Landing Recent QUIC changes until 5:55 PM, Aug 25, 2016 UTC-4

net/quic/core/crypto/quic_crypto_client_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/crypto/quic_crypto_client_config.h"
 
 #include <memory>
 
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
@@ skipping 48 matching lines @@
     : proof_verifier_(std::move(proof_verifier)) {
   DCHECK(proof_verifier_.get());
   SetDefaults();
 }
 
 QuicCryptoClientConfig::~QuicCryptoClientConfig() {
   base::STLDeleteValues(&cached_states_);
 }
 
 QuicCryptoClientConfig::CachedState::CachedState()
-    : server_config_valid_(false), generation_counter_(0) {}
+    : server_config_valid_(false),
+      expiration_time_(QuicWallTime::Zero()),
+      generation_counter_(0) {}
 
 QuicCryptoClientConfig::CachedState::~CachedState() {}
 
 bool QuicCryptoClientConfig::CachedState::IsComplete(QuicWallTime now) const {
   if (server_config_.empty()) {
     RecordInchoateClientHelloReason(SERVER_CONFIG_EMPTY);
     return false;
   }
 
   if (!server_config_valid_) {
     RecordInchoateClientHelloReason(SERVER_CONFIG_INVALID);
     return false;
   }
 
   const CryptoHandshakeMessage* scfg = GetServerConfig();
   if (!scfg) {
     // Should be impossible short of cache corruption.
     DCHECK(false);
     RecordInchoateClientHelloReason(SERVER_CONFIG_CORRUPTED);
     return false;
   }
 
-  uint64_t expiry_seconds;
-  if (scfg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
-    RecordInchoateClientHelloReason(SERVER_CONFIG_INVALID_EXPIRY);
-    return false;
-  }
-  if (now.ToUNIXSeconds() >= expiry_seconds) {
+  if (now.IsAfter(expiration_time_)) {
     UMA_HISTOGRAM_CUSTOM_TIMES(
         "Net.QuicClientHelloServerConfig.InvalidDuration",
-        base::TimeDelta::FromSeconds(now.ToUNIXSeconds() - expiry_seconds),
+        base::TimeDelta::FromSeconds(now.ToUNIXSeconds() -
+                                     expiration_time_.ToUNIXSeconds()),
         base::TimeDelta::FromMinutes(1), base::TimeDelta::FromDays(20), 50);
     RecordInchoateClientHelloReason(SERVER_CONFIG_EXPIRED);
     return false;
   }
 
   return true;
 }
 
 bool QuicCryptoClientConfig::CachedState::IsEmpty() const {
   return server_config_.empty();
@@ skipping 27 matching lines @@
   server_nonces_.push(server_nonce);
 }
 
 bool QuicCryptoClientConfig::CachedState::has_server_nonce() const {
   return !server_nonces_.empty();
 }
 
 QuicCryptoClientConfig::CachedState::ServerConfigState
 QuicCryptoClientConfig::CachedState::SetServerConfig(StringPiece server_config,
                                                      QuicWallTime now,
+                                                     QuicWallTime expiry_time,
                                                      string* error_details) {
   const bool matches_existing = server_config == server_config_;
 
   // Even if the new server config matches the existing one, we still wish to
   // reject it if it has expired.
   std::unique_ptr<CryptoHandshakeMessage> new_scfg_storage;
   const CryptoHandshakeMessage* new_scfg;
 
   if (!matches_existing) {
     new_scfg_storage.reset(CryptoFramer::ParseMessage(server_config));
     new_scfg = new_scfg_storage.get();
   } else {
     new_scfg = GetServerConfig();
   }
 
   if (!new_scfg) {
     *error_details = "SCFG invalid";
     return SERVER_CONFIG_INVALID;
   }
 
-  uint64_t expiry_seconds;
-  if (new_scfg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
-    *error_details = "SCFG missing EXPY";
-    return SERVER_CONFIG_INVALID_EXPIRY;
+  if (expiry_time.IsZero()) {
+    uint64_t expiry_seconds;
+    if (new_scfg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
+      *error_details = "SCFG missing EXPY";
+      return SERVER_CONFIG_INVALID_EXPIRY;
+    }
+    expiration_time_ = QuicWallTime::FromUNIXSeconds(expiry_seconds);
+  } else {
+    expiration_time_ = expiry_time;
   }
 
