Home | History | Annotate | Download | only in crypto 
      1 // Copyright 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "net/quic/crypto/quic_crypto_client_config.h"
      6 
      7 #include "base/metrics/histogram.h"
      8 #include "base/metrics/sparse_histogram.h"
      9 #include "base/stl_util.h"
     10 #include "base/strings/string_util.h"
     11 #include "net/quic/crypto/cert_compressor.h"
     12 #include "net/quic/crypto/chacha20_poly1305_encrypter.h"
     13 #include "net/quic/crypto/channel_id.h"
     14 #include "net/quic/crypto/common_cert_set.h"
     15 #include "net/quic/crypto/crypto_framer.h"
     16 #include "net/quic/crypto/crypto_utils.h"
     17 #include "net/quic/crypto/curve25519_key_exchange.h"
     18 #include "net/quic/crypto/key_exchange.h"
     19 #include "net/quic/crypto/p256_key_exchange.h"
     20 #include "net/quic/crypto/proof_verifier.h"
     21 #include "net/quic/crypto/quic_encrypter.h"
     22 #include "net/quic/quic_utils.h"
     23 
     24 using base::StringPiece;
     25 using std::find;
     26 using std::make_pair;
     27 using std::map;
     28 using std::string;
     29 using std::vector;
     30 
     31 namespace net {
     32 
     33 namespace {
     34 
     35 enum ServerConfigState {
     36   // WARNING: Do not change the numerical values of any of server config state.
     37   // Do not remove deprecated server config states - just comment them as
     38   // deprecated.
     39   SERVER_CONFIG_EMPTY = 0,
     40   SERVER_CONFIG_INVALID = 1,
     41   SERVER_CONFIG_CORRUPTED = 2,
     42   SERVER_CONFIG_EXPIRED = 3,
     43   SERVER_CONFIG_INVALID_EXPIRY = 4,
     44 
     45   // NOTE: Add new server config states only immediately above this line. Make
     46   // sure to update the QuicServerConfigState enum in
     47   // tools/metrics/histograms/histograms.xml accordingly.
     48   SERVER_CONFIG_COUNT
     49 };
     50 
     51 void RecordServerConfigState(ServerConfigState server_config_state) {
     52   UMA_HISTOGRAM_ENUMERATION("Net.QuicClientHelloServerConfigState",
     53                             server_config_state, SERVER_CONFIG_COUNT);
     54 }
     55 
     56 }  // namespace
     57 
     58 QuicCryptoClientConfig::QuicCryptoClientConfig()
     59     : disable_ecdsa_(false) {}
     60 
     61 QuicCryptoClientConfig::~QuicCryptoClientConfig() {
     62   STLDeleteValues(&cached_states_);
     63 }
     64 
     65 QuicCryptoClientConfig::CachedState::CachedState()
     66     : server_config_valid_(false),
     67       generation_counter_(0) {}
     68 
     69 QuicCryptoClientConfig::CachedState::~CachedState() {}
     70 
     71 bool QuicCryptoClientConfig::CachedState::IsComplete(QuicWallTime now) const {
     72   if (server_config_.empty()) {
     73     RecordServerConfigState(SERVER_CONFIG_EMPTY);
     74     return false;
     75   }
     76 
     77   if (!server_config_valid_) {
     78     RecordServerConfigState(SERVER_CONFIG_INVALID);
     79     return false;
     80   }
     81 
     82   const CryptoHandshakeMessage* scfg = GetServerConfig();
     83   if (!scfg) {
     84     // Should be impossible short of cache corruption.
