QUIC - Record reject reasons for CHLO message.

net/quic/crypto/quic_crypto_client_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_client_config.h"
 
+#include "base/metrics/sparse_histogram.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "net/quic/crypto/cert_compressor.h"
 #include "net/quic/crypto/chacha20_poly1305_encrypter.h"
 #include "net/quic/crypto/channel_id.h"
 #include "net/quic/crypto/common_cert_set.h"
 #include "net/quic/crypto/crypto_framer.h"
 #include "net/quic/crypto/crypto_utils.h"
 #include "net/quic/crypto/curve25519_key_exchange.h"
 #include "net/quic/crypto/key_exchange.h"
@@ skipping 568 matching lines @@
       *error_details = "Proof missing";
       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
     }
   }
 
   const uint32* reject_reasons;
   size_t num_reject_reasons;
   COMPILE_ASSERT(sizeof(QuicTag) == sizeof(uint32), header_out_of_sync);
   if (rej.GetTaglist(kRREJ, &reject_reasons,
                      &num_reject_reasons) == QUIC_NO_ERROR) {
-#if defined(DEBUG)
+    uint32 packed_error = 0;
     for (size_t i = 0; i < num_reject_reasons; ++i) {
-      DVLOG(1) << "Reasons for rejection: " << reject_reasons[i];
+      HandshakeFailureReason reason =
+          static_cast<HandshakeFailureReason>(reject_reasons[i]);
+      packed_error |= RejectReasonToPackedError(reason);
     }
-#endif
+    UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons",
+                                packed_error);
   }
 
   return QUIC_NO_ERROR;
 }
 
+uint32 QuicCryptoClientConfig::RejectReasonToPackedError(
+    HandshakeFailureReason reason) {
+  enum RejectReasonShifted {
+    HANDSHAKE_OK_SHIFTED = 0,
+
+    CLIENT_NONCE_UNKNOWN_FAILURE_SHIFTED = 1u << 5,
+    CLIENT_NONCE_INVALID_FAILURE_SHIFTED = 2u << 5,
+
+    SERVER_NONCE_INVALID_FAILURE_SHIFTED = 1u << 10,
+    SERVER_NONCE_DECRYPTION_FAILURE_SHIFTED = 2u << 10,
+    SERVER_NONCE_NOT_UNIQUE_FAILURE_SHIFTED = 3u << 10,
+
+    SERVER_CONFIG_INCHOATE_HELLO_FAILURE_SHIFTED = 1u << 15,
+    SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE_SHIFTED = 2u << 15,
+
+    SOURCE_ADDRESS_TOKEN_INVALID_FAILURE_SHIFTED = 1u << 20,
+    SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE_SHIFTED = 2u << 20,
+    SOURCE_ADDRESS_TOKEN_PARSE_FAILURE_SHIFTED = 3u << 20,
+    SOURCE_ADDRESS_TOKEN_DIFFERENT_IP_ADDRESS_FAILURE_SHIFTED = 4u << 20,
+    SOURCE_ADDRESS_TOKEN_CLOCK_SKEW_FAILURE_SHIFTED = 5u << 20,
+    SOURCE_ADDRESS_TOKEN_EXPIRED_FAILURE_SHIFTED = 6u << 20,
+
+    UNKNOWN_REJECT_REASON_SHIFTED = 1u << 31,
+  };
+
+  switch (reason) {
+    case HANDSHAKE_OK:
+      return HANDSHAKE_OK_SHIFTED;

[Ryan Hamilton, 2014/06/23 23:09:43]

As discussed offline, might as well just make the return values explicit here.

[ramant (doing other things), 2014/06/23 23:14:17]

Done.

+    case CLIENT_NONCE_UNKNOWN_FAILURE:
+      return CLIENT_NONCE_UNKNOWN_FAILURE_SHIFTED;
+    case CLIENT_NONCE_INVALID_FAILURE:
+      return CLIENT_NONCE_INVALID_FAILURE_SHIFTED;
+    case SERVER_NONCE_INVALID_FAILURE:
+      return SERVER_NONCE_INVALID_FAILURE_SHIFTED;
+    case SERVER_NONCE_DECRYPTION_FAILURE:
+      return SERVER_NONCE_DECRYPTION_FAILURE_SHIFTED;
+    case SERVER_NONCE_NOT_UNIQUE_FAILURE:
+      return SERVER_NONCE_NOT_UNIQUE_FAILURE_SHIFTED;
+    case SERVER_CONFIG_INCHOATE_HELLO_FAILURE:
+      return SERVER_CONFIG_INCHOATE_HELLO_FAILURE_SHIFTED;
+    case SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE:
+      return SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_INVALID_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_INVALID_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_PARSE_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_PARSE_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_DIFFERENT_IP_ADDRESS_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_DIFFERENT_IP_ADDRESS_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_CLOCK_SKEW_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_CLOCK_SKEW_FAILURE_SHIFTED;
+    case SOURCE_ADDRESS_TOKEN_EXPIRED_FAILURE:
+      return SOURCE_ADDRESS_TOKEN_EXPIRED_FAILURE_SHIFTED;
+    default:
+      NOTREACHED();
+      return UNKNOWN_REJECT_REASON_SHIFTED;
+  }
+}
+
 QuicErrorCode QuicCryptoClientConfig::ProcessServerHello(
     const CryptoHandshakeMessage& server_hello,
     QuicConnectionId connection_id,
     const QuicVersionVector& negotiated_versions,
     CachedState* cached,
     QuicCryptoNegotiatedParameters* out_params,
     string* error_details) {
   DCHECK(error_details != NULL);
 
   if (server_hello.tag() != kSHLO) {
@@ skipping 141 matching lines @@
     return;
   }
 
   // Update canonical version to point at the "most recent" entry.
   canonical_server_map_[suffix_server_id] = server_id;
 
   server_state->InitializeFrom(*canonical_state);
 }
 
 }  // namespace net