Call ProofHandler::OnProofVerifyDetailsAvailable in TLS handshake in QUIC
gfe-relnote: Notify QuicCryptoClientStream::ProofHandler when VerifyCertChain completes, protected by quic_supports_tls_handshake
PiperOrigin-RevId: 272701332
Change-Id: Ie96d15a99421e43226feefb6e5889056868a1746
diff --git a/quic/core/quic_crypto_client_stream.cc b/quic/core/quic_crypto_client_stream.cc
index a05caee..097fc9b 100644
--- a/quic/core/quic_crypto_client_stream.cc
+++ b/quic/core/quic_crypto_client_stream.cc
@@ -44,7 +44,7 @@
case PROTOCOL_TLS1_3:
handshaker_ = std::make_unique<TlsClientHandshaker>(
this, session, server_id, crypto_config->proof_verifier(),
- crypto_config->ssl_ctx(), std::move(verify_context),
+ crypto_config->ssl_ctx(), std::move(verify_context), proof_handler,
crypto_config->user_agent_id());
break;
case PROTOCOL_UNSUPPORTED:
diff --git a/quic/core/quic_crypto_client_stream_test.cc b/quic/core/quic_crypto_client_stream_test.cc
index 9969baf..5b49fad 100644
--- a/quic/core/quic_crypto_client_stream_test.cc
+++ b/quic/core/quic_crypto_client_stream_test.cc
@@ -95,10 +95,11 @@
TEST_F(QuicCryptoClientStreamTest, ConnectedAfterTlsHandshake) {
SetQuicReloadableFlag(quic_supports_tls_handshake, true);
supported_versions_.clear();
- for (QuicTransportVersion transport_version :
- AllSupportedTransportVersions()) {
- supported_versions_.push_back(
- ParsedQuicVersion(PROTOCOL_TLS1_3, transport_version));
+ for (ParsedQuicVersion version : AllSupportedVersions()) {
+ if (version.handshake_protocol != PROTOCOL_TLS1_3) {
+ continue;
+ }
+ supported_versions_.push_back(version);
}
CreateConnection();
CompleteCryptoHandshake();
@@ -107,6 +108,29 @@
EXPECT_TRUE(stream()->handshake_confirmed());
}
+TEST_F(QuicCryptoClientStreamTest,
+ ProofVerifyDetailsAvailableAfterTlsHandshake) {
+ SetQuicReloadableFlag(quic_supports_tls_handshake, true);
+ supported_versions_.clear();
+ for (ParsedQuicVersion version : AllSupportedVersions()) {
+ if (version.handshake_protocol != PROTOCOL_TLS1_3) {
+ continue;
+ }
+ supported_versions_.push_back(version);
+ }
+ CreateConnection();
+
+ EXPECT_CALL(*session_, OnProofVerifyDetailsAvailable(testing::_));
+ stream()->CryptoConnect();
+ QuicConfig config;
+ crypto_test_utils::HandshakeWithFakeServer(
+ &config, &server_helper_, &alarm_factory_, connection_, stream(),
+ AlpnForVersion(connection_->version()));
+ EXPECT_EQ(PROTOCOL_TLS1_3, stream()->handshake_protocol());
+ EXPECT_TRUE(stream()->encryption_established());
+ EXPECT_TRUE(stream()->handshake_confirmed());
+}
+
TEST_F(QuicCryptoClientStreamTest, MessageAfterHandshake) {
CompleteCryptoHandshake();
diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index bb45602..88fea66 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -33,6 +33,8 @@
parent_->verify_result_ = ok ? ssl_verify_ok : ssl_verify_invalid;
parent_->state_ = STATE_HANDSHAKE_RUNNING;
parent_->proof_verify_callback_ = nullptr;
+ parent_->proof_handler_->OnProofVerifyDetailsAvailable(
+ *parent_->verify_details_);
parent_->AdvanceHandshake();
}
@@ -47,11 +49,13 @@
ProofVerifier* proof_verifier,
SSL_CTX* ssl_ctx,
std::unique_ptr<ProofVerifyContext> verify_context,
+ QuicCryptoClientStream::ProofHandler* proof_handler,
const std::string& user_agent_id)
: TlsHandshaker(stream, session, ssl_ctx),
server_id_(server_id),
proof_verifier_(proof_verifier),
verify_context_(std::move(verify_context)),
+ proof_handler_(proof_handler),
user_agent_id_(user_agent_id),
crypto_negotiated_params_(new QuicCryptoNegotiatedParameters),
tls_connection_(ssl_ctx, this) {}
@@ -366,6 +370,7 @@
std::unique_ptr<ProofVerifierCallback>(proof_verify_callback));
switch (verify_result) {
case QUIC_SUCCESS:
+ proof_handler_->OnProofVerifyDetailsAvailable(*verify_details_);
return ssl_verify_ok;
case QUIC_PENDING:
proof_verify_callback_ = proof_verify_callback;
diff --git a/quic/core/tls_client_handshaker.h b/quic/core/tls_client_handshaker.h
index f3e90ce..4672821 100644
--- a/quic/core/tls_client_handshaker.h
+++ b/quic/core/tls_client_handshaker.h
@@ -30,6 +30,7 @@
ProofVerifier* proof_verifier,
SSL_CTX* ssl_ctx,
std::unique_ptr<ProofVerifyContext> verify_context,
+ QuicCryptoClientStream::ProofHandler* proof_handler,
const std::string& user_agent_id);
TlsClientHandshaker(const TlsClientHandshaker&) = delete;
TlsClientHandshaker& operator=(const TlsClientHandshaker&) = delete;
@@ -109,6 +110,10 @@
// constructor.
