Landing Recent QUIC changes until Sat Oct 29 14:59:35.

net/quic/core/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 539 matching lines @@
   explicit ProcessClientHelloHelper(
       std::unique_ptr<ProcessClientHelloResultCallback>* done_cb)
       : done_cb_(done_cb) {}
 
   ~ProcessClientHelloHelper() {
     QUIC_BUG_IF(done_cb_ != nullptr)
         << "Deleting ProcessClientHelloHelper with a pending callback.";
   }
 
   void Fail(QuicErrorCode error, const string& error_details) {
-    (*done_cb_)->Run(error, error_details, nullptr, nullptr);
+    (*done_cb_)->Run(error, error_details, nullptr, nullptr, nullptr);
     DetachCallback();
   }
 
   void Succeed(std::unique_ptr<CryptoHandshakeMessage> message,
-               std::unique_ptr<DiversificationNonce> diversification_nonce) {
+               std::unique_ptr<DiversificationNonce> diversification_nonce,
+               std::unique_ptr<ProofSource::Details> proof_source_details) {
     (*done_cb_)->Run(QUIC_NO_ERROR, string(), std::move(message),
-                     std::move(diversification_nonce));
+                     std::move(diversification_nonce),
+                     std::move(proof_source_details));
     DetachCallback();
   }
 
   void DetachCallback() {
     QUIC_BUG_IF(done_cb_ == nullptr) << "Callback already detached.";
     done_cb_ = nullptr;
   }
 
  private:
   std::unique_ptr<ProcessClientHelloResultCallback>* done_cb_;
@@ skipping 47 matching lines @@
            const scoped_refptr<ProofSource::Chain>& chain,
            const string& signature,
            const string& leaf_cert_sct,
            std::unique_ptr<ProofSource::Details> details) override {
     if (ok) {
       crypto_proof_->chain = chain;
       crypto_proof_->signature = signature;
       crypto_proof_->cert_sct = leaf_cert_sct;
     }
     config_->ProcessClientHelloAfterGetProof(
-        !ok, *validate_chlo_result_, reject_only_, connection_id_,
-        client_address_, version_, supported_versions_, use_stateless_rejects_,
-        server_designated_connection_id_, clock_, rand_,
+        !ok, std::move(details), *validate_chlo_result_, reject_only_,
+        connection_id_, client_address_, version_, supported_versions_,
+        use_stateless_rejects_, server_designated_connection_id_, clock_, rand_,
         compressed_certs_cache_, params_, crypto_proof_,
         total_framing_overhead_, chlo_packet_size_, requested_config_,
         primary_config_, std::move(done_cb_));
   }
 
  private:
   const QuicCryptoServerConfig* config_;
   const scoped_refptr<ValidateClientHelloResultCallback::Result>
       validate_chlo_result_;
   const bool reject_only_;
@@ skipping 87 matching lines @@
     return;
   }
 
   if (!ClientDemandsX509Proof(client_hello)) {
     helper.Fail(QUIC_UNSUPPORTED_PROOF_DEMAND, "Missing or invalid PDMD");
     return;
   }
   DCHECK(proof_source_.get());
   string chlo_hash;
   CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash);
+
   // No need to get a new proof if one was already generated.
   if (!crypto_proof->chain) {
+    const QuicTag* tag_ptr;
+    size_t num_tags;
+    QuicTagVector connection_options;
+    if (client_hello.GetTaglist(kCOPT, &tag_ptr, &num_tags) == QUIC_NO_ERROR) {
+      connection_options.assign(tag_ptr, tag_ptr + num_tags);
+    }
     if (FLAGS_enable_async_get_proof) {
       std::unique_ptr<ProcessClientHelloCallback> cb(
           new ProcessClientHelloCallback(
               this, validate_chlo_result, reject_only, connection_id,
               client_address, version, supported_versions,
               use_stateless_rejects, server_designated_connection_id, clock,
               rand, compressed_certs_cache, params, crypto_proof,
               total_framing_overhead, chlo_packet_size, requested_config,
               primary_config, std::move(done_cb)));
       proof_source_->GetProof(server_ip, info.sni.as_string(),
                               primary_config->serialized, version, chlo_hash,
-                              std::move(cb));
+                              connection_options, std::move(cb));
       helper.DetachCallback();
       return;
     }
 
