Index: net/quic/crypto/quic_crypto_client_config.cc |
diff --git a/net/quic/crypto/quic_crypto_client_config.cc b/net/quic/crypto/quic_crypto_client_config.cc |
index 9347493082d6e52d06e467d7dc8e3cfff2dad391..17e6f36939cf099e918f1cec3e5f4ab60d0ade40 100644 |
--- a/net/quic/crypto/quic_crypto_client_config.cc |
+++ b/net/quic/crypto/quic_crypto_client_config.cc |
@@ -28,18 +28,19 @@ using std::vector; |
namespace net { |
-QuicCryptoClientConfig::QuicCryptoClientConfig() |
- : disable_ecdsa_(false) {} |
+QuicCryptoClientConfig::QuicCryptoClientConfig() : disable_ecdsa_(false) { |
+} |
QuicCryptoClientConfig::~QuicCryptoClientConfig() { |
STLDeleteValues(&cached_states_); |
} |
QuicCryptoClientConfig::CachedState::CachedState() |
- : server_config_valid_(false), |
- generation_counter_(0) {} |
+ : server_config_valid_(false), generation_counter_(0) { |
+} |
-QuicCryptoClientConfig::CachedState::~CachedState() {} |
+QuicCryptoClientConfig::CachedState::~CachedState() { |
+} |
bool QuicCryptoClientConfig::CachedState::IsComplete(QuicWallTime now) const { |
if (server_config_.empty() || !server_config_valid_) { |
@@ -80,7 +81,9 @@ QuicCryptoClientConfig::CachedState::GetServerConfig() const { |
} |
QuicErrorCode QuicCryptoClientConfig::CachedState::SetServerConfig( |
- StringPiece server_config, QuicWallTime now, string* error_details) { |
+ StringPiece server_config, |
+ QuicWallTime now, |
+ string* error_details) { |
const bool matches_existing = server_config == server_config_; |
// Even if the new server config matches the existing one, we still wish to |
@@ -188,8 +191,7 @@ bool QuicCryptoClientConfig::CachedState::Initialize( |
} |
string error_details; |
- QuicErrorCode error = SetServerConfig(server_config, now, |
- &error_details); |
+ QuicErrorCode error = SetServerConfig(server_config, now, &error_details); |
if (error != QUIC_NO_ERROR) { |
DVLOG(1) << "SetServerConfig failed with " << error_details; |
return false; |
@@ -205,8 +207,8 @@ const string& QuicCryptoClientConfig::CachedState::server_config() const { |
return server_config_; |
} |
-const string& |
-QuicCryptoClientConfig::CachedState::source_address_token() const { |
+const string& QuicCryptoClientConfig::CachedState::source_address_token() |
+ const { |
return source_address_token_; |
} |
@@ -284,7 +286,8 @@ QuicCryptoClientConfig::CachedState* QuicCryptoClientConfig::LookupOrCreate( |
void QuicCryptoClientConfig::ClearCachedStates() { |
for (CachedStateMap::const_iterator it = cached_states_.begin(); |
- it != cached_states_.end(); ++it) { |
+ it != cached_states_.end(); |
+ ++it) { |
it->second->Clear(); |
} |
} |
@@ -330,8 +333,8 @@ void QuicCryptoClientConfig::FillInchoateClientHello( |
if (!certs.empty()) { |
vector<uint64> hashes; |
hashes.reserve(certs.size()); |
- for (vector<string>::const_iterator i = certs.begin(); |
- i != certs.end(); ++i) { |
+ for (vector<string>::const_iterator i = certs.begin(); i != certs.end(); |
+ ++i) { |
hashes.push_back(QuicUtils::FNV1a_64_Hash(i->data(), i->size())); |
} |
out->SetVector(kCCRT, hashes); |
@@ -351,8 +354,8 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
string* error_details) const { |
DCHECK(error_details != NULL); |
- FillInchoateClientHello(server_id, preferred_version, cached, |
- out_params, out); |
+ FillInchoateClientHello( |
+ server_id, preferred_version, cached, out_params, out); |
// Set initial receive window for flow control. |
out->SetValue(kIFCW, initial_flow_control_window_bytes); |
@@ -375,10 +378,10 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
const QuicTag* their_aeads; |
const QuicTag* their_key_exchanges; |
size_t num_their_aeads, num_their_key_exchanges; |
- if (scfg->GetTaglist(kAEAD, &their_aeads, |
- &num_their_aeads) != QUIC_NO_ERROR || |
