commit 01062943651f3e11165be6273c9a90005e6b0142
author fayang <fayang@google.com> Wed Jan 22 07:23:23 2020 -0800
committer Copybara-Service <copybara-worker@google.com> Wed Jan 22 07:23:56 2020 -0800
tree 16c337331eb96ff99466918ead4a62cd2b570094
parent 021a1e78bb78f9b63b2d3250ca8156468143c9d3

gfe-relnote: In QUIC version T099, implement HANDSHAKE_DONE frame to drive the handshake to confirmation on the client side. Not used in prod yet.

PiperOrigin-RevId: 290948924
Change-Id: Idcbc5c0d573b5db992b65d4971ea12a3d7e87633

quic/core/tls_client_handshaker.cc

diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index da549f3..45d1849 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -240,6 +240,9 @@
 }
 
 HandshakeState TlsClientHandshaker::GetHandshakeState() const {
+  if (handshake_confirmed_) {
+    return HANDSHAKE_CONFIRMED;
+  }
   if (one_rtt_keys_available_) {
     return HANDSHAKE_COMPLETE;
   }
@@ -254,6 +257,20 @@
   return TlsHandshaker::BufferSizeLimitForLevel(level);
 }
 
+void TlsClientHandshaker::OnHandshakeDoneReceived() {
+  if (!one_rtt_keys_available_) {
+    CloseConnection(QUIC_HANDSHAKE_FAILED,
+                    "Unexpected handshake done received");
+    return;
+  }
+  if (handshake_confirmed_) {
+    return;
+  }
+  handshake_confirmed_ = true;
+  delegate()->DiscardOldEncryptionKey(ENCRYPTION_HANDSHAKE);
+  delegate()->DiscardOldDecryptionKey(ENCRYPTION_HANDSHAKE);
+}
+
 void TlsClientHandshaker::AdvanceHandshake() {
   if (state_ == STATE_CONNECTION_CLOSED) {
     QUIC_LOG(INFO)
@@ -359,9 +376,6 @@
       SSL_get_peer_signature_algorithm(ssl());
 
   delegate()->SetDefaultEncryptionLevel(ENCRYPTION_FORWARD_SECURE);
-  // TODO(fayang): Replace this with DiscardOldKeys(ENCRYPTION_HANDSHAKE) when
-  // handshake key discarding settles down.
-  delegate()->NeuterHandshakeData();
 }
 
 enum ssl_verify_result_t TlsClientHandshaker::VerifyCert(uint8_t* out_alert) {