Require ECDHE cipher in remoting client.

net/socket/ssl_client_socket_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
@@ skipping 3086 matching lines @@
   // However, enabling deprecated ciphers connects fresh.
   transport.reset(new TCPClientSocket(addr(), &log_, NetLog::Source()));
   EXPECT_EQ(OK, callback.GetResult(transport->Connect(callback.callback())));
   sock = CreateSSLClientSocket(
       transport.Pass(), test_server()->host_port_pair(), deprecated_ssl_config);
   EXPECT_EQ(OK, callback.GetResult(sock->Connect(callback.callback())));
   EXPECT_TRUE(sock->GetSSLInfo(&ssl_info));
   EXPECT_EQ(SSLInfo::HANDSHAKE_FULL, ssl_info.handshake_type);
 }
 
+TEST_F(SSLClientSocketTest, RequireECDHE) {
+  // Run test server without ECDHE.
+  SpawnedTestServer::SSLOptions ssl_options(
+      SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME);

[davidben, 2015/06/16 19:18:21]

This should just be the parameterless one I think. (You don't get far enough to
care about the certificate anyway.)

[Sergey Ulanov, 2015/06/16 19:29:07]

Done

+  ssl_options.key_exchanges = SpawnedTestServer::SSLOptions::KEY_EXCHANGE_RSA;
+  SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, ssl_options,
+                                base::FilePath());
+  ASSERT_TRUE(test_server.Start());
+
+  AddressList addr;
+  ASSERT_TRUE(test_server.GetAddressList(&addr));
+
+  TestCompletionCallback callback;
+  TestNetLog log;
+  scoped_ptr<StreamSocket> transport(
+      new TCPClientSocket(addr, &log, NetLog::Source()));
+  int rv = transport->Connect(callback.callback());
+  if (rv == ERR_IO_PENDING)
+    rv = callback.WaitForResult();

[davidben, 2015/06/16 19:18:21]

Nit: This can be
   int rv = ....(callback.callback());
   rv = callback.GetResult(rv);
Or even
   EXPECT_EQ(OK, callback.GetResult(....(callback.callback())));

I think most of these tests predate GetResult. :-) Or were copied from ones that
did.

[Sergey Ulanov, 2015/06/16 19:29:07]

Done.

+  EXPECT_EQ(OK, rv);
+
+  SSLConfig config;
+  config.require_ecdhe = true;
+
+  scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket(
+      transport.Pass(), test_server.host_port_pair(), config));
+
+  rv = sock->Connect(callback.callback());
+
+  if (rv == ERR_IO_PENDING)
+    rv = callback.WaitForResult();
+
+  EXPECT_EQ(ERR_SSL_VERSION_OR_CIPHER_MISMATCH, rv);
+}
+
 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabled) {
   if (!SupportsAESGCM()) {
     LOG(WARNING) << "Skipping test because AES-GCM is not supported.";
     return;
   }
 
   // False Start requires NPN/ALPN, ECDHE, and an AEAD.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
@@ skipping 303 matching lines @@
   ssl_config.channel_id_enabled = true;
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
 
   EXPECT_EQ(ERR_UNEXPECTED, rv);
   EXPECT_FALSE(sock_->IsConnected());
 }
 
 }  // namespace net