Add a bool demand_x509_proof argument to QuicCryptoClientConfig::FillInchoateClientHello to conditi…

net/quic/crypto/quic_crypto_client_config.cc

Index: net/quic/crypto/quic_crypto_client_config.cc
diff --git a/net/quic/crypto/quic_crypto_client_config.cc b/net/quic/crypto/quic_crypto_client_config.cc
index 53c60c2e805404c8bb58ac5dc417b8e10b3f3e2c..b31a73744e29a517fd2ac36da9fdaee495d4e04f 100644
--- a/net/quic/crypto/quic_crypto_client_config.cc
+++ b/net/quic/crypto/quic_crypto_client_config.cc
@@ -413,6 +413,7 @@ void QuicCryptoClientConfig::FillInchoateClientHello(
     const QuicVersion preferred_version,
     const CachedState* cached,
     QuicRandom* rand,
+    bool demand_x509_proof,
     QuicCryptoNegotiatedParameters* out_params,
     CryptoHandshakeMessage* out) const {
   out->set_tag(kCHLO);
@@ -429,10 +430,6 @@ void QuicCryptoClientConfig::FillInchoateClientHello(
     out->SetStringPiece(kUAID, user_agent_id_);
   }
 
-  char proof_nonce[32];
-  rand->RandBytes(proof_nonce, arraysize(proof_nonce));
-  out->SetStringPiece(kNONP, StringPiece(proof_nonce, arraysize(proof_nonce)));
-
   // Even though this is an inchoate CHLO, send the SCID so that
   // the STK can be validated by the server.
   const CryptoHandshakeMessage* scfg = cached->GetServerConfig();
@@ -447,6 +444,14 @@ void QuicCryptoClientConfig::FillInchoateClientHello(
     out->SetStringPiece(kSourceAddressTokenTag, cached->source_address_token());
   }
 
+  if (!demand_x509_proof) {
+    return;
+  }
+
+  char proof_nonce[32];
+  rand->RandBytes(proof_nonce, arraysize(proof_nonce));
+  out->SetStringPiece(kNONP, StringPiece(proof_nonce, arraysize(proof_nonce)));
+
   if (disable_ecdsa_) {
     out->SetVector(kPDMD, QuicTagVector{kX59R});
   } else {
@@ -493,7 +498,7 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello(
   DCHECK(error_details != nullptr);
 
   FillInchoateClientHello(server_id, preferred_version, cached, rand,
-                          out_params, out);
+                          /* demand_x509_proof= */ true, out_params, out);
 
   const CryptoHandshakeMessage* scfg = cached->GetServerConfig();
   if (!scfg) {