Allow QUIC clients to accept STK/SCFG updates on an existing connection.

net/quic/quic_crypto_client_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_crypto_client_stream.h"
 
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/crypto/crypto_utils.h"
 #include "net/quic/crypto/null_encrypter.h"
 #include "net/quic/quic_client_session_base.h"
@@ skipping 76 matching lines @@
   if (channel_id_source_callback_) {
     channel_id_source_callback_->Cancel();
   }
   if (proof_verify_callback_) {
     proof_verify_callback_->Cancel();
   }
 }
 
 void QuicCryptoClientStream::OnHandshakeMessage(
     const CryptoHandshakeMessage& message) {
+  DVLOG(1) << "Client: Received " << message.DebugString();
+
   QuicCryptoStream::OnHandshakeMessage(message);
 
+  if (message.tag() == kSCUP) {
+    if (!handshake_confirmed()) {
+      CloseConnection(QUIC_CRYPTO_UPDATE_BEFORE_HANDSHAKE_COMPLETE);
+      return;
+    }
+
+    // |message| is an update from the server, so we treat it differently from a
+    // handshake message.
+    HandleServerConfigUpdateMessage(&message);
+    return;
+  }
+
+  // Do not process handshake messages after the handshake is confirmed.
+  if (handshake_confirmed()) {
+    CloseConnection(QUIC_CRYPTO_MESSAGE_AFTER_HANDSHAKE_COMPLETE);
+    return;
+  }
+
   DoHandshakeLoop(&message);
 }
 
 bool QuicCryptoClientStream::CryptoConnect() {
   next_state_ = STATE_INITIALIZE;
   DoHandshakeLoop(NULL);
   return true;
 }
 
 int QuicCryptoClientStream::num_sent_client_hellos() const {
   return num_client_hellos_;
 }
 
 bool QuicCryptoClientStream::WasChannelIDSent() const {
   // TODO(rch): we should replace this with a boolean member so we
   // can free the memory associated with the key after we're finished with it.
   return channel_id_key_.get() != NULL;
 }
 
+void QuicCryptoClientStream::HandleServerConfigUpdateMessage(
+    const CryptoHandshakeMessage* in) {
+  DCHECK(in->tag() == kSCUP);
+  string error_details;
+  QuicCryptoClientConfig::CachedState* cached =
+      crypto_config_->LookupOrCreate(server_id_);
+  QuicErrorCode error = crypto_config_->ProcessServerConfigUpdate(
+      *in,
+      session()->connection()->clock()->WallNow(),
+      cached,
+      &crypto_negotiated_params_,
+      &error_details);
+
+  if (error != QUIC_NO_ERROR) {
+    CloseConnectionWithDetails(
+        error, "Server config update invalid: " + error_details);
+    return;
+  }
+}
+
 // kMaxClientHellos is the maximum number of times that we'll send a client
 // hello. The value 3 accounts for:
 //   * One failure due to an incorrect or missing source-address token.
 //   * One failure due the server's certificate chain being unavailible and the
 //     server being unwilling to send it without a valid source-address token.
 static const int kMaxClientHellos = 3;
 
 void QuicCryptoClientStream::DoHandshakeLoop(
     const CryptoHandshakeMessage* in) {
   CryptoHandshakeMessage out;
   QuicErrorCode error;
   string error_details;
   QuicCryptoClientConfig::CachedState* cached =
       crypto_config_->LookupOrCreate(server_id_);
 
-  if (in != NULL) {
-    DVLOG(1) << "Client: Received " << in->DebugString();
-  }
-
   for (;;) {
     const State state = next_state_;
     next_state_ = STATE_IDLE;
     switch (state) {
       case STATE_INITIALIZE: {
         if (!cached->IsEmpty() && !cached->proof_valid() &&
             !cached->signature().empty() && server_id_.is_https()) {
           DCHECK(crypto_config_->proof_verifier());
           // If the cached state needs to be verified, do it now.
           next_state_ = STATE_VERIFY_PROOF;
@@ skipping 309 matching lines @@
     }
   }
   return false;
 }
 
 QuicClientSessionBase* QuicCryptoClientStream::client_session() {
   return reinterpret_cast<QuicClientSessionBase*>(session());
 }
 
 }  // namespace net