Deprecate FLAGS_quic_reloadable_flag_enable_async_get_proof

net/quic/core/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 680 matching lines @@
   CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash);
 
   // No need to get a new proof if one was already generated.
   if (!signed_config->chain) {
     const QuicTag* tag_ptr;
     size_t num_tags;
     QuicTagVector connection_options;
     if (client_hello.GetTaglist(kCOPT, &tag_ptr, &num_tags) == QUIC_NO_ERROR) {
       connection_options.assign(tag_ptr, tag_ptr + num_tags);
     }
-    if (FLAGS_quic_reloadable_flag_enable_async_get_proof) {
-      std::unique_ptr<ProcessClientHelloCallback> cb(
-          new ProcessClientHelloCallback(
-              this, validate_chlo_result, reject_only, connection_id,
-              client_address, version, supported_versions,
-              use_stateless_rejects, server_designated_connection_id, clock,
-              rand, compressed_certs_cache, params, signed_config,
-              total_framing_overhead, chlo_packet_size, requested_config,
-              primary_config, std::move(done_cb)));
-      proof_source_->GetProof(server_address, info.sni.as_string(),
-                              primary_config->serialized, version, chlo_hash,
-                              connection_options, std::move(cb));
-      helper.DetachCallback();
-      return;
-    }
-
-    QuicCryptoProof proof;
-    if (!proof_source_->GetProof(server_address, info.sni.as_string(),
-                                 primary_config->serialized, version, chlo_hash,
-                                 connection_options, &signed_config->chain,
-                                 &proof)) {
-      helper.Fail(QUIC_HANDSHAKE_FAILED, "Missing or invalid crypto proof.");
-      return;
-    }
-    signed_config->proof = proof;
+    std::unique_ptr<ProcessClientHelloCallback> cb(
+        new ProcessClientHelloCallback(
+            this, validate_chlo_result, reject_only, connection_id,
+            client_address, version, supported_versions, use_stateless_rejects,
+            server_designated_connection_id, clock, rand,
+            compressed_certs_cache, params, signed_config,
+            total_framing_overhead, chlo_packet_size, requested_config,
+            primary_config, std::move(done_cb)));
+    proof_source_->GetProof(server_address, info.sni.as_string(),
+                            primary_config->serialized, version, chlo_hash,
+                            connection_options, std::move(cb));
+    helper.DetachCallback();
+    return;
   }
 
   helper.DetachCallback();
   ProcessClientHelloAfterGetProof(
       /* found_error = */ false, /* proof_source_details = */ nullptr,
       *validate_chlo_result, reject_only, connection_id, client_address,
       version, supported_versions, use_stateless_rejects,
       server_designated_connection_id, clock, rand, compressed_certs_cache,
       params, signed_config, total_framing_overhead, chlo_packet_size,
       requested_config, primary_config, std::move(done_cb));
@@ skipping 532 matching lines @@
   string chlo_hash;
   CryptoUtils::HashHandshakeMessage(client_hello, &chlo_hash);
   bool need_proof = true;
   need_proof = !signed_config->chain;
   const QuicTag* tag_ptr;
   size_t num_tags;
   QuicTagVector connection_options;
   if (client_hello.GetTaglist(kCOPT, &tag_ptr, &num_tags) == QUIC_NO_ERROR) {
     connection_options.assign(tag_ptr, tag_ptr + num_tags);
   }
-  if (FLAGS_quic_reloadable_flag_enable_async_get_proof) {
-    if (need_proof) {
-      // Make an async call to GetProof and setup the callback to trampoline
-      // back into EvaluateClientHelloAfterGetProof
-      std::unique_ptr<EvaluateClientHelloCallback> cb(
-          new EvaluateClientHelloCallback(
-              *this, found_error, server_address.host(), version,
-              requested_config, primary_config, signed_config,
-              client_hello_state, std::move(done_cb)));
-      proof_source_->GetProof(server_address, info->sni.as_string(),
-                              serialized_config, version, chlo_hash,
-                              connection_options, std::move(cb));
-      helper.DetachCallback();
-      return;
-    }
-  }
 
-  // No need to get a new proof if one was already generated.
   if (need_proof) {
-    QuicCryptoProof proof;
-
-    if (proof_source_->GetProof(
-            server_address, info->sni.as_string(), serialized_config, version,
-            chlo_hash, connection_options, &signed_config->chain, &proof)) {
-      signed_config->proof = proof;
-    } else {
-      get_proof_failed = true;
-    }
+    // Make an async call to GetProof and setup the callback to trampoline
+    // back into EvaluateClientHelloAfterGetProof
+    std::unique_ptr<EvaluateClientHelloCallback> cb(
+        new EvaluateClientHelloCallback(
+            *this, found_error, server_address.host(), version,
+            requested_config, primary_config, signed_config, client_hello_state,
+            std::move(done_cb)));
+    proof_source_->GetProof(server_address, info->sni.as_string(),
+                            serialized_config, version, chlo_hash,
+                            connection_options, std::move(cb));
+    helper.DetachCallback();
+    return;
   }
 