-    if (!proof_source_->GetProof(server_ip, info.sni.as_string(),
-                                 primary_config->serialized, version, chlo_hash,
-                                 &crypto_proof->chain, &crypto_proof->signature,
-                                 &crypto_proof->cert_sct)) {
+    if (!proof_source_->GetProof(
+            server_ip, info.sni.as_string(), primary_config->serialized,
+            version, chlo_hash, connection_options, &crypto_proof->chain,
+            &crypto_proof->signature, &crypto_proof->cert_sct)) {
       helper.Fail(QUIC_HANDSHAKE_FAILED, "Missing or invalid crypto proof.");
       return;
     }
   }
 
   helper.DetachCallback();
   ProcessClientHelloAfterGetProof(
-      /* found_error = */ false, *validate_chlo_result, reject_only,
-      connection_id, client_address, version, supported_versions,
-      use_stateless_rejects, server_designated_connection_id, clock, rand,
-      compressed_certs_cache, params, crypto_proof, total_framing_overhead,
-      chlo_packet_size, requested_config, primary_config, std::move(done_cb));
+      /* found_error = */ false, /* proof_source_details = */ nullptr,
+      *validate_chlo_result, reject_only, connection_id, client_address,
+      version, supported_versions, use_stateless_rejects,
+      server_designated_connection_id, clock, rand, compressed_certs_cache,
+      params, crypto_proof, total_framing_overhead, chlo_packet_size,
+      requested_config, primary_config, std::move(done_cb));
 }
 
 void QuicCryptoServerConfig::ProcessClientHelloAfterGetProof(
     bool found_error,
+    std::unique_ptr<ProofSource::Details> proof_source_details,
     const ValidateClientHelloResultCallback::Result& validate_chlo_result,
     bool reject_only,
     QuicConnectionId connection_id,
     const IPEndPoint& client_address,
     QuicVersion version,
     const QuicVersionVector& supported_versions,
     bool use_stateless_rejects,
     QuicConnectionId server_designated_connection_id,
     const QuicClock* clock,
     QuicRandom* rand,
@@ skipping 28 matching lines @@
   if (!info.reject_reasons.empty() || !requested_config.get()) {
     BuildRejection(version, clock->WallNow(), *primary_config, client_hello,
                    info, validate_chlo_result.cached_network_params,
                    use_stateless_rejects, server_designated_connection_id, rand,
                    compressed_certs_cache, params, *crypto_proof,
                    total_framing_overhead, chlo_packet_size, out.get());
     if (FLAGS_quic_export_rej_for_all_rejects &&
         rejection_observer_ != nullptr) {
       rejection_observer_->OnRejectionBuilt(info.reject_reasons, out.get());
     }
-    helper.Succeed(std::move(out), std::move(out_diversification_nonce));
+    helper.Succeed(std::move(out), std::move(out_diversification_nonce),
+                   std::move(proof_source_details));
     return;
   }
 
   if (reject_only) {
-    helper.Succeed(std::move(out), std::move(out_diversification_nonce));
+    helper.Succeed(std::move(out), std::move(out_diversification_nonce),
+                   std::move(proof_source_details));
     return;
   }
 
   const QuicTag* their_aeads;
   const QuicTag* their_key_exchanges;
   size_t num_their_aeads, num_their_key_exchanges;
   if (client_hello.GetTaglist(kAEAD, &their_aeads, &num_their_aeads) !=
           QUIC_NO_ERROR ||
       client_hello.GetTaglist(kKEXS, &their_key_exchanges,
                               &num_their_key_exchanges) != QUIC_NO_ERROR ||
@@ skipping 207 matching lines @@
   }
   out->SetVector(kVER, supported_version_tags);
   out->SetStringPiece(
       kSourceAddressTokenTag,
       NewSourceAddressToken(*requested_config.get(), info.source_address_tokens,
                             client_address.address(), rand, info.now, nullptr));
   QuicSocketAddressCoder address_coder(client_address);
   out->SetStringPiece(kCADR, address_coder.Encode());
   out->SetStringPiece(kPUBS, forward_secure_public_value);
 