     85     DCHECK(false);
     86     RecordServerConfigState(SERVER_CONFIG_CORRUPTED);
     87     return false;
     88   }
     89 
     90   uint64 expiry_seconds;
     91   if (scfg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
     92     RecordServerConfigState(SERVER_CONFIG_INVALID_EXPIRY);
     93     return false;
     94   }
     95   if (now.ToUNIXSeconds() >= expiry_seconds) {
     96     UMA_HISTOGRAM_CUSTOM_TIMES(
     97         "Net.QuicClientHelloServerConfig.InvalidDuration",
     98         base::TimeDelta::FromSeconds(now.ToUNIXSeconds() - expiry_seconds),
     99         base::TimeDelta::FromMinutes(1), base::TimeDelta::FromDays(20), 50);
    100     RecordServerConfigState(SERVER_CONFIG_EXPIRED);
    101     return false;
    102   }
    103 
    104   return true;
    105 }
    106 
    107 bool QuicCryptoClientConfig::CachedState::IsEmpty() const {
    108   return server_config_.empty();
    109 }
    110 
    111 const CryptoHandshakeMessage*
    112 QuicCryptoClientConfig::CachedState::GetServerConfig() const {
    113   if (server_config_.empty()) {
    114     return NULL;
    115   }
    116 
    117   if (!scfg_.get()) {
    118     scfg_.reset(CryptoFramer::ParseMessage(server_config_));
    119     DCHECK(scfg_.get());
    120   }
    121   return scfg_.get();
    122 }
    123 
    124 QuicErrorCode QuicCryptoClientConfig::CachedState::SetServerConfig(
    125     StringPiece server_config, QuicWallTime now, string* error_details) {
    126   const bool matches_existing = server_config == server_config_;
    127 
    128   // Even if the new server config matches the existing one, we still wish to
    129   // reject it if it has expired.
    130   scoped_ptr<CryptoHandshakeMessage> new_scfg_storage;
    131   const CryptoHandshakeMessage* new_scfg;
    132 
    133   if (!matches_existing) {
    134     new_scfg_storage.reset(CryptoFramer::ParseMessage(server_config));
    135     new_scfg = new_scfg_storage.get();
    136   } else {
    137     new_scfg = GetServerConfig();
    138   }
    139 
    140   if (!new_scfg) {
    141     *error_details = "SCFG invalid";
    142     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    143   }
    144 
    145   uint64 expiry_seconds;
    146   if (new_scfg->GetUint64(kEXPY, &expiry_seconds) != QUIC_NO_ERROR) {
    147     *error_details = "SCFG missing EXPY";
    148     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    149   }
    150 
    151   if (now.ToUNIXSeconds() >= expiry_seconds) {
    152     *error_details = "SCFG has expired";
    153     return QUIC_CRYPTO_SERVER_CONFIG_EXPIRED;
    154   }
    155 
    156   if (!matches_existing) {
    157     server_config_ = server_config.as_string();
    158     SetProofInvalid();
    159     scfg_.reset(new_scfg_storage.release());
    160   }
    161   return QUIC_NO_ERROR;
    162 }
    163 
    164 void QuicCryptoClientConfig::CachedState::InvalidateServerConfig() {
    165   server_config_.clear();
    166   scfg_.reset();
    167   SetProofInvalid();
    168 }
    169 
    170 void QuicCryptoClientConfig::CachedState::SetProof(const vector<string>& certs,
    171                                                    StringPiece signature) {
    172   bool has_changed =
    173       signature != server_config_sig_ || certs_.size() != certs.size();
    174 
    175   if (!has_changed) {
    176     for (size_t i = 0; i < certs_.size(); i++) {
    177       if (certs_[i] != certs[i]) {
    178         has_changed = true;
    179         break;
    180       }
    181     }
    182   }
    183 
    184   if (!has_changed) {
    185     return;
    186   }
    187 
    188   // If the proof has changed then it needs to be revalidated.
    189   SetProofInvalid();
    190   certs_ = certs;
    191   server_config_sig_ = signature.as_string();
    192 }
    193 
    194 void QuicCryptoClientConfig::CachedState::Clear() {
    195   server_config_.clear();
    196   source_address_token_.clear();
    197   certs_.clear();
    198   server_config_sig_.clear();
    199   server_config_valid_ = false;
    200   proof_verify_details_.reset();
    201   scfg_.reset();
    202   ++generation_counter_;
    203 }
    204 
    205 void QuicCryptoClientConfig::CachedState::ClearProof() {
    206   SetProofInvalid();
    207   certs_.clear();
    208   server_config_sig_.clear();
    209 }
    210 
    211 void QuicCryptoClientConfig::CachedState::SetProofValid() {
    212   server_config_valid_ = true;
    213 }
    214 
    215 void QuicCryptoClientConfig::CachedState::SetProofInvalid() {
    216   server_config_valid_ = false;
    217   ++generation_counter_;
    218 }
    219 
