tree f0049c458ea8b962fd06ceaed0c4600b82e3f2b5
parent da42ab69f80814355f3407a723fdc90edaa30664
author dschinazi <dschinazi@google.com> 1587062671 -0700
committer Copybara-Service <copybara-worker@google.com> 1587062702 -0700

Make PSK handshake fail with QUIC+TLS

QUIC+TLS currently does not support pre-shared keys (PSK). Before this CL, the code would simply ignore the PSK and continue the handshake. This could lead to traffic not being authenticated. To avoid this class of security issues, this CL ensures that the QUIC+TLS handshake fails if a PSK has been configured. We will implement support for PSK in QUIC+TLS in a subsequent CL.

This CL also refactors the constructor for TlsServerHandshaker to give it access to the QuicCryptoServerConfig.

gfe-relnote: make QUIC+TLS+PSK fail, not used in production, TLS versions protected by gfe2_reloadable_flag_quic_enable_t050_v2, gfe2_reloadable_flag_quic_enable_version_draft_25_v3 and gfe2_reloadable_flag_quic_enable_version_draft_27.
PiperOrigin-RevId: 306890388
Change-Id: Ic254e3f049bcdc5b980916072e516447f198e2f1