCryptoProof() {}
 QuicCryptoProof::~QuicCryptoProof() {}
 }  // namespace net