    220 bool QuicCryptoClientConfig::CachedState::Initialize(
    221     StringPiece server_config,
    222     StringPiece source_address_token,
    223     const vector<string>& certs,
    224     StringPiece signature,
    225     QuicWallTime now) {
    226   DCHECK(server_config_.empty());
    227 
    228   if (server_config.empty()) {
    229     return false;
    230   }
    231 
    232   string error_details;
    233   QuicErrorCode error = SetServerConfig(server_config, now,
    234                                         &error_details);
    235   if (error != QUIC_NO_ERROR) {
    236     DVLOG(1) << "SetServerConfig failed with " << error_details;
    237     return false;
    238   }
    239 
    240   signature.CopyToString(&server_config_sig_);
    241   source_address_token.CopyToString(&source_address_token_);
    242   certs_ = certs;
    243   return true;
    244 }
    245 
    246 const string& QuicCryptoClientConfig::CachedState::server_config() const {
    247   return server_config_;
    248 }
    249 
    250 const string&
    251 QuicCryptoClientConfig::CachedState::source_address_token() const {
    252   return source_address_token_;
    253 }
    254 
    255 const vector<string>& QuicCryptoClientConfig::CachedState::certs() const {
    256   return certs_;
    257 }
    258 
    259 const string& QuicCryptoClientConfig::CachedState::signature() const {
    260   return server_config_sig_;
    261 }
    262 
    263 bool QuicCryptoClientConfig::CachedState::proof_valid() const {
    264   return server_config_valid_;
    265 }
    266 
    267 uint64 QuicCryptoClientConfig::CachedState::generation_counter() const {
    268   return generation_counter_;
    269 }
    270 
    271 const ProofVerifyDetails*
    272 QuicCryptoClientConfig::CachedState::proof_verify_details() const {
    273   return proof_verify_details_.get();
    274 }
    275 
    276 void QuicCryptoClientConfig::CachedState::set_source_address_token(
    277     StringPiece token) {
    278   source_address_token_ = token.as_string();
    279 }
    280 
    281 void QuicCryptoClientConfig::CachedState::SetProofVerifyDetails(
    282     ProofVerifyDetails* details) {
    283   proof_verify_details_.reset(details);
    284 }
    285 
    286 void QuicCryptoClientConfig::CachedState::InitializeFrom(
    287     const QuicCryptoClientConfig::CachedState& other) {
    288   DCHECK(server_config_.empty());
    289   DCHECK(!server_config_valid_);
    290   server_config_ = other.server_config_;
    291   source_address_token_ = other.source_address_token_;
    292   certs_ = other.certs_;
    293   server_config_sig_ = other.server_config_sig_;
    294   server_config_valid_ = other.server_config_valid_;
    295   if (other.proof_verify_details_.get() != NULL) {
    296     proof_verify_details_.reset(other.proof_verify_details_->Clone());
    297   }
    298   ++generation_counter_;
    299 }
    300 
    301 void QuicCryptoClientConfig::SetDefaults() {
    302   // Key exchange methods.
    303   kexs.resize(2);
    304   kexs[0] = kC255;
    305   kexs[1] = kP256;
    306 
    307   // Authenticated encryption algorithms. Prefer ChaCha20 by default.
    308   aead.clear();
    309   if (ChaCha20Poly1305Encrypter::IsSupported()) {
    310     aead.push_back(kCC12);
    311   }
    312   aead.push_back(kAESG);
    313 
    314   disable_ecdsa_ = false;
    315 }
    316 
    317 QuicCryptoClientConfig::CachedState* QuicCryptoClientConfig::LookupOrCreate(
    318     const QuicServerId& server_id) {
    319   CachedStateMap::const_iterator it = cached_states_.find(server_id);
    320   if (it != cached_states_.end()) {
    321     return it->second;
    322   }
    323 
    324   CachedState* cached = new CachedState;
    325   cached_states_.insert(make_pair(server_id, cached));
    326   PopulateFromCanonicalConfig(server_id, cached);
    327   return cached;
    328 }
    329 
    330 void QuicCryptoClientConfig::ClearCachedStates() {
    331   for (CachedStateMap::const_iterator it = cached_states_.begin();
    332        it != cached_states_.end(); ++it) {
    333     it->second->Clear();
    334   }
    335 }
    336 
    337 void QuicCryptoClientConfig::FillInchoateClientHello(
    338     const QuicServerId& server_id,
    339     const QuicVersion preferred_version,
    340     const CachedState* cached,
    341     QuicCryptoNegotiatedParameters* out_params,
    342     CryptoHandshakeMessage* out) const {
    343   out->set_tag(kCHLO);
    344   out->set_minimum_size(kClientHelloMinimumSize);
    345 
    346   // Server name indication. We only send SNI if it's a valid domain name, as
    347   // per the spec.