   // Details are null because the synchronous version of GetProof does not
   // return any stats.  Eventually the synchronous codepath will be eliminated.
   EvaluateClientHelloAfterGetProof(
       found_error, server_address.host(), version, requested_config,
       primary_config, signed_config, nullptr /* proof_source_details */,
       get_proof_failed, client_hello_state, std::move(done_cb));
   helper.DetachCallback();
 }
@@ skipping 38 matching lines @@
   QUIC_DVLOG(1) << "No 0-RTT replay protection in QUIC_VERSION_33 and higher.";
   // If the server nonce is empty and we're requiring handshake confirmation
   // for DoS reasons then we must reject the CHLO.
   if (FLAGS_quic_reloadable_flag_quic_require_handshake_confirmation &&
       info->server_nonce.empty()) {
     info->reject_reasons.push_back(SERVER_NONCE_REQUIRED_FAILURE);
   }
   helper.ValidationComplete(QUIC_NO_ERROR, "", std::move(proof_source_details));
 }
 
-bool QuicCryptoServerConfig::BuildServerConfigUpdateMessage(
-    QuicVersion version,
-    StringPiece chlo_hash,
-    const SourceAddressTokens& previous_source_address_tokens,
-    const QuicSocketAddress& server_address,
-    const QuicIpAddress& client_ip,
-    const QuicClock* clock,
-    QuicRandom* rand,
-    QuicCompressedCertsCache* compressed_certs_cache,
-    const QuicCryptoNegotiatedParameters& params,
-    const CachedNetworkParameters* cached_network_params,
-    const QuicTagVector& connection_options,
-    CryptoHandshakeMessage* out) const {
-  string serialized;
-  string source_address_token;
-  QuicWallTime expiry_time = QuicWallTime::Zero();
-  const CommonCertSets* common_cert_sets;
-  {
-    QuicReaderMutexLock locked(&configs_lock_);
-    serialized = primary_config_->serialized;
-    common_cert_sets = primary_config_->common_cert_sets;
-    expiry_time = primary_config_->expiry_time;
-    source_address_token = NewSourceAddressToken(
-        *primary_config_, previous_source_address_tokens, client_ip, rand,
-        clock->WallNow(), cached_network_params);
-  }
-
-  out->set_tag(kSCUP);
-  out->SetStringPiece(kSCFG, serialized);
-  out->SetStringPiece(kSourceAddressTokenTag, source_address_token);
-  out->SetValue(kSTTL,
-                expiry_time.AbsoluteDifference(clock->WallNow()).ToSeconds());
-
-  QuicReferenceCountedPointer<ProofSource::Chain> chain;
-  QuicCryptoProof proof;
-  if (!proof_source_->GetProof(server_address, params.sni, serialized, version,
-                               chlo_hash, connection_options, &chain, &proof)) {
-    QUIC_DVLOG(1) << "Server: failed to get proof.";
-    return false;
-  }
-
-  const string compressed = CompressChain(
-      compressed_certs_cache, chain, params.client_common_set_hashes,
-      params.client_cached_cert_hashes, common_cert_sets);
-
-  out->SetStringPiece(kCertificateTag, compressed);
-  out->SetStringPiece(kPROF, proof.signature);
-  if (params.sct_supported_by_client && enable_serving_sct_) {
-    if (proof.leaf_cert_scts.empty()) {
-      QUIC_LOG_EVERY_N_SEC(WARNING, 60)
-          << "SCT is expected but it is empty.  sni: " << params.sni
-          << " server_address: " << server_address.ToString();
-    } else {
-      out->SetStringPiece(kCertificateSCTTag, proof.leaf_cert_scts);
-    }
-  }
-  return true;
-}
-
 void QuicCryptoServerConfig::BuildServerConfigUpdateMessage(
     QuicVersion version,
     StringPiece chlo_hash,
     const SourceAddressTokens& previous_source_address_tokens,
     const QuicSocketAddress& server_address,
     const QuicIpAddress& client_ip,
     const QuicClock* clock,
     QuicRandom* rand,
     QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
@@ skipping 603 matching lines @@
       expiry_time(QuicWallTime::Zero()),
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {}
 
 QuicSignedServerConfig::QuicSignedServerConfig() {}
 QuicSignedServerConfig::~QuicSignedServerConfig() {}
 
 }  // namespace net