Land Recent QUIC changes.

net/quic/crypto/crypto_server_config.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/crypto_server_config.h"
 
 #include <stdlib.h>
 #include <algorithm>
 
 #include "base/stl_util.h"
@@ skipping 32 matching lines @@
 // static
 const char QuicCryptoServerConfig::TESTING[] = "secret string for testing";
 
 QuicCryptoServerConfig::ConfigOptions::ConfigOptions()
     : expiry_time(QuicWallTime::Zero()),
       channel_id_enabled(false) { }
 
 QuicCryptoServerConfig::QuicCryptoServerConfig(
     StringPiece source_address_token_secret,
     QuicRandom* rand)
-    : configs_lock_(),
+    : replay_protection_(true),
+      configs_lock_(),
       primary_config_(NULL),
       next_config_promotion_time_(QuicWallTime::Zero()),
       strike_register_lock_(),
       server_nonce_strike_register_lock_(),
       strike_register_max_entries_(1 << 10),
       strike_register_window_secs_(600),
       source_address_token_future_secs_(3600),
       source_address_token_lifetime_secs_(86400),
       server_nonce_strike_register_max_entries_(1 << 10),
       server_nonce_strike_register_window_secs_(120) {
@@ skipping 548 matching lines @@
     *error_details = "Invalid SNI name";
     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
   }
 
   // The client nonce is used first to try and establish uniqueness.
   bool unique_by_strike_register = false;
 
   if (client_hello.GetStringPiece(kNONC, &info->client_nonce) &&
       info->client_nonce.size() == kNonceSize) {
     info->client_nonce_well_formed = true;
-    base::AutoLock auto_lock(strike_register_lock_);
+    if (replay_protection_) {
+      base::AutoLock auto_lock(strike_register_lock_);
 
-    if (strike_register_.get() == NULL) {
-      strike_register_.reset(new StrikeRegister(
-          strike_register_max_entries_,
-          static_cast<uint32>(info->now.ToUNIXSeconds()),
-          strike_register_window_secs_,
-          orbit,
-          StrikeRegister::DENY_REQUESTS_AT_STARTUP));
+      if (strike_register_.get() == NULL) {
+        strike_register_.reset(new StrikeRegister(
+            strike_register_max_entries_,
+            static_cast<uint32>(info->now.ToUNIXSeconds()),
+            strike_register_window_secs_,
+            orbit,
+            StrikeRegister::DENY_REQUESTS_AT_STARTUP));
+      }
+
+      unique_by_strike_register = strike_register_->Insert(
+          reinterpret_cast<const uint8*>(info->client_nonce.data()),
+          static_cast<uint32>(info->now.ToUNIXSeconds()));
     }
-    unique_by_strike_register = strike_register_->Insert(
-        reinterpret_cast<const uint8*>(info->client_nonce.data()),
-        static_cast<uint32>(info->now.ToUNIXSeconds()));
   }
 
   client_hello.GetStringPiece(kServerNonceTag, &info->server_nonce);
 
   // If the client nonce didn't establish uniqueness then an echoed server
   // nonce may.
   bool unique_by_server_nonce = false;
-  if (!unique_by_strike_register && !info->server_nonce.empty()) {
+  if (replay_protection_ &&
+      !unique_by_strike_register &&
+      !info->server_nonce.empty()) {
     unique_by_server_nonce = ValidateServerNonce(info->server_nonce, info->now);
   }
 
-  info->unique = unique_by_strike_register || unique_by_server_nonce;
+  info->unique = !replay_protection_ ||
+                 unique_by_strike_register ||
+                 unique_by_server_nonce;
 
   return QUIC_NO_ERROR;
 }
 
 void QuicCryptoServerConfig::BuildRejection(
     const scoped_refptr<Config>& config,
     const CryptoHandshakeMessage& client_hello,
     const ClientHelloInfo& info,
     QuicRandom* rand,
     CryptoHandshakeMessage* out) const {
   out->set_tag(kREJ);
   out->SetStringPiece(kSCFG, config->serialized);
   out->SetStringPiece(kSourceAddressTokenTag,
                       NewSourceAddressToken(info.client_ip, rand, info.now));
-  out->SetStringPiece(kServerNonceTag, NewServerNonce(rand, info.now));
+  if (replay_protection_) {
+    out->SetStringPiece(kServerNonceTag, NewServerNonce(rand, info.now));
+  }
 
   // The client may have requested a certificate chain.
   const QuicTag* their_proof_demands;
   size_t num_their_proof_demands;
 
   if (proof_source_.get() != NULL && !info.sni.empty() &&
       client_hello.GetTaglist(kPDMD, &their_proof_demands,
                               &num_their_proof_demands) ==
           QUIC_NO_ERROR) {
     for (size_t i = 0; i < num_their_proof_demands; i++) {
@@ skipping 190 matching lines @@
 
 void QuicCryptoServerConfig::SetProofSource(ProofSource* proof_source) {
   proof_source_.reset(proof_source);
 }
 
 void QuicCryptoServerConfig::SetEphemeralKeySource(
     EphemeralKeySource* ephemeral_key_source) {
   ephemeral_key_source_.reset(ephemeral_key_source);
 }
 
+void QuicCryptoServerConfig::set_replay_protection(bool on) {
+  replay_protection_ = on;
+}
+
 void QuicCryptoServerConfig::set_strike_register_max_entries(
     uint32 max_entries) {
   base::AutoLock locker(strike_register_lock_);
   DCHECK(!strike_register_.get());
   strike_register_max_entries_ = max_entries;
 }
 
 void QuicCryptoServerConfig::set_strike_register_window_secs(
     uint32 window_secs) {
   base::AutoLock locker(strike_register_lock_);
@@ skipping 140 matching lines @@
 }
 
 QuicCryptoServerConfig::Config::Config()
     : channel_id_enabled(false),
       is_primary(false),
       primary_time(QuicWallTime::Zero()) {}
 
 QuicCryptoServerConfig::Config::~Config() { STLDeleteElements(&key_exchanges); }
 
 }  // namespace net