    348   if (CryptoUtils::IsValidSNI(server_id.host())) {
    349     out->SetStringPiece(kSNI, server_id.host());
    350   }
    351   out->SetValue(kVER, QuicVersionToQuicTag(preferred_version));
    352 
    353   if (!user_agent_id_.empty()) {
    354     out->SetStringPiece(kUAID, user_agent_id_);
    355   }
    356 
    357   if (!cached->source_address_token().empty()) {
    358     out->SetStringPiece(kSourceAddressTokenTag, cached->source_address_token());
    359   }
    360 
    361   if (server_id.is_https()) {
    362     if (disable_ecdsa_) {
    363       out->SetTaglist(kPDMD, kX59R, 0);
    364     } else {
    365       out->SetTaglist(kPDMD, kX509, 0);
    366     }
    367   }
    368 
    369   if (common_cert_sets) {
    370     out->SetStringPiece(kCCS, common_cert_sets->GetCommonHashes());
    371   }
    372 
    373   const vector<string>& certs = cached->certs();
    374   // We save |certs| in the QuicCryptoNegotiatedParameters so that, if the
    375   // client config is being used for multiple connections, another connection
    376   // doesn't update the cached certificates and cause us to be unable to
    377   // process the server's compressed certificate chain.
    378   out_params->cached_certs = certs;
    379   if (!certs.empty()) {
    380     vector<uint64> hashes;
    381     hashes.reserve(certs.size());
    382     for (vector<string>::const_iterator i = certs.begin();
    383          i != certs.end(); ++i) {
    384       hashes.push_back(QuicUtils::FNV1a_64_Hash(i->data(), i->size()));
    385     }
    386     out->SetVector(kCCRT, hashes);
    387   }
    388 }
    389 
    390 QuicErrorCode QuicCryptoClientConfig::FillClientHello(
    391     const QuicServerId& server_id,
    392     QuicConnectionId connection_id,
    393     const QuicVersion preferred_version,
    394     const CachedState* cached,
    395     QuicWallTime now,
    396     QuicRandom* rand,
    397     const ChannelIDKey* channel_id_key,
    398     QuicCryptoNegotiatedParameters* out_params,
    399     CryptoHandshakeMessage* out,
    400     string* error_details) const {
    401   DCHECK(error_details != NULL);
    402 
    403   FillInchoateClientHello(server_id, preferred_version, cached,
    404                           out_params, out);
    405 
    406   const CryptoHandshakeMessage* scfg = cached->GetServerConfig();
    407   if (!scfg) {
    408     // This should never happen as our caller should have checked
    409     // cached->IsComplete() before calling this function.
    410     *error_details = "Handshake not ready";
    411     return QUIC_CRYPTO_INTERNAL_ERROR;
    412   }
    413 
    414   StringPiece scid;
    415   if (!scfg->GetStringPiece(kSCID, &scid)) {
    416     *error_details = "SCFG missing SCID";
    417     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    418   }
    419   out->SetStringPiece(kSCID, scid);
    420 
    421   const QuicTag* their_aeads;
    422   const QuicTag* their_key_exchanges;
    423   size_t num_their_aeads, num_their_key_exchanges;
    424   if (scfg->GetTaglist(kAEAD, &their_aeads,
    425                        &num_their_aeads) != QUIC_NO_ERROR ||
    426       scfg->GetTaglist(kKEXS, &their_key_exchanges,
    427                        &num_their_key_exchanges) != QUIC_NO_ERROR) {
    428     *error_details = "Missing AEAD or KEXS";
    429     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    430   }
    431 
    432   // AEAD: the work loads on the client and server are symmetric. Since the
    433   // client is more likely to be CPU-constrained, break the tie by favoring
    434   // the client's preference.
    435   // Key exchange: the client does more work than the server, so favor the
    436   // client's preference.