-  if (now.ToUNIXSeconds() >= expiry_seconds) {
+  if (now.IsAfter(expiration_time_)) {
     *error_details = "SCFG has expired";
     return SERVER_CONFIG_EXPIRED;
   }
 
   if (!matches_existing) {
     server_config_ = server_config.as_string();
     SetProofInvalid();
     scfg_.reset(new_scfg_storage.release());
   }
   return SERVER_CONFIG_VALID;
@@ skipping 67 matching lines @@
   ++generation_counter_;
 }
 
 bool QuicCryptoClientConfig::CachedState::Initialize(
     StringPiece server_config,
     StringPiece source_address_token,
     const vector<string>& certs,
     StringPiece cert_sct,
     StringPiece chlo_hash,
     StringPiece signature,
-    QuicWallTime now) {
+    QuicWallTime now,
+    QuicWallTime expiration_time) {
   DCHECK(server_config_.empty());
 
   if (server_config.empty()) {
     RecordDiskCacheServerConfigState(SERVER_CONFIG_EMPTY);
     return false;
   }
 
   string error_details;
-  ServerConfigState state = SetServerConfig(server_config, now, &error_details);
+  ServerConfigState state =
+      SetServerConfig(server_config, now, expiration_time, &error_details);
   RecordDiskCacheServerConfigState(state);
   if (state != SERVER_CONFIG_VALID) {
     DVLOG(1) << "SetServerConfig failed with " << error_details;
     return false;
   }
 
   signature.CopyToString(&server_config_sig_);
   source_address_token.CopyToString(&source_address_token_);
   cert_sct.CopyToString(&cert_sct_);
   chlo_hash.CopyToString(&chlo_hash_);
@@ skipping 58 matching lines @@
   DCHECK(server_config_.empty());
   DCHECK(!server_config_valid_);
   server_config_ = other.server_config_;
   source_address_token_ = other.source_address_token_;
   certs_ = other.certs_;
   cert_sct_ = other.cert_sct_;
   chlo_hash_ = other.chlo_hash_;
   server_config_sig_ = other.server_config_sig_;
   server_config_valid_ = other.server_config_valid_;
   server_designated_connection_ids_ = other.server_designated_connection_ids_;
+  expiration_time_ = other.expiration_time_;
   if (other.proof_verify_details_.get() != nullptr) {
     proof_verify_details_.reset(other.proof_verify_details_->Clone());
   }
   ++generation_counter_;
 }
 
 QuicConnectionId
 QuicCryptoClientConfig::CachedState::GetNextServerDesignatedConnectionId() {
   if (server_designated_connection_ids_.empty()) {
     QUIC_BUG
@@ skipping 363 matching lines @@
     CachedState* cached,
     string* error_details) {
   DCHECK(error_details != nullptr);
 
   StringPiece scfg;
   if (!message.GetStringPiece(kSCFG, &scfg)) {
     *error_details = "Missing SCFG";
     return QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND;
   }
 
+  QuicWallTime expiration_time = QuicWallTime::Zero();
+  uint64_t expiry_seconds;
+  if (message.GetUint64(kSTTL, &expiry_seconds) == QUIC_NO_ERROR) {
+    expiration_time = now.Add(QuicTime::Delta::FromSeconds(expiry_seconds));
+  }
+
   CachedState::ServerConfigState state =
-      cached->SetServerConfig(scfg, now, error_details);
+      cached->SetServerConfig(scfg, now, expiration_time, error_details);
   if (state == CachedState::SERVER_CONFIG_EXPIRED) {
     return QUIC_CRYPTO_SERVER_CONFIG_EXPIRED;
   }
   // TODO(rtenneti): Return more specific error code than returning
   // QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER.
   if (state != CachedState::SERVER_CONFIG_VALID) {
     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
   }
 
   StringPiece token;
@@ skipping 234 matching lines @@
   }
 
   // Update canonical version to point at the "most recent" entry.
   canonical_server_map_[suffix_server_id] = server_id;
 
   server_state->InitializeFrom(*canonical_state);
   return true;
 }
 
 }  // namespace net