Landing Recent QUIC changes until 5:55 PM, Aug 25, 2016 UTC-4

net/quic/core/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 622 matching lines @@
     return QUIC_HANDSHAKE_FAILED;
   }
 
   StringPiece cert_sct;
   if (client_hello.GetStringPiece(kCertificateSCTTag, &cert_sct) &&
       cert_sct.empty()) {
     params->sct_supported_by_client = true;
   }
 
   if (!info.reject_reasons.empty() || !requested_config.get()) {
-    BuildRejection(version, *primary_config, client_hello, info,
-                   validate_chlo_result.cached_network_params,
+    BuildRejection(version, clock->WallNow(), *primary_config, client_hello,
+                   info, validate_chlo_result.cached_network_params,
                    use_stateless_rejects, server_designated_connection_id, rand,
                    compressed_certs_cache, params, *crypto_proof,
                    total_framing_overhead, chlo_packet_size, out);
     return QUIC_NO_ERROR;
   }
 
   if (reject_only) {
     return QUIC_NO_ERROR;
   }
 
@@ skipping 623 matching lines @@
     const IPAddress& server_ip,
     const IPAddress& client_ip,
     const QuicClock* clock,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
     const CachedNetworkParameters* cached_network_params,
     CryptoHandshakeMessage* out) const {
   string serialized;
   string source_address_token;
+  QuicWallTime expiry_time = QuicWallTime::Zero();
   const CommonCertSets* common_cert_sets;
   {
     base::AutoLock locked(configs_lock_);
     serialized = primary_config_->serialized;
     common_cert_sets = primary_config_->common_cert_sets;
+    expiry_time = primary_config_->expiry_time;
     source_address_token = NewSourceAddressToken(
         *primary_config_, previous_source_address_tokens, client_ip, rand,
         clock->WallNow(), cached_network_params);
   }
 
   out->set_tag(kSCUP);
   out->SetStringPiece(kSCFG, serialized);
   out->SetStringPiece(kSourceAddressTokenTag, source_address_token);
+  if (FLAGS_quic_send_scfg_ttl) {
+    out->SetValue(kSTTL,
+                  expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds());
+  }
 
   scoped_refptr<ProofSource::Chain> chain;
   string signature;
   string cert_sct;
   if (!proof_source_->GetProof(server_ip, params.sni, serialized, version,
                                chlo_hash, &chain, &signature, &cert_sct)) {
     DVLOG(1) << "Server: failed to get proof.";
     return false;
   }
 
@@ skipping 117 matching lines @@
     } else {
       message.SetStringPiece(kCertificateSCTTag, leaf_cert_sct);
     }
   }
 
   cb->Run(true, message);
 }
 
 void QuicCryptoServerConfig::BuildRejection(
     QuicVersion version,
+    QuicWallTime now,
     const Config& config,
     const CryptoHandshakeMessage& client_hello,
     const ClientHelloInfo& info,
     const CachedNetworkParameters& cached_network_params,
     bool use_stateless_rejects,
     QuicConnectionId server_designated_connection_id,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     QuicCryptoNegotiatedParameters* params,
     const QuicCryptoProof& crypto_proof,
     QuicByteCount total_framing_overhead,
     QuicByteCount chlo_packet_size,
     CryptoHandshakeMessage* out) const {
   if (FLAGS_enable_quic_stateless_reject_support && use_stateless_rejects) {
     DVLOG(1) << "QUIC Crypto server config returning stateless reject "
              << "with server-designated connection ID "
              << server_designated_connection_id;
     out->set_tag(kSREJ);
     out->SetValue(kRCID, server_designated_connection_id);
   } else {
     out->set_tag(kREJ);
   }
   out->SetStringPiece(kSCFG, config.serialized);
   out->SetStringPiece(
       kSourceAddressTokenTag,
       NewSourceAddressToken(config, info.source_address_tokens, info.client_ip,
                             rand, info.now, &cached_network_params));
+  if (FLAGS_quic_send_scfg_ttl) {
+    out->SetValue(kSTTL,
+                  config.expiry_time.AbsoluteDifference(now).ToSeconds());
+  }
   if (replay_protection_) {
     out->SetStringPiece(kServerNonceTag, NewServerNonce(rand, info.now));
   }
 
   // Send client the reject reason for debugging purposes.
   DCHECK_LT(0u, info.reject_reasons.size());
   out->SetVector(kRREJ, info.reject_reasons);
 
   // The client may have requested a certificate chain.
   if (!ClientDemandsX509Proof(client_hello)) {
@@ skipping 244 matching lines @@
     for (const KeyExchange* key_exchange : config->key_exchanges) {
       if (key_exchange->tag() == tag) {
         LOG(WARNING) << "Duplicate key exchange in config: " << tag;
         return nullptr;
       }
     }
 
     config->key_exchanges.push_back(ka.release());
   }
 
+  if (FLAGS_quic_send_scfg_ttl) {
+    uint64_t expiry_seconds;
+    if (msg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
+      LOG(WARNING) << "Server config message is missing EXPY";
+      return nullptr;
+    }
+    config->expiry_time = QuicWallTime::FromUNIXSeconds(expiry_seconds);
+  }
+
   return config;
 }
 
 void QuicCryptoServerConfig::SetEphemeralKeySource(
     EphemeralKeySource* ephemeral_key_source) {
   ephemeral_key_source_.reset(ephemeral_key_source);
 }
 
 void QuicCryptoServerConfig::SetStrikeRegisterClient(
     StrikeRegisterClient* strike_register_client) {
@@ skipping 297 matching lines @@
         return true;
     }
   }
   return false;
 }
 
 QuicCryptoServerConfig::Config::Config()
     : channel_id_enabled(false),
       is_primary(false),
       primary_time(QuicWallTime::Zero()),
+      expiry_time(QuicWallTime::Zero()),
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {
   base::STLDeleteElements(&key_exchanges);
 }
 
 QuicCryptoProof::QuicCryptoProof() {}
 QuicCryptoProof::~QuicCryptoProof() {}
 }  // namespace net