    437   size_t key_exchange_index;
    438   if (!QuicUtils::FindMutualTag(
    439           aead, their_aeads, num_their_aeads, QuicUtils::LOCAL_PRIORITY,
    440           &out_params->aead, NULL) ||
    441       !QuicUtils::FindMutualTag(
    442           kexs, their_key_exchanges, num_their_key_exchanges,
    443           QuicUtils::LOCAL_PRIORITY, &out_params->key_exchange,
    444           &key_exchange_index)) {
    445     *error_details = "Unsupported AEAD or KEXS";
    446     return QUIC_CRYPTO_NO_SUPPORT;
    447   }
    448   out->SetTaglist(kAEAD, out_params->aead, 0);
    449   out->SetTaglist(kKEXS, out_params->key_exchange, 0);
    450 
    451   StringPiece public_value;
    452   if (scfg->GetNthValue24(kPUBS, key_exchange_index, &public_value) !=
    453           QUIC_NO_ERROR) {
    454     *error_details = "Missing public value";
    455     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    456   }
    457 
    458   StringPiece orbit;
    459   if (!scfg->GetStringPiece(kORBT, &orbit) || orbit.size() != kOrbitSize) {
    460     *error_details = "SCFG missing OBIT";
    461     return QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND;
    462   }
    463 
    464   CryptoUtils::GenerateNonce(now, rand, orbit, &out_params->client_nonce);
    465   out->SetStringPiece(kNONC, out_params->client_nonce);
    466   if (!out_params->server_nonce.empty()) {
    467     out->SetStringPiece(kServerNonceTag, out_params->server_nonce);
    468   }
    469 
    470   switch (out_params->key_exchange) {
    471     case kC255:
    472       out_params->client_key_exchange.reset(Curve25519KeyExchange::New(
    473           Curve25519KeyExchange::NewPrivateKey(rand)));
    474       break;
    475     case kP256:
    476       out_params->client_key_exchange.reset(P256KeyExchange::New(
    477           P256KeyExchange::NewPrivateKey()));
    478       break;
    479     default:
    480       DCHECK(false);
    481       *error_details = "Configured to support an unknown key exchange";
    482       return QUIC_CRYPTO_INTERNAL_ERROR;
    483   }
    484 
    485   if (!out_params->client_key_exchange->CalculateSharedKey(
    486           public_value, &out_params->initial_premaster_secret)) {
    487     *error_details = "Key exchange failure";
    488     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    489   }
    490   out->SetStringPiece(kPUBS, out_params->client_key_exchange->public_value());
    491 
    492   if (channel_id_key) {
    493     // In order to calculate the encryption key for the CETV block we need to
    494     // serialise the client hello as it currently is (i.e. without the CETV
    495     // block). For this, the client hello is serialized without padding.
    496     const size_t orig_min_size = out->minimum_size();
    497     out->set_minimum_size(0);
    498 
    499     CryptoHandshakeMessage cetv;
    500     cetv.set_tag(kCETV);
    501 
    502     string hkdf_input;
    503     const QuicData& client_hello_serialized = out->GetSerialized();
    504     hkdf_input.append(QuicCryptoConfig::kCETVLabel,
    505                       strlen(QuicCryptoConfig::kCETVLabel) + 1);
    506     hkdf_input.append(reinterpret_cast<char*>(&connection_id),
    507                       sizeof(connection_id));
    508     hkdf_input.append(client_hello_serialized.data(),
    509                       client_hello_serialized.length());
    510     hkdf_input.append(cached->server_config());
    511 
    512     string key = channel_id_key->SerializeKey();
    513     string signature;
    514     if (!channel_id_key->Sign(hkdf_input, &signature)) {
    515       *error_details = "Channel ID signature failed";
    516       return QUIC_INVALID_CHANNEL_ID_SIGNATURE;
    517     }
    518 
    519     cetv.SetStringPiece(kCIDK, key);
    520     cetv.SetStringPiece(kCIDS, signature);
    521 
    522     CrypterPair crypters;
    523     if (!CryptoUtils::DeriveKeys(out_params->initial_premaster_secret,
    524                                  out_params->aead, out_params->client_nonce,
    525                                  out_params->server_nonce, hkdf_input,
    526                                  CryptoUtils::CLIENT, &crypters,
    527                                  NULL /* subkey secret */)) {
    528       *error_details = "Symmetric key setup failed";
    529       return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
    530     }
    531 
    532     const QuicData& cetv_plaintext = cetv.GetSerialized();
    533     scoped_ptr<QuicData> cetv_ciphertext(crypters.encrypter->EncryptPacket(
    534         0 /* sequence number */,
    535         StringPiece() /* associated data */,
    536         cetv_plaintext.AsStringPiece()));
    537     if (!cetv_ciphertext.get()) {
    538       *error_details = "Packet encryption failed";
    539       return QUIC_ENCRYPTION_FAILURE;
    540     }
    541 
    542     out->SetStringPiece(kCETV, cetv_ciphertext->AsStringPiece());
    543     out->MarkDirty();
    544 
    545     out->set_minimum_size(orig_min_size);
    546   }
    547 
    548   // Derive the symmetric keys and set up the encrypters and decrypters.
