Revert of Allow the DTLS fingerprint verification to occur after the handshake.

webrtc/p2p/base/dtlstransportchannel.cc

Index: webrtc/p2p/base/dtlstransportchannel.cc
diff --git a/webrtc/p2p/base/dtlstransportchannel.cc b/webrtc/p2p/base/dtlstransportchannel.cc
index 62e08a1c849b3d47defe3e60921aa686fd99db27..3dde8fea0535199e31c6ff75c4c9575d21b37b16 100644
--- a/webrtc/p2p/base/dtlstransportchannel.cc
+++ b/webrtc/p2p/base/dtlstransportchannel.cc
@@ -179,7 +179,7 @@
 }
 
 bool DtlsTransportChannelWrapper::SetSslRole(rtc::SSLRole role) {
-  if (dtls_) {
+  if (dtls_state() == DTLS_TRANSPORT_CONNECTED) {
     if (ssl_role_ != role) {
       LOG(LS_ERROR) << "SSL Role can't be reversed after the session is setup.";
       return false;
@@ -235,33 +235,12 @@
   }
 
   // At this point we know we are doing DTLS
-  bool fingerprint_changing = remote_fingerprint_value_.size() > 0u;
   remote_fingerprint_value_ = std::move(remote_fingerprint_value);
   remote_fingerprint_algorithm_ = digest_alg;
 
-  if (dtls_ && !fingerprint_changing) {
-    // This can occur if DTLS is set up before a remote fingerprint is
-    // received. For instance, if we set up DTLS due to receiving an early
-    // ClientHello.
-    auto err = dtls_->SetPeerCertificateDigest(
-        remote_fingerprint_algorithm_,
-        reinterpret_cast<unsigned char*>(remote_fingerprint_value_.data()),
-        remote_fingerprint_value_.size());
-    if (err != rtc::SSLPeerCertificateDigestError::NONE) {
-      LOG_J(LS_ERROR, this) << "Couldn't set DTLS certificate digest.";
-      set_dtls_state(DTLS_TRANSPORT_FAILED);
-      // If the error is "verification failed", don't return false, because
-      // this means the fingerprint was formatted correctly but didn't match
-      // the certificate from the DTLS handshake. Thus the DTLS state should go
-      // to "failed", but SetRemoteDescription shouldn't fail.
-      return err == rtc::SSLPeerCertificateDigestError::VERIFICATION_FAILED;
-    }
-    return true;
-  }
-
-  // If the fingerprint is changing, we'll tear down the DTLS association and
-  // create a new one, resetting our state.
-  if (dtls_ && fingerprint_changing) {
+  if (dtls_) {
+    // If the fingerprint is changing, we'll tear down the DTLS association and
+    // create a new one, resetting our state.
     dtls_.reset(nullptr);
     set_dtls_state(DTLS_TRANSPORT_NEW);
     set_writable(false);
@@ -303,12 +282,10 @@
   dtls_->SignalEvent.connect(this, &DtlsTransportChannelWrapper::OnDtlsEvent);
   dtls_->SignalSSLHandshakeError.connect(
       this, &DtlsTransportChannelWrapper::OnDtlsHandshakeError);
-  if (remote_fingerprint_value_.size() &&
-      dtls_->SetPeerCertificateDigest(
+  if (!dtls_->SetPeerCertificateDigest(
           remote_fingerprint_algorithm_,
           reinterpret_cast<unsigned char*>(remote_fingerprint_value_.data()),
-          remote_fingerprint_value_.size()) !=
-          rtc::SSLPeerCertificateDigestError::NONE) {
+          remote_fingerprint_value_.size())) {
     LOG_J(LS_ERROR, this) << "Couldn't set DTLS certificate digest.";
     return false;
   }
@@ -422,10 +399,6 @@
       ASSERT(false);
       return -1;
   }
-}
-
-bool DtlsTransportChannelWrapper::IsDtlsConnected() {
-  return dtls_ && dtls_->IsTlsConnected();
 }
 
 // The state transition logic here is as follows:
@@ -508,14 +481,6 @@
         LOG_J(LS_INFO, this) << "Caching DTLS ClientHello packet until DTLS is "
                              << "started.";
         cached_client_hello_.SetData(data, size);
-        // If we haven't started setting up DTLS yet (because we don't have a
-        // remote fingerprint/role), we can use the client hello as a clue that
-        // the peer has chosen the client role, and proceed with the handshake.
-        // The fingerprint will be verified when it's set.
-        if (!dtls_ && local_certificate_) {
-          SetSslRole(rtc::SSL_SERVER);
-          SetupDtls();
-        }
       } else {
         LOG_J(LS_INFO, this) << "Not a DTLS ClientHello packet; dropping.";
       }
@@ -589,20 +554,8 @@
   if (sig & rtc::SE_READ) {
     char buf[kMaxDtlsPacketLen];
     size_t read;
-    int read_error;
-    rtc::StreamResult ret = dtls_->Read(buf, sizeof(buf), &read, &read_error);
-    if (ret == rtc::SR_SUCCESS) {
+    if (dtls_->Read(buf, sizeof(buf), &read, NULL) == rtc::SR_SUCCESS) {
       SignalReadPacket(this, buf, read, rtc::CreatePacketTime(0), 0);
-    } else if (ret == rtc::SR_EOS) {
-      // Remote peer shut down the association with no error.
-      LOG_J(LS_INFO, this) << "DTLS channel closed";
-      set_writable(false);
-      set_dtls_state(DTLS_TRANSPORT_CLOSED);
-    } else if (ret == rtc::SR_ERROR) {
-      // Remote peer shut down the association with an error.
-      LOG_J(LS_INFO, this) << "DTLS channel error, code=" << read_error;
-      set_writable(false);
-      set_dtls_state(DTLS_TRANSPORT_FAILED);
     }
   }
   if (sig & rtc::SE_CLOSE) {