-  helper.Succeed(std::move(out), std::move(out_diversification_nonce));
+  helper.Succeed(std::move(out), std::move(out_diversification_nonce),
+                 std::move(proof_source_details));
 }
 
 scoped_refptr<QuicCryptoServerConfig::Config>
 QuicCryptoServerConfig::GetConfigWithScid(StringPiece requested_scid) const {
   // In Chromium, we will dead lock if the lock is held by the current thread.
   // Chromium doesn't have AssertReaderHeld API call.
   // configs_lock_.AssertReaderHeld();
 
   if (!requested_scid.empty()) {
     ConfigMap::const_iterator it = configs_.find(requested_scid.as_string());
@@ skipping 232 matching lines @@
     // No valid source address token.
     found_error = true;
   }
 
   bool get_proof_failed = false;
   string serialized_config = primary_config->serialized;
   string chlo_hash;
   CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash);
   bool need_proof = true;
   need_proof = !crypto_proof->chain;
+  const QuicTag* tag_ptr;
+  size_t num_tags;
+  QuicTagVector connection_options;
+  if (client_hello.GetTaglist(kCOPT, &tag_ptr, &num_tags) == QUIC_NO_ERROR) {
+    connection_options.assign(tag_ptr, tag_ptr + num_tags);
+  }
   if (FLAGS_enable_async_get_proof) {
     if (need_proof) {
       // Make an async call to GetProof and setup the callback to trampoline
       // back into EvaluateClientHelloAfterGetProof
       std::unique_ptr<EvaluateClientHelloCallback> cb(
           new EvaluateClientHelloCallback(
               *this, found_error, server_ip, version, requested_config,
               primary_config, crypto_proof, client_hello_state,
               std::move(done_cb)));
       proof_source_->GetProof(server_ip, info->sni.as_string(),
                               serialized_config, version, chlo_hash,
-                              std::move(cb));
+                              connection_options, std::move(cb));
       helper.DetachCallback();
       return;
     }
   }
 
   // No need to get a new proof if one was already generated.
   if (need_proof &&
-      !proof_source_->GetProof(server_ip, info->sni.as_string(),
-                               serialized_config, version, chlo_hash,
-                               &crypto_proof->chain, &crypto_proof->signature,
-                               &crypto_proof->cert_sct)) {
+      !proof_source_->GetProof(
+          server_ip, info->sni.as_string(), serialized_config, version,
+          chlo_hash, connection_options, &crypto_proof->chain,
+          &crypto_proof->signature, &crypto_proof->cert_sct)) {
     get_proof_failed = true;
   }
 
   // Details are null because the synchronous version of GetProof does not
   // return any stats.  Eventually the synchronous codepath will be eliminated.
   EvaluateClientHelloAfterGetProof(
       found_error, server_ip, version, requested_config, primary_config,
       crypto_proof, nullptr /* proof_source_details */, get_proof_failed,
       client_hello_state, std::move(done_cb));
   helper.DetachCallback();
@@ skipping 116 matching lines @@
     QuicVersion version,
     StringPiece chlo_hash,
     const SourceAddressTokens& previous_source_address_tokens,
     const IPAddress& server_ip,
     const IPAddress& client_ip,
     const QuicClock* clock,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
     const CachedNetworkParameters* cached_network_params,
+    const QuicTagVector& connection_options,
     CryptoHandshakeMessage* out) const {
   string serialized;
   string source_address_token;
   QuicWallTime expiry_time = QuicWallTime::Zero();
   const CommonCertSets* common_cert_sets;
   {
     base::AutoLock locked(configs_lock_);
     serialized = primary_config_->serialized;
     common_cert_sets = primary_config_->common_cert_sets;
     expiry_time = primary_config_->expiry_time;
     source_address_token = NewSourceAddressToken(
         *primary_config_, previous_source_address_tokens, client_ip, rand,
         clock->WallNow(), cached_network_params);
   }
 