    549   // Set the following members of out_params:
    550   //   out_params->hkdf_input_suffix
    551   //   out_params->initial_crypters
    552   out_params->hkdf_input_suffix.clear();
    553   out_params->hkdf_input_suffix.append(reinterpret_cast<char*>(&connection_id),
    554                                        sizeof(connection_id));
    555   const QuicData& client_hello_serialized = out->GetSerialized();
    556   out_params->hkdf_input_suffix.append(client_hello_serialized.data(),
    557                                        client_hello_serialized.length());
    558   out_params->hkdf_input_suffix.append(cached->server_config());
    559 
    560   string hkdf_input;
    561   const size_t label_len = strlen(QuicCryptoConfig::kInitialLabel) + 1;
    562   hkdf_input.reserve(label_len + out_params->hkdf_input_suffix.size());
    563   hkdf_input.append(QuicCryptoConfig::kInitialLabel, label_len);
    564   hkdf_input.append(out_params->hkdf_input_suffix);
    565 
    566   if (!CryptoUtils::DeriveKeys(
    567            out_params->initial_premaster_secret, out_params->aead,
    568            out_params->client_nonce, out_params->server_nonce, hkdf_input,
    569            CryptoUtils::CLIENT, &out_params->initial_crypters,
    570            NULL /* subkey secret */)) {
    571     *error_details = "Symmetric key setup failed";
    572     return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
    573   }
    574 
    575   return QUIC_NO_ERROR;
    576 }
    577 
    578 QuicErrorCode QuicCryptoClientConfig::CacheNewServerConfig(
    579     const CryptoHandshakeMessage& message,
    580     QuicWallTime now,
    581     const vector<string>& cached_certs,
    582     CachedState* cached,
    583     string* error_details) {
    584   DCHECK(error_details != NULL);
    585 
    586   StringPiece scfg;
    587   if (!message.GetStringPiece(kSCFG, &scfg)) {
    588     *error_details = "Missing SCFG";
    589     return QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND;
    590   }
    591 
    592   QuicErrorCode error = cached->SetServerConfig(scfg, now, error_details);
    593   if (error != QUIC_NO_ERROR) {
    594     return error;
    595   }
    596 
    597   StringPiece token;
    598   if (message.GetStringPiece(kSourceAddressTokenTag, &token)) {
    599     cached->set_source_address_token(token);
    600   }
    601 
    602   StringPiece proof, cert_bytes;
    603   bool has_proof = message.GetStringPiece(kPROF, &proof);
    604   bool has_cert = message.GetStringPiece(kCertificateTag, &cert_bytes);
    605   if (has_proof && has_cert) {
    606     vector<string> certs;
    607     if (!CertCompressor::DecompressChain(cert_bytes, cached_certs,
    608                                          common_cert_sets, &certs)) {
    609       *error_details = "Certificate data invalid";
    610       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    611     }
    612 
    613     cached->SetProof(certs, proof);
    614   } else {
    615     if (proof_verifier() != NULL) {
    616       // Secure QUIC: clear existing proof as we have been sent a new SCFG
    617       // without matching proof/certs.
    618       cached->ClearProof();
    619     }
    620 
    621     if (has_proof && !has_cert) {
    622       *error_details = "Certificate missing";
    623       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    624     }
    625 
    626     if (!has_proof && has_cert) {
    627       *error_details = "Proof missing";
    628       return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    629     }
    630   }
    631 
    632   return QUIC_NO_ERROR;
    633 }
    634 
    635 QuicErrorCode QuicCryptoClientConfig::ProcessRejection(
    636     const CryptoHandshakeMessage& rej,
    637     QuicWallTime now,
    638     CachedState* cached,
    639     bool is_https,
    640     QuicCryptoNegotiatedParameters* out_params,
    641     string* error_details) {
    642   DCHECK(error_details != NULL);
    643 
    644   if (rej.tag() != kREJ) {
    645     *error_details = "Message is not REJ";
    646     return QUIC_CRYPTO_INTERNAL_ERROR;
    647   }
    648 
    649   QuicErrorCode error = CacheNewServerConfig(rej, now, out_params->cached_certs,
    650                                              cached, error_details);
    651   if (error != QUIC_NO_ERROR) {
    652     return error;
    653   }
    654 
    655   StringPiece nonce;
    656   if (rej.GetStringPiece(kServerNonceTag, &nonce)) {
    657     out_params->server_nonce = nonce.as_string();
    658   }
    659 
    660   const uint32* reject_reasons;
    661   size_t num_reject_reasons;
    662   COMPILE_ASSERT(sizeof(QuicTag) == sizeof(uint32), header_out_of_sync);
    663   if (rej.GetTaglist(kRREJ, &reject_reasons,
    664                      &num_reject_reasons) == QUIC_NO_ERROR) {
    665     uint32 packed_error = 0;
    666     for (size_t i = 0; i < num_reject_reasons; ++i) {
    667       // HANDSHAKE_OK is 0 and don't report that as error.
