Internal change PiperOrigin-RevId: 395565188
diff --git a/quic/core/crypto/crypto_protocol.h b/quic/core/crypto/crypto_protocol.h index d594f48..e45d73a 100644 --- a/quic/core/crypto/crypto_protocol.h +++ b/quic/core/crypto/crypto_protocol.h
@@ -28,7 +28,8 @@ // The following tags have been deprecated and should not be reused: // "1CON", "BBQ4", "NCON", "RCID", "SREJ", "TBKP", "TB10", "SCLS", "SMHL", -// "QNZR", "B2HI", "H2PR", "FIFO", "LIFO", "RRWS", "QNSP", "B2CL" +// "QNZR", "B2HI", "H2PR", "FIFO", "LIFO", "RRWS", "QNSP", "B2CL", "CHSP", +// "BPTE" // clang-format off const QuicTag kCHLO = TAG('C', 'H', 'L', 'O'); // Client hello @@ -340,8 +341,8 @@ const QuicTag kNSLC = TAG('N', 'S', 'L', 'C'); // Always send connection close // for idle timeout. -const QuicTag kCHSP = TAG('C', 'H', 'S', 'P'); // Chaos protection. -const QuicTag kBPTE = TAG('B', 'P', 'T', 'E'); // BoringSSL Permutes +const QuicTag kNCHP = TAG('N', 'C', 'H', 'P'); // No chaos protection. +const QuicTag kNBPE = TAG('N', 'B', 'P', 'E'); // No BoringSSL Permutes // TLS Extensions. // Proof types (i.e. certificate types)
diff --git a/quic/core/http/end_to_end_test.cc b/quic/core/http/end_to_end_test.cc index 0969bdf..c6c6780 100644 --- a/quic/core/http/end_to_end_test.cc +++ b/quic/core/http/end_to_end_test.cc
@@ -5644,7 +5644,7 @@ std::vector<std::unique_ptr<QuicEncryptedPacket>> packets_; }; -TEST_P(EndToEndTest, ChaosProtection) { +TEST_P(EndToEndTest, ChaosProtectionDisabled) { if (!version_.UsesCryptoFrames()) { ASSERT_TRUE(Initialize()); return; @@ -5653,8 +5653,8 @@ auto copying_writer = new CopyingPacketWriter(1); delete client_writer_; client_writer_ = copying_writer; - // Enable chaos protection and perform an HTTP request. - client_config_.SetClientConnectionOptions(QuicTagVector{kCHSP}); + // Disable chaos protection and perform an HTTP request. + client_config_.SetClientConnectionOptions(QuicTagVector{kNCHP}); ASSERT_TRUE(Initialize()); SendSynchronousFooRequestAndCheckResponse(); // Parse the saved packet to make sure it's valid. @@ -5667,31 +5667,15 @@ // can inspect the contents of this packet. } -TEST_P(EndToEndTest, ChaosProtectionWithMultiPacketChlo) { - if (!version_.UsesCryptoFrames()) { - ASSERT_TRUE(Initialize()); - return; - } - // Enable chaos protection. - client_config_.SetClientConnectionOptions(QuicTagVector{kCHSP}); - // Add a transport parameter to make the client hello span multiple packets. - constexpr auto kCustomParameter = - static_cast<TransportParameters::TransportParameterId>(0xff34); - client_config_.custom_transport_parameters_to_send()[kCustomParameter] = - std::string(2000, '?'); - ASSERT_TRUE(Initialize()); - SendSynchronousFooRequestAndCheckResponse(); -} - -TEST_P(EndToEndTest, PermuteTlsExtensions) { +TEST_P(EndToEndTest, DisablePermuteTlsExtensions) { if (!version_.UsesTls()) { ASSERT_TRUE(Initialize()); return; } - // Enable TLS extension permutation and perform an HTTP request. - client_config_.SetClientConnectionOptions(QuicTagVector{kBPTE}); + // Disable TLS extension permutation and perform an HTTP request. + client_config_.SetClientConnectionOptions(QuicTagVector{kNBPE}); ASSERT_TRUE(Initialize()); - EXPECT_TRUE(GetClientSession()->permutes_tls_extensions()); + EXPECT_FALSE(GetClientSession()->permutes_tls_extensions()); SendSynchronousFooRequestAndCheckResponse(); }
diff --git a/quic/core/quic_connection.cc b/quic/core/quic_connection.cc index 57d16ec..4617e8c 100644 --- a/quic/core/quic_connection.cc +++ b/quic/core/quic_connection.cc