ProofVerifier* proof_verifier_;
std::unique_ptr<ProofVerifyContext> verify_context_;
+ // Unowned pointer to the proof handler which has the
+ // OnProofVerifyDetailsAvailable callback to use for notifying the result of
+ // certificate verification.
+ QuicCryptoClientStream::ProofHandler* proof_handler_;
std::string user_agent_id_;
diff --git a/quic/core/tls_handshaker_test.cc b/quic/core/tls_handshaker_test.cc
index 168dc55..1d34321 100644
--- a/quic/core/tls_handshaker_test.cc
+++ b/quic/core/tls_handshaker_test.cc
@@ -210,6 +210,15 @@
std::vector<std::pair<std::string, EncryptionLevel>> pending_writes_;
};
+class MockProofHandler : public QuicCryptoClientStream::ProofHandler {
+ public:
+ MockProofHandler() = default;
+ ~MockProofHandler() override {}
+
+ MOCK_METHOD1(OnProofValid, void(const QuicCryptoClientConfig::CachedState&));
+ MOCK_METHOD1(OnProofVerifyDetailsAvailable, void(const ProofVerifyDetails&));
+};
+
class TestQuicCryptoClientStream : public TestQuicCryptoStream {
public:
explicit TestQuicCryptoClientStream(QuicSession* session)
@@ -223,12 +232,14 @@
proof_verifier_.get(),
ssl_ctx_.get(),
crypto_test_utils::ProofVerifyContextForTesting(),
+ &proof_handler_,
"quic-tester")) {}
~TestQuicCryptoClientStream() override = default;
TlsHandshaker* handshaker() const override { return handshaker_.get(); }
TlsClientHandshaker* client_handshaker() const { return handshaker_.get(); }
+ const MockProofHandler& proof_handler() { return proof_handler_; }
bool CryptoConnect() { return handshaker_->CryptoConnect(); }
@@ -238,6 +249,7 @@
private:
std::unique_ptr<FakeProofVerifier> proof_verifier_;
+ MockProofHandler proof_handler_;
bssl::UniquePtr<SSL_CTX> ssl_ctx_;
std::unique_ptr<TlsClientHandshaker> handshaker_;
};
@@ -341,6 +353,7 @@
OnCryptoHandshakeEvent(QuicSession::HANDSHAKE_CONFIRMED));
EXPECT_CALL(server_session_,
OnCryptoHandshakeEvent(QuicSession::HANDSHAKE_CONFIRMED));
+ EXPECT_CALL(client_stream_->proof_handler(), OnProofVerifyDetailsAvailable);
client_stream_->CryptoConnect();
ExchangeHandshakeMessages(client_stream_, server_stream_);
@@ -401,6 +414,8 @@
FakeProofVerifier* proof_verifier = client_stream_->GetFakeProofVerifier();
proof_verifier->Activate();
+ EXPECT_CALL(client_stream_->proof_handler(), OnProofVerifyDetailsAvailable);
+
// Start handshake.
client_stream_->CryptoConnect();
ExchangeHandshakeMessages(client_stream_, server_stream_);