    668       if (reject_reasons[i] == HANDSHAKE_OK || reject_reasons[i] >= 32) {
    669         continue;
    670       }
    671       HandshakeFailureReason reason =
    672           static_cast<HandshakeFailureReason>(reject_reasons[i]);
    673       packed_error |= 1 << (reason - 1);
    674     }
    675     DVLOG(1) << "Reasons for rejection: " << packed_error;
    676     if (is_https) {
    677       UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Secure",
    678                                   packed_error);
    679     } else {
    680       UMA_HISTOGRAM_SPARSE_SLOWLY("Net.QuicClientHelloRejectReasons.Insecure",
    681                                   packed_error);
    682     }
    683   }
    684 
    685   return QUIC_NO_ERROR;
    686 }
    687 
    688 QuicErrorCode QuicCryptoClientConfig::ProcessServerHello(
    689     const CryptoHandshakeMessage& server_hello,
    690     QuicConnectionId connection_id,
    691     const QuicVersionVector& negotiated_versions,
    692     CachedState* cached,
    693     QuicCryptoNegotiatedParameters* out_params,
    694     string* error_details) {
    695   DCHECK(error_details != NULL);
    696 
    697   if (server_hello.tag() != kSHLO) {
    698     *error_details = "Bad tag";
    699     return QUIC_INVALID_CRYPTO_MESSAGE_TYPE;
    700   }
    701 
    702   const QuicTag* supported_version_tags;
    703   size_t num_supported_versions;
    704 
    705   if (server_hello.GetTaglist(kVER, &supported_version_tags,
    706                               &num_supported_versions) != QUIC_NO_ERROR) {
    707     *error_details = "server hello missing version list";
    708     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    709   }
    710   if (!negotiated_versions.empty()) {
    711     bool mismatch = num_supported_versions != negotiated_versions.size();
    712     for (size_t i = 0; i < num_supported_versions && !mismatch; ++i) {
    713       mismatch = QuicTagToQuicVersion(supported_version_tags[i]) !=
    714           negotiated_versions[i];
    715     }
    716     // The server sent a list of supported versions, and the connection
    717     // reports that there was a version negotiation during the handshake.
    718       // Ensure that these two lists are identical.
    719     if (mismatch) {
    720       *error_details = "Downgrade attack detected";
    721       return QUIC_VERSION_NEGOTIATION_MISMATCH;
    722     }
    723   }
    724 
    725   // Learn about updated source address tokens.
    726   StringPiece token;
    727   if (server_hello.GetStringPiece(kSourceAddressTokenTag, &token)) {
    728     cached->set_source_address_token(token);
    729   }
    730 
    731   // TODO(agl):
    732   //   learn about updated SCFGs.
