In QUIC, when TLS 0-rtt is rejected, disable early data in all cached session tickets that are associated with that server.
Protected by disabled flag quic_enable_zero_rtt_for_tls.
Merge instructions: Please leave the implementation for the new API empty. I will fix that.
PiperOrigin-RevId: 312771280
Change-Id: Ib96b050d088ce1629c67c4f443e89d224d4432d2
diff --git a/quic/core/crypto/quic_crypto_client_config.h b/quic/core/crypto/quic_crypto_client_config.h
index 9a87556..6f057c2 100644
--- a/quic/core/crypto/quic_crypto_client_config.h
+++ b/quic/core/crypto/quic_crypto_client_config.h
@@ -76,6 +76,10 @@
virtual std::unique_ptr<QuicResumptionState> Lookup(
const QuicServerId& server_id,
const SSL_CTX* ctx) = 0;
+
+ // Called when 0-RTT is rejected. Disables early data for all the TLS tickets
+ // associated with |server_id|.
+ virtual void ClearEarlyData(const QuicServerId& server_id) = 0;
};
// QuicCryptoClientConfig contains crypto-related configuration settings for a
diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index b3cfc0a..4c4dbab 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -520,8 +520,10 @@
void TlsClientHandshaker::HandleZeroRttReject() {
QUIC_LOG(INFO) << "0-RTT handshake attempted but was rejected by the server";
+ DCHECK(session_cache_);
handshaker_delegate()->OnZeroRttRejected();
SSL_reset_early_data_reject(ssl());
+ session_cache_->ClearEarlyData(server_id_);
AdvanceHandshake();
}
diff --git a/quic/test_tools/simple_session_cache.cc b/quic/test_tools/simple_session_cache.cc
index 6a0cafb..94b8764 100644
--- a/quic/test_tools/simple_session_cache.cc
+++ b/quic/test_tools/simple_session_cache.cc
@@ -34,6 +34,12 @@
if (it == cache_entries_.end()) {
return nullptr;
}
+
+ if (!it->second.session) {
+ cache_entries_.erase(it);
+ return nullptr;
+ }
+
auto state = std::make_unique<QuicResumptionState>();
state->tls_session = std::move(it->second.session);
state->application_state = it->second.application_state.get();
@@ -41,5 +47,10 @@
return state;
}
+void SimpleSessionCache::ClearEarlyData(const QuicServerId& /*server_id*/) {
+ // The simple session cache only stores 1 SSL ticket per entry, so no need to
+ // do anything here.
+}
+
} // namespace test
} // namespace quic
diff --git a/quic/test_tools/simple_session_cache.h b/quic/test_tools/simple_session_cache.h
index cfe3f4a..6043a43 100644
--- a/quic/test_tools/simple_session_cache.h
+++ b/quic/test_tools/simple_session_cache.h
@@ -28,6 +28,7 @@
const ApplicationState* application_state) override;
std::unique_ptr<QuicResumptionState> Lookup(const QuicServerId& server_id,
const SSL_CTX* ctx) override;
+ void ClearEarlyData(const QuicServerId& server_id) override;
private:
struct Entry {