   out->set_tag(kSCUP);
   out->SetStringPiece(kSCFG, serialized);
   out->SetStringPiece(kSourceAddressTokenTag, source_address_token);
   out->SetValue(kSTTL,
                 expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds());
 
   scoped_refptr<ProofSource::Chain> chain;
   string signature;
   string cert_sct;
   if (!proof_source_->GetProof(server_ip, params.sni, serialized, version,
-                               chlo_hash, &chain, &signature, &cert_sct)) {
+                               chlo_hash, connection_options, &chain,
+                               &signature, &cert_sct)) {
     DVLOG(1) << "Server: failed to get proof.";
     return false;
   }
 
   const string compressed = CompressChain(
       compressed_certs_cache, chain, params.client_common_set_hashes,
       params.client_cached_cert_hashes, common_cert_sets);
 
   out->SetStringPiece(kCertificateTag, compressed);
   out->SetStringPiece(kPROF, signature);
@@ skipping 12 matching lines @@
     QuicVersion version,
     StringPiece chlo_hash,
     const SourceAddressTokens& previous_source_address_tokens,
     const IPAddress& server_ip,
     const IPAddress& client_ip,
     const QuicClock* clock,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
     const CachedNetworkParameters* cached_network_params,
+    const QuicTagVector& connection_options,
     std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const {
   string serialized;
   string source_address_token;
   const CommonCertSets* common_cert_sets;
   {
     base::AutoLock locked(configs_lock_);
     serialized = primary_config_->serialized;
     common_cert_sets = primary_config_->common_cert_sets;
     source_address_token = NewSourceAddressToken(
         *primary_config_, previous_source_address_tokens, client_ip, rand,
         clock->WallNow(), cached_network_params);
   }
 
   CryptoHandshakeMessage message;
   message.set_tag(kSCUP);
   message.SetStringPiece(kSCFG, serialized);
   message.SetStringPiece(kSourceAddressTokenTag, source_address_token);
 
   std::unique_ptr<BuildServerConfigUpdateMessageProofSourceCallback>
       proof_source_cb(new BuildServerConfigUpdateMessageProofSourceCallback(
           this, version, compressed_certs_cache, common_cert_sets, params,
           std::move(message), std::move(cb)));
 
+  // Note: We unconditionally use the async variant of GetProof here, unlike
+  // elsewhere in this file where we check for the kSYNC tag in the CHLO for the
+  // connection before deciding.  This call is not in the critical serving path,
+  // and so should not have much impact on the experiments associated with that
+  // tag (plus it would be a chore to plumb information about the tag down to
+  // here).
   proof_source_->GetProof(server_ip, params.sni, serialized, version, chlo_hash,
-                          std::move(proof_source_cb));
+                          connection_options, std::move(proof_source_cb));
 }
 
 QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback::
     ~BuildServerConfigUpdateMessageProofSourceCallback() {}
 
 QuicCryptoServerConfig::BuildServerConfigUpdateMessageProofSourceCallback::
     BuildServerConfigUpdateMessageProofSourceCallback(
         const QuicCryptoServerConfig* config,
         QuicVersion version,
         QuicCompressedCertsCache* compressed_certs_cache,
@@ skipping 676 matching lines @@
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {
 }
 
 QuicCryptoProof::QuicCryptoProof() {}
 QuicCryptoProof::~QuicCryptoProof() {}
 
 }  // namespace net