Land Recent QUIC changes.

net/quic/crypto/crypto_server_config.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/crypto_server_config.h"
 
 #include <stdlib.h>
 #include <algorithm>
 
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "crypto/hkdf.h"
 #include "crypto/secure_hash.h"
+#include "net/base/net_util.h"
 #include "net/quic/crypto/aes_128_gcm_12_decrypter.h"
 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h"
 #include "net/quic/crypto/cert_compressor.h"
 #include "net/quic/crypto/channel_id.h"
 #include "net/quic/crypto/crypto_framer.h"
 #include "net/quic/crypto/crypto_server_config_protobuf.h"
 #include "net/quic/crypto/crypto_utils.h"
 #include "net/quic/crypto/curve25519_key_exchange.h"
 #include "net/quic/crypto/ephemeral_key_source.h"
 #include "net/quic/crypto/key_exchange.h"
@@ skipping 25 matching lines @@
 
 QuicCryptoServerConfig::QuicCryptoServerConfig(
     StringPiece source_address_token_secret,
     QuicRandom* rand)
     : replay_protection_(true),
       configs_lock_(),
       primary_config_(NULL),
       next_config_promotion_time_(QuicWallTime::Zero()),
       strike_register_lock_(),
       server_nonce_strike_register_lock_(),
+      strike_register_no_startup_period_(false),
       strike_register_max_entries_(1 << 10),
       strike_register_window_secs_(600),
       source_address_token_future_secs_(3600),
       source_address_token_lifetime_secs_(86400),
       server_nonce_strike_register_max_entries_(1 << 10),
       server_nonce_strike_register_window_secs_(120) {
   crypto::HKDF hkdf(source_address_token_secret, StringPiece() /* no salt */,
                     "QUIC source address token key",
                     CryptoSecretBoxer::GetKeySize(),
                     0 /* no fixed IV needed */);
@@ skipping 560 matching lines @@
     info->client_nonce_well_formed = true;
     if (replay_protection_) {
       base::AutoLock auto_lock(strike_register_lock_);
 
       if (strike_register_.get() == NULL) {
         strike_register_.reset(new StrikeRegister(
             strike_register_max_entries_,
             static_cast<uint32>(info->now.ToUNIXSeconds()),
             strike_register_window_secs_,
             orbit,
+            strike_register_no_startup_period_ ?
+            StrikeRegister::NO_STARTUP_PERIOD_NEEDED :
             StrikeRegister::DENY_REQUESTS_AT_STARTUP));
       }
 
       unique_by_strike_register = strike_register_->Insert(
           reinterpret_cast<const uint8*>(info->client_nonce.data()),
           static_cast<uint32>(info->now.ToUNIXSeconds()));
     }
   }
 
   client_hello.GetStringPiece(kServerNonceTag, &info->server_nonce);
@@ skipping 252 matching lines @@
 
 void QuicCryptoServerConfig::SetEphemeralKeySource(
     EphemeralKeySource* ephemeral_key_source) {
   ephemeral_key_source_.reset(ephemeral_key_source);
 }
 
 void QuicCryptoServerConfig::set_replay_protection(bool on) {
   replay_protection_ = on;
 }
 
+void QuicCryptoServerConfig::set_strike_register_no_startup_period() {
+  base::AutoLock auto_lock(strike_register_lock_);
+  DCHECK(!strike_register_.get());
+  strike_register_no_startup_period_ = true;
+}
+
 void QuicCryptoServerConfig::set_strike_register_max_entries(
     uint32 max_entries) {
   base::AutoLock locker(strike_register_lock_);
   DCHECK(!strike_register_.get());
   strike_register_max_entries_ = max_entries;
 }
 
 void QuicCryptoServerConfig::set_strike_register_window_secs(
     uint32 window_secs) {
   base::AutoLock locker(strike_register_lock_);
@@ skipping 21 matching lines @@
     uint32 window_secs) {
   DCHECK(!server_nonce_strike_register_.get());
   server_nonce_strike_register_window_secs_ = window_secs;
 }
 
 string QuicCryptoServerConfig::NewSourceAddressToken(
     const IPEndPoint& ip,
     QuicRandom* rand,
     QuicWallTime now) const {
   SourceAddressToken source_address_token;
-  source_address_token.set_ip(ip.ToString());
+  source_address_token.set_ip(IPAddressToPackedString(ip.address()));
   source_address_token.set_timestamp(now.ToUNIXSeconds());
 
   return source_address_token_boxer_.Box(
       rand, source_address_token.SerializeAsString());
 }
 
 bool QuicCryptoServerConfig::ValidateSourceAddressToken(
     StringPiece token,
     const IPEndPoint& ip,
     QuicWallTime now) const {
   string storage;
   StringPiece plaintext;
   if (!source_address_token_boxer_.Unbox(token, &storage, &plaintext)) {
     return false;
   }
 
   SourceAddressToken source_address_token;
   if (!source_address_token.ParseFromArray(plaintext.data(),
                                            plaintext.size())) {
     return false;
   }
 
-  if (source_address_token.ip() != ip.ToString()) {
+  if (source_address_token.ip() != IPAddressToPackedString(ip.address())) {
     // It's for a different IP address.
     return false;
   }
 
   const QuicWallTime timestamp(
       QuicWallTime::FromUNIXSeconds(source_address_token.timestamp()));
   const QuicTime::Delta delta(now.AbsoluteDifference(timestamp));
 
   if (now.IsBefore(timestamp) &&
       delta.ToSeconds() > source_address_token_future_secs_) {
@@ skipping 75 matching lines @@
 }
 
 QuicCryptoServerConfig::Config::Config()
     : channel_id_enabled(false),
       is_primary(false),
       primary_time(QuicWallTime::Zero()) {}
 
 QuicCryptoServerConfig::Config::~Config() { STLDeleteElements(&key_exchanges); }
 
 }  // namespace net