Prevent multiple simultaneous calls to GetProof

net/quic/core/quic_crypto_server_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/quic_crypto_server_stream.h"
 
 #include <memory>
 
 #include "net/quic/core/crypto/crypto_protocol.h"
 #include "net/quic/core/crypto/crypto_utils.h"
@@ skipping 25 matching lines @@
   void Run(QuicErrorCode error,
            const string& error_details,
            std::unique_ptr<CryptoHandshakeMessage> message,
            std::unique_ptr<DiversificationNonce> diversification_nonce,
            std::unique_ptr<net::ProofSource::Details> proof_source_details)
       override {
     if (stream_ == nullptr) {
       return;
     }
 
-    // Note: set the parent's callback to nullptr here because
-    // FinishProcessingHandshakeMessageAfterProcessClientHello can be invoked
-    // from either synchronous or asynchronous codepaths.  When the synchronous
-    // codepaths are removed, this assignment should move to
-    // FinishProcessingHandshakeMessageAfterProcessClientHello.
-    stream_->process_client_hello_cb_ = nullptr;
-
     stream_->FinishProcessingHandshakeMessageAfterProcessClientHello(
         *result_, error, error_details, std::move(message),
         std::move(diversification_nonce), std::move(proof_source_details));
   }
 
   void Cancel() { stream_ = nullptr; }
 
  private:
   QuicCryptoServerStream* stream_;
   QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result>
@@ skipping 26 matching lines @@
 QuicCryptoServerStream::QuicCryptoServerStream(
     const QuicCryptoServerConfig* crypto_config,
     QuicCompressedCertsCache* compressed_certs_cache,
     bool use_stateless_rejects_if_peer_supported,
     QuicSession* session,
     Helper* helper)
     : QuicCryptoServerStreamBase(session),
       crypto_config_(crypto_config),
       compressed_certs_cache_(compressed_certs_cache),
       signed_config_(new QuicSignedServerConfig),
-      validate_client_hello_cb_(nullptr),
       helper_(helper),
       num_handshake_messages_(0),
       num_handshake_messages_with_server_nonces_(0),
       send_server_config_update_cb_(nullptr),
       num_server_config_update_messages_sent_(0),
       use_stateless_rejects_if_peer_supported_(
           use_stateless_rejects_if_peer_supported),
       peer_supports_stateless_rejects_(false),
       chlo_packet_size_(0),
+      validate_client_hello_cb_(nullptr),
       process_client_hello_cb_(nullptr) {
   DCHECK_EQ(Perspective::IS_SERVER, session->connection()->perspective());
 }
 
 QuicCryptoServerStream::~QuicCryptoServerStream() {
   CancelOutstandingCallbacks();
 }
 
 void QuicCryptoServerStream::CancelOutstandingCallbacks() {
   // Detach from the validation callback.  Calling this multiple times is safe.
@@ skipping 23 matching lines @@
                                "Unexpected handshake message from client");
     return;
   }
 
   if (message.tag() != kCHLO) {
     CloseConnectionWithDetails(QUIC_INVALID_CRYPTO_MESSAGE_TYPE,
                                "Handshake packet not CHLO");
     return;
   }
 
-  if (validate_client_hello_cb_ != nullptr) {
+  if (validate_client_hello_cb_ != nullptr ||
+      (base::GetFlag(FLAGS_quic_reloadable_flag_fix_quic_callback_crash) &&
+       process_client_hello_cb_ != nullptr)) {
     // Already processing some other handshake message.  The protocol
     // does not allow for clients to send multiple handshake messages
     // before the server has a chance to respond.
     CloseConnectionWithDetails(
         QUIC_CRYPTO_MESSAGE_WHILE_VALIDATING_CLIENT_HELLO,
         "Unexpected handshake message while processing CHLO");
     return;
   }
 
   CryptoUtils::HashHandshakeMessage(message, &chlo_hash_);
 
   std::unique_ptr<ValidateCallback> cb(new ValidateCallback(this));
+  DCHECK(validate_client_hello_cb_ == nullptr);
+  DCHECK(process_client_hello_cb_ == nullptr);
   validate_client_hello_cb_ = cb.get();
   crypto_config_->ValidateClientHello(
       message, session()->connection()->peer_address().host(),
       session()->connection()->self_address(), version(),
       session()->connection()->clock(), signed_config_, std::move(cb));
 }
 
 void QuicCryptoServerStream::FinishProcessingHandshakeMessage(
     QuicReferenceCountedPointer<ValidateClientHelloResultCallback::Result>
         result,
     std::unique_ptr<ProofSource::Details> details) {
   const CryptoHandshakeMessage& message = result->client_hello;
 
   // Clear the callback that got us here.
   DCHECK(validate_client_hello_cb_ != nullptr);
+  DCHECK(process_client_hello_cb_ == nullptr);
   validate_client_hello_cb_ = nullptr;
 
   if (use_stateless_rejects_if_peer_supported_) {
     peer_supports_stateless_rejects_ = DoesPeerSupportStatelessRejects(message);
   }
 
   std::unique_ptr<ProcessClientHelloCallback> cb(
       new ProcessClientHelloCallback(this, result));
   process_client_hello_cb_ = cb.get();
   ProcessClientHello(result, std::move(details), std::move(cb));
 }
 
 void QuicCryptoServerStream::
     FinishProcessingHandshakeMessageAfterProcessClientHello(
         const ValidateClientHelloResultCallback::Result& result,
         QuicErrorCode error,
         const string& error_details,
         std::unique_ptr<CryptoHandshakeMessage> reply,
         std::unique_ptr<DiversificationNonce> diversification_nonce,
         std::unique_ptr<ProofSource::Details> proof_source_details) {
+  // Clear the callback that got us here.
+  DCHECK(process_client_hello_cb_ != nullptr);
+  DCHECK(validate_client_hello_cb_ == nullptr);
+  process_client_hello_cb_ = nullptr;
+
   const CryptoHandshakeMessage& message = result.client_hello;
   if (error != QUIC_NO_ERROR) {
     CloseConnectionWithDetails(error, error_details);
     return;
   }
 
   if (reply->tag() != kSHLO) {
     if (reply->tag() == kSREJ) {
       DCHECK(use_stateless_rejects_if_peer_supported_);
       DCHECK(peer_supports_stateless_rejects_);
@@ skipping 251 matching lines @@
 QuicConnectionId QuicCryptoServerStream::GenerateConnectionIdForReject(
     bool use_stateless_rejects) {
   if (!use_stateless_rejects) {
     return 0;
   }
   return helper_->GenerateConnectionIdForReject(
       session()->connection()->connection_id());
 }
 
 }  // namespace net