Clear the QUIC cached proof when a client receives a REJ w/o a PROF tag.

net/quic/crypto/crypto_handshake.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/crypto_handshake.h"
 
 #include <ctype.h>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
@@ skipping 452 matching lines @@
   if (!has_changed) {
     return;
   }
 
   // If the proof has changed then it needs to be revalidated.
   SetProofInvalid();
   certs_ = certs;
   server_config_sig_ = signature.as_string();
 }
 
+void QuicCryptoClientConfig::CachedState::ClearProof() {
+  SetProofInvalid();
+  certs_.clear();
+  server_config_sig_.clear();
+}
+
 void QuicCryptoClientConfig::CachedState::SetProofValid() {
   server_config_valid_ = true;
 }
 
 void QuicCryptoClientConfig::CachedState::SetProofInvalid() {
   server_config_valid_ = false;
   ++generation_counter_;
 }
 
 const string& QuicCryptoClientConfig::CachedState::server_config() const {
@@ skipping 332 matching lines @@
   if (rej.GetStringPiece(kSourceAddressTokenTag, &token)) {
     cached->set_source_address_token(token);
   }
 
   StringPiece nonce;
   if (rej.GetStringPiece(kServerNonceTag, &nonce)) {
     out_params->server_nonce = nonce.as_string();
   }
 
   StringPiece proof, cert_bytes;
-  if (rej.GetStringPiece(kPROF, &proof) &&
-      rej.GetStringPiece(kCertificateTag, &cert_bytes)) {
+  bool has_proof = rej.GetStringPiece(kPROF, &proof);
+  bool has_cert = rej.GetStringPiece(kCertificateTag, &cert_bytes);
+  if (has_proof && has_cert) {
     vector<string> certs;
     if (!CertCompressor::DecompressChain(cert_bytes, out_params->cached_certs,
                                          common_cert_sets, &certs)) {
       *error_details = "Certificate data invalid";

[wtc, 2013/08/15 16:33:05]

It seems that we should also call cached->ClearProof() in
this case ...

       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
     }
 
     cached->SetProof(certs, proof);
+  } else {
+    cached->ClearProof();
+    if (has_proof && !has_cert) {
+      *error_details = "Certificate missing";
+      return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
+    }
+
+    if (!has_proof && has_cert) {
+      *error_details = "Proof missing";
+      return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
+    }
   }
 
   return QUIC_NO_ERROR;
 }
 
 QuicErrorCode QuicCryptoClientConfig::ProcessServerHello(
     const CryptoHandshakeMessage& server_hello,
     QuicGuid guid,
     QuicCryptoNegotiatedParameters* out_params,
     string* error_details) {
@@ skipping 43 matching lines @@
 
 ChannelIDSigner* QuicCryptoClientConfig::channel_id_signer() const {
   return channel_id_signer_.get();
 }
 
 void QuicCryptoClientConfig::SetChannelIDSigner(ChannelIDSigner* signer) {
   channel_id_signer_.reset(signer);
 }
 
 }  // namespace net