tree 206fc23248e5ec653897968def06192c3154f29e
parent 51484c694f99d211587d24e5d3e2634b12f978f6
author dschinazi <dschinazi@google.com> 1733262406 -0800
committer Copybara-Service <copybara-worker@google.com> 1733262450 -0800

Chaos Protection v2

This CL adds support for multi-packet chaos protection. While the first version of Chaos Protection would scramble the ClientHello if it fit in a CRYPTO frame in a single packet, the emergence of post-quantum cryptography has now caused the ClientHello to span multiple packets. Chaos Protection v2 now scrambles the ClientHello across packets, such that it is now required to parse all of them in order to extract information such as the SNI.

This CL also removes automatic flushing of initial crypto packets in the packet creator. This is safe because all uses of such functions are guaranteed to use a scope packed flusher anyway.

Note that --quic_enable_new_chaos_protector is still marked as enabled_blocked_by so it is safe to add new functionality behind it.

Protected by FLAGS_quic_enable_new_chaos_protector.

PiperOrigin-RevId: 702456667