    733 
    734   StringPiece public_value;
    735   if (!server_hello.GetStringPiece(kPUBS, &public_value)) {
    736     *error_details = "server hello missing forward secure public value";
    737     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    738   }
    739 
    740   if (!out_params->client_key_exchange->CalculateSharedKey(
    741           public_value, &out_params->forward_secure_premaster_secret)) {
    742     *error_details = "Key exchange failure";
    743     return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER;
    744   }
    745 
    746   string hkdf_input;
    747   const size_t label_len = strlen(QuicCryptoConfig::kForwardSecureLabel) + 1;
    748   hkdf_input.reserve(label_len + out_params->hkdf_input_suffix.size());
    749   hkdf_input.append(QuicCryptoConfig::kForwardSecureLabel, label_len);
    750   hkdf_input.append(out_params->hkdf_input_suffix);
    751 
    752   if (!CryptoUtils::DeriveKeys(
    753            out_params->forward_secure_premaster_secret, out_params->aead,
    754            out_params->client_nonce, out_params->server_nonce, hkdf_input,
    755            CryptoUtils::CLIENT, &out_params->forward_secure_crypters,
    756            &out_params->subkey_secret)) {
    757     *error_details = "Symmetric key setup failed";
    758     return QUIC_CRYPTO_SYMMETRIC_KEY_SETUP_FAILED;
    759   }
    760 
    761   return QUIC_NO_ERROR;
    762 }
    763 
    764 QuicErrorCode QuicCryptoClientConfig::ProcessServerConfigUpdate(
    765     const CryptoHandshakeMessage& server_config_update,
    766     QuicWallTime now,
    767     CachedState* cached,
    768     QuicCryptoNegotiatedParameters* out_params,
    769     string* error_details) {
    770   DCHECK(error_details != NULL);
    771 
    772   if (server_config_update.tag() != kSCUP) {
    773     *error_details = "ServerConfigUpdate must have kSCUP tag.";
    774     return QUIC_INVALID_CRYPTO_MESSAGE_TYPE;
    775   }
    776 
    777   return CacheNewServerConfig(server_config_update, now,
    778                               out_params->cached_certs, cached, error_details);
    779 }
    780 
    781 ProofVerifier* QuicCryptoClientConfig::proof_verifier() const {
    782   return proof_verifier_.get();
    783 }
    784 
    785 void QuicCryptoClientConfig::SetProofVerifier(ProofVerifier* verifier) {
    786   proof_verifier_.reset(verifier);
    787 }
    788 
    789 ChannelIDSource* QuicCryptoClientConfig::channel_id_source() const {
    790   return channel_id_source_.get();
    791 }
    792 
    793 void QuicCryptoClientConfig::SetChannelIDSource(ChannelIDSource* source) {
    794   channel_id_source_.reset(source);
    795 }
    796 
    797 void QuicCryptoClientConfig::InitializeFrom(
    798     const QuicServerId& server_id,
    799     const QuicServerId& canonical_server_id,
    800     QuicCryptoClientConfig* canonical_crypto_config) {
    801   CachedState* canonical_cached =
    802       canonical_crypto_config->LookupOrCreate(canonical_server_id);
    803   if (!canonical_cached->proof_valid()) {
    804     return;
    805   }
    806   CachedState* cached = LookupOrCreate(server_id);
    807   cached->InitializeFrom(*canonical_cached);
    808 }
    809 
    810 void QuicCryptoClientConfig::AddCanonicalSuffix(const string& suffix) {
    811   canoncial_suffixes_.push_back(suffix);
    812 }
    813 
    814 void QuicCryptoClientConfig::PreferAesGcm() {
    815   DCHECK(!aead.empty());
    816   if (aead.size() <= 1) {
    817     return;
    818   }
    819   QuicTagVector::iterator pos = find(aead.begin(), aead.end(), kAESG);
    820   if (pos != aead.end()) {
    821     aead.erase(pos);
    822     aead.insert(aead.begin(), kAESG);
    823   }
    824 }
    825 
    826 void QuicCryptoClientConfig::DisableEcdsa() {
    827   disable_ecdsa_ = true;
    828 }
    829 
    830 void QuicCryptoClientConfig::PopulateFromCanonicalConfig(
    831     const QuicServerId& server_id,
    832     CachedState* server_state) {
    833   DCHECK(server_state->IsEmpty());
    834   size_t i = 0;
    835   for (; i < canoncial_suffixes_.size(); ++i) {
    836     if (EndsWith(server_id.host(), canoncial_suffixes_[i], false)) {
    837       break;
    838     }
    839   }
    840   if (i == canoncial_suffixes_.size())
    841     return;
    842 
    843   QuicServerId suffix_server_id(canoncial_suffixes_[i], server_id.port(),
    844                                 server_id.is_https(),
    845                                 server_id.privacy_mode());
    846   if (!ContainsKey(canonical_server_map_, suffix_server_id)) {
    847     // This is the first host we've seen which matches the suffix, so make it
    848     // canonical.
    849     canonical_server_map_[suffix_server_id] = server_id;
    850     return;
    851   }
    852 
    853   const QuicServerId& canonical_server_id =
    854       canonical_server_map_[suffix_server_id];
    855   CachedState* canonical_state = cached_states_[canonical_server_id];
    856   if (!canonical_state->proof_valid()) {
    857     return;
    858   }
    859 
    860   // Update canonical version to point at the "most recent" entry.
    861   canonical_server_map_[suffix_server_id] = server_id;
    862 
    863   server_state->InitializeFrom(*canonical_state);
    864 }
    865 
    866 }  // namespace net
    867