@@ -523,8 +523,8 @@ } else { SetNetworkTimeouts(config.max_time_before_crypto_handshake(), config.max_idle_time_before_crypto_handshake()); - if (config.HasClientRequestedIndependentOption(kCHSP, perspective_)) { - packet_creator_.set_chaos_protection_enabled(true); + if (config.HasClientRequestedIndependentOption(kNCHP, perspective_)) { + packet_creator_.set_chaos_protection_enabled(false); } }
diff --git a/quic/core/quic_packet_creator.cc b/quic/core/quic_packet_creator.cc index 94cf48a..a9f16e0 100644 --- a/quic/core/quic_packet_creator.cc +++ b/quic/core/quic_packet_creator.cc
@@ -109,8 +109,7 @@ delegate) {} QuicPacketCreator::QuicPacketCreator(QuicConnectionId server_connection_id, - QuicFramer* framer, - QuicRandom* random, + QuicFramer* framer, QuicRandom* random, DelegateInterface* delegate) : delegate_(delegate), debug_delegate_(nullptr), @@ -123,11 +122,7 @@ packet_size_(0), server_connection_id_(server_connection_id), client_connection_id_(EmptyQuicConnectionId()), - packet_(QuicPacketNumber(), - PACKET_1BYTE_PACKET_NUMBER, - nullptr, - 0, - false, + packet_(QuicPacketNumber(), PACKET_1BYTE_PACKET_NUMBER, nullptr, 0, false, false), pending_padding_bytes_(0), needs_full_padding_(false), @@ -136,7 +131,8 @@ fully_pad_crypto_handshake_packets_(true), latched_hard_max_packet_length_(0), max_datagram_frame_size_(0), - chaos_protection_enabled_(false) { + chaos_protection_enabled_(framer->perspective() == + Perspective::IS_CLIENT) { SetMaxPacketLength(kDefaultMaxPacketSize); if (!framer_->version().UsesTls()) { // QUIC+TLS negotiates the maximum datagram frame size via the
diff --git a/quic/core/quic_session.cc b/quic/core/quic_session.cc index 1e07162..2912b3d 100644 --- a/quic/core/quic_session.cc +++ b/quic/core/quic_session.cc
@@ -147,8 +147,8 @@ connection_->set_can_receive_ack_frequency_frame(); config_.SetMinAckDelayMs(kDefaultMinAckDelayTimeMs); } - if (config_.HasClientRequestedIndependentOption(kBPTE, perspective_)) { - permutes_tls_extensions_ = true; + if (config_.HasClientRequestedIndependentOption(kNBPE, perspective_)) { + permutes_tls_extensions_ = false; } }
diff --git a/quic/core/quic_session.h b/quic/core/quic_session.h index 76e4805..7fc0a80 100644 --- a/quic/core/quic_session.h +++ b/quic/core/quic_session.h
@@ -958,7 +958,7 @@ bool liveness_testing_in_progress_; // Whether BoringSSL randomizes the order of TLS extensions. - bool permutes_tls_extensions_ = false; + bool permutes_tls_extensions_ = true; const bool quic_tls_disable_resumption_refactor_ = GetQuicReloadableFlag(quic_tls_disable_resumption_refactor);
diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc index 737f449..4010590 100644 --- a/quic/core/tls_client_handshaker.cc +++ b/quic/core/tls_client_handshaker.cc
@@ -74,13 +74,14 @@ // TODO(b/193650832) Add SetFromConfig to QUIC handshakers and remove reliance // on session pointer. - if (session()->permutes_tls_extensions()) { - // Ask BoringSSL to randomize the order of TLS extensions. -#if BORINGSSL_API_VERSION >= 16 - QUIC_DLOG(INFO) << "Enabling TLS extension permutation"; - SSL_set_permute_extensions(ssl(), true); -#endif // BORINGSSL_API_VERSION + const bool permutes_tls_extensions = session()->permutes_tls_extensions(); + if (!permutes_tls_extensions) { + QUIC_DLOG(INFO) << "Disabling TLS extension permutation"; } +#if BORINGSSL_API_VERSION >= 16 + // Ask BoringSSL to randomize the order of TLS extensions. + SSL_set_permute_extensions(ssl(), permutes_tls_extensions); +#endif // BORINGSSL_API_VERSION // Set the SNI to send, if any. SSL_set_connect_state(ssl());