QUIC - Race Cert Verification with host resolution if certs are

net/quic/crypto/proof_verifier_chromium.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 210 matching lines @@
     // Note that this is a completely synchronous operation: The CT Log Verifier
     // gets all the data it needs for SCT verification and does not do any
     // external communication.
     cert_transparency_verifier_->Verify(cert_.get(), std::string(), cert_sct,
                                         &verify_details_->ct_verify_result,
                                         net_log_);
   }
 
   // We call VerifySignature first to avoid copying of server_config and
   // signature.
-  if (!VerifySignature(server_config, quic_version, chlo_hash, signature,
+  if (!signature.empty() &&

[ramant (doing other things), 2016/07/06 15:27:18]

Hi Ryan,
  Is it better to pass "verify_cert_only" as a param to ProofVerify and skip the
signature check if "verify_cert_only" argument is true?

thanks
raman

[Ryan Hamilton, 2016/07/07 00:24:36]

Yeah, I think being more explicit would be better. It seems like this code might
allow for the server to supply an empty signature and that would trick the
verifier into accepting it.

[ramant (doing other things), 2016/07/07 16:18:20]

Added a new method.

+      !VerifySignature(server_config, quic_version, chlo_hash, signature,
                        certs[0])) {
     *error_details = "Failed to verify signature of server config";
     DLOG(WARNING) << *error_details;
     verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID;
     *verify_details = std::move(verify_details_);
     return QUIC_FAILURE;
   }
 
   hostname_ = hostname;
   port_ = port;
@@ skipping 268 matching lines @@
   }
   return status;
 }
 
 void ProofVerifierChromium::OnJobComplete(Job* job) {
   active_jobs_.erase(job);
   delete job;
 }
 
 }  // namespace net