- scfg->GetTaglist(kKEXS, &their_key_exchanges, |
- &num_their_key_exchanges) != QUIC_NO_ERROR) { |
+ if (scfg->GetTaglist(kAEAD, &their_aeads, &num_their_aeads) != |
+ QUIC_NO_ERROR || |
+ scfg->GetTaglist(kKEXS, &their_key_exchanges, &num_their_key_exchanges) != |
+ QUIC_NO_ERROR) { |
*error_details = "Missing AEAD or KEXS"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
} |
@@ -389,13 +392,18 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
// Key exchange: the client does more work than the server, so favor the |
// client's preference. |
size_t key_exchange_index; |
- if (!QuicUtils::FindMutualTag( |
- aead, their_aeads, num_their_aeads, QuicUtils::LOCAL_PRIORITY, |
- &out_params->aead, NULL) || |
- !QuicUtils::FindMutualTag( |
- kexs, their_key_exchanges, num_their_key_exchanges, |
- QuicUtils::LOCAL_PRIORITY, &out_params->key_exchange, |
- &key_exchange_index)) { |
+ if (!QuicUtils::FindMutualTag(aead, |
+ their_aeads, |
+ num_their_aeads, |
+ QuicUtils::LOCAL_PRIORITY, |
+ &out_params->aead, |
+ NULL) || |
+ !QuicUtils::FindMutualTag(kexs, |
+ their_key_exchanges, |
+ num_their_key_exchanges, |
+ QuicUtils::LOCAL_PRIORITY, |
+ &out_params->key_exchange, |
+ &key_exchange_index)) { |
*error_details = "Unsupported AEAD or KEXS"; |
return QUIC_CRYPTO_NO_SUPPORT; |
} |
@@ -404,7 +412,7 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
StringPiece public_value; |
if (scfg->GetNthValue24(kPUBS, key_exchange_index, &public_value) != |
- QUIC_NO_ERROR) { |
+ QUIC_NO_ERROR) { |
*error_details = "Missing public value"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
} |
@@ -427,8 +435,8 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
Curve25519KeyExchange::NewPrivateKey(rand))); |
break; |
case kP256: |
- out_params->client_key_exchange.reset(P256KeyExchange::New( |
- P256KeyExchange::NewPrivateKey())); |
+ out_params->client_key_exchange.reset( |
+ P256KeyExchange::New(P256KeyExchange::NewPrivateKey())); |
break; |
default: |
DCHECK(false); |
@@ -447,7 +455,8 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
if (channel_id_signer_.get()) { |
const QuicTag* their_proof_demands; |
size_t num_their_proof_demands; |
- if (scfg->GetTaglist(kPDMD, &their_proof_demands, |
+ if (scfg->GetTaglist(kPDMD, |
+ &their_proof_demands, |
&num_their_proof_demands) == QUIC_NO_ERROR) { |
for (size_t i = 0; i < num_their_proof_demands; i++) { |
if (their_proof_demands[i] == kCHID) { |
@@ -479,8 +488,8 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
hkdf_input.append(cached->server_config()); |
string key, signature; |
- if (!channel_id_signer_->Sign(server_id.host(), hkdf_input, |
- &key, &signature)) { |
+ if (!channel_id_signer_->Sign( |
+ server_id.host(), hkdf_input, &key, &signature)) { |
*error_details = "Channel ID signature failed"; |
return QUIC_INVALID_CHANNEL_ID_SIGNATURE; |
} |
@@ -490,18 +499,21 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
CrypterPair crypters; |
if (!CryptoUtils::DeriveKeys(out_params->initial_premaster_secret, |
- out_params->aead, out_params->client_nonce, |
- out_params->server_nonce, hkdf_input, |
- CryptoUtils::CLIENT, &crypters)) { |
+ out_params->aead, |
+ out_params->client_nonce, |
+ out_params->server_nonce, |
+ hkdf_input, |
+ CryptoUtils::CLIENT, |
+ &crypters)) { |
*error_details = "Symmetric key setup failed"; |
return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED; |
} |
const QuicData& cetv_plaintext = cetv.GetSerialized(); |
- scoped_ptr<QuicData> cetv_ciphertext(crypters.encrypter->EncryptPacket( |
- 0 /* sequence number */, |
- StringPiece() /* associated data */, |
- cetv_plaintext.AsStringPiece())); |
+ scoped_ptr<QuicData> cetv_ciphertext( |
+ crypters.encrypter->EncryptPacket(0 /* sequence number */, |
+ StringPiece() /* associated data */, |
