Move RC4 behind a fallback.

net/url_request/url_request_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <shlobj.h>
 #endif
@@ skipping 7115 matching lines @@
       if (err_allowed) {
         EXPECT_NE(0, d.bytes_received());
         CheckSSLInfo(r->ssl_info());
       } else {
         EXPECT_EQ(0, d.bytes_received());
       }
     }
   }
 }
 
+// Tests that servers which require a deprecated cipher suite still work.
+TEST_F(HTTPSRequestTest, CipherFallbackTest) {
+  CapturingNetLog net_log;
+  default_context_.set_net_log(&net_log);
+
+  SpawnedTestServer::SSLOptions ssl_options;
+  ssl_options.bulk_ciphers = SpawnedTestServer::SSLOptions::BULK_CIPHER_RC4;
+  SpawnedTestServer test_server(
+      SpawnedTestServer::TYPE_HTTPS, ssl_options,
+      base::FilePath(FILE_PATH_LITERAL("net/data/ssl")));
+  ASSERT_TRUE(test_server.Start());
+
+  TestDelegate d;
+  {

[Ryan Sleevi, 2015/04/02 06:32:06]

Is this scope necessary? Seems like a normal scoping / order would tear
everything down correctly.

[davidben, 2015/04/03 19:58:26]

Done. (Copy-paste from elsewhere.)

+    scoped_ptr<URLRequest> r(default_context_.CreateRequest(
+        test_server.GetURL(std::string()), DEFAULT_PRIORITY, &d));
+    r->Start();
+    EXPECT_TRUE(r->is_pending());
+
+    base::RunLoop().Run();
+
+    EXPECT_EQ(1, d.response_started_count());
+    EXPECT_FALSE(d.received_data_before_response());
+    EXPECT_NE(0, d.bytes_received());
+    CheckSSLInfo(r->ssl_info());
+    EXPECT_EQ(test_server.host_port_pair().host(),
+              r->GetSocketAddress().host());
+    EXPECT_EQ(test_server.host_port_pair().port(),
+              r->GetSocketAddress().port());
+
+    // No version downgrade should have been necessary.
+    EXPECT_FALSE(r->ssl_info().connection_status &
+                 SSL_CONNECTION_VERSION_FALLBACK);
+    int expected_version = SSL_CONNECTION_VERSION_TLS1_2;
+    if (SSLClientSocket::GetMaxSupportedSSLVersion() <
+        SSL_PROTOCOL_VERSION_TLS1_2) {
+      expected_version = SSL_CONNECTION_VERSION_TLS1_1;
+    }
+    EXPECT_EQ(expected_version,
+              SSLConnectionStatusToVersion(r->ssl_info().connection_status));
+
+    CapturingNetLog::CapturedEntryList entries;
+    net_log.GetEntries(&entries);
+    ExpectLogContainsSomewhere(entries, 0, NetLog::TYPE_SSL_CIPHER_FALLBACK,
+                               NetLog::PHASE_NONE);
+  }
+}
+
 // This tests that a load of www.google.com with a certificate error sets
 // the |certificate_errors_are_fatal| flag correctly. This flag will cause
 // the interstitial to be fatal.
 TEST_F(HTTPSRequestTest, HTTPSPreloadedHSTSTest) {
   SpawnedTestServer::SSLOptions ssl_options(
       SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME);
   SpawnedTestServer test_server(
       SpawnedTestServer::TYPE_HTTPS,
       ssl_options,
       base::FilePath(FILE_PATH_LITERAL("net/data/ssl")));
@@ skipping 1793 matching lines @@
 
     EXPECT_FALSE(r->is_pending());
     EXPECT_EQ(1, d->response_started_count());
     EXPECT_FALSE(d->received_data_before_response());
     EXPECT_EQ(d->bytes_received(), static_cast<int>(file_size));
   }
 }
 #endif  // !defined(DISABLE_FTP_SUPPORT)
 
 }  // namespace net