+ cetv_plaintext.AsStringPiece())); |
if (!cetv_ciphertext.get()) { |
*error_details = "Packet encryption failed"; |
return QUIC_ENCRYPTION_FAILURE; |
@@ -527,10 +539,13 @@ QuicErrorCode QuicCryptoClientConfig::FillClientHello( |
hkdf_input.append(QuicCryptoConfig::kInitialLabel, label_len); |
hkdf_input.append(out_params->hkdf_input_suffix); |
- if (!CryptoUtils::DeriveKeys( |
- out_params->initial_premaster_secret, out_params->aead, |
- out_params->client_nonce, out_params->server_nonce, hkdf_input, |
- CryptoUtils::CLIENT, &out_params->initial_crypters)) { |
+ if (!CryptoUtils::DeriveKeys(out_params->initial_premaster_secret, |
+ out_params->aead, |
+ out_params->client_nonce, |
+ out_params->server_nonce, |
+ hkdf_input, |
+ CryptoUtils::CLIENT, |
+ &out_params->initial_crypters)) { |
*error_details = "Symmetric key setup failed"; |
return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED; |
} |
@@ -577,8 +592,8 @@ QuicErrorCode QuicCryptoClientConfig::ProcessRejection( |
bool has_cert = rej.GetStringPiece(kCertificateTag, &cert_bytes); |
if (has_proof && has_cert) { |
vector<string> certs; |
- if (!CertCompressor::DecompressChain(cert_bytes, out_params->cached_certs, |
- common_cert_sets, &certs)) { |
+ if (!CertCompressor::DecompressChain( |
+ cert_bytes, out_params->cached_certs, common_cert_sets, &certs)) { |
*error_details = "Certificate data invalid"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
} |
@@ -617,7 +632,8 @@ QuicErrorCode QuicCryptoClientConfig::ProcessServerHello( |
const QuicTag* supported_version_tags; |
size_t num_supported_versions; |
- if (server_hello.GetTaglist(kVER, &supported_version_tags, |
+ if (server_hello.GetTaglist(kVER, |
+ &supported_version_tags, |
&num_supported_versions) != QUIC_NO_ERROR) { |
*error_details = "server hello missing version list"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |
@@ -626,11 +642,11 @@ QuicErrorCode QuicCryptoClientConfig::ProcessServerHello( |
bool mismatch = num_supported_versions != negotiated_versions.size(); |
for (size_t i = 0; i < num_supported_versions && !mismatch; ++i) { |
mismatch = QuicTagToQuicVersion(supported_version_tags[i]) != |
- negotiated_versions[i]; |
+ negotiated_versions[i]; |
} |
// The server sent a list of supported versions, and the connection |
// reports that there was a version negotiation during the handshake. |
- // Ensure that these two lists are identical. |
+ // Ensure that these two lists are identical. |
if (mismatch) { |
*error_details = "Downgrade attack detected"; |
return QUIC_VERSION_NEGOTIATION_MISMATCH; |
@@ -664,10 +680,13 @@ QuicErrorCode QuicCryptoClientConfig::ProcessServerHello( |
hkdf_input.append(QuicCryptoConfig::kForwardSecureLabel, label_len); |
hkdf_input.append(out_params->hkdf_input_suffix); |
- if (!CryptoUtils::DeriveKeys( |
- out_params->forward_secure_premaster_secret, out_params->aead, |
- out_params->client_nonce, out_params->server_nonce, hkdf_input, |
- CryptoUtils::CLIENT, &out_params->forward_secure_crypters)) { |
+ if (!CryptoUtils::DeriveKeys(out_params->forward_secure_premaster_secret, |
+ out_params->aead, |
+ out_params->client_nonce, |
+ out_params->server_nonce, |
+ hkdf_input, |
+ CryptoUtils::CLIENT, |
+ &out_params->forward_secure_crypters)) { |
*error_details = "Symmetric key setup failed"; |
return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED; |
} |
@@ -737,7 +756,8 @@ void QuicCryptoClientConfig::PopulateFromCanonicalConfig( |
if (i == canoncial_suffixes_.size()) |
return; |
- QuicServerId suffix_server_id(canoncial_suffixes_[i], server_id.port(), |
+ QuicServerId suffix_server_id(canoncial_suffixes_[i], |
+ server_id.port(), |
server_id.is_https(), |
server_id.privacy_mode()); |
if (!ContainsKey(canonical_server_map_, suffix_server_id)) { |