Disable HTTP/2 over NPN (with OpenSSL).

net/socket/ssl_client_socket_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
@@ skipping 3122 matching lines @@
 
 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabled) {
   // False Start requires NPN/ALPN, ECDHE, and an AEAD.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
   ASSERT_NO_FATAL_FAILURE(
       TestFalseStart(server_options, client_config, true));
 }
 
 // Test that False Start is disabled without NPN.
 TEST_F(SSLClientSocketFalseStartTest, NoNPN) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   SSLConfig client_config;
-  client_config.next_protos.clear();
+  client_config.alpn_protos.clear();
+  client_config.npn_protos.clear();
   ASSERT_NO_FATAL_FAILURE(
       TestFalseStart(server_options, client_config, false));
 }
 
 // Test that False Start is disabled with plain RSA ciphers.
 TEST_F(SSLClientSocketFalseStartTest, RSA) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
   ASSERT_NO_FATAL_FAILURE(
       TestFalseStart(server_options, client_config, false));
 }
 
 // Test that False Start is disabled with DHE_RSA ciphers.
 TEST_F(SSLClientSocketFalseStartTest, DHE_RSA) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_DHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
   ASSERT_NO_FATAL_FAILURE(TestFalseStart(server_options, client_config, false));
 }
 
 // Test that False Start is disabled without an AEAD.
 TEST_F(SSLClientSocketFalseStartTest, NoAEAD) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
   ASSERT_NO_FATAL_FAILURE(TestFalseStart(server_options, client_config, false));
 }
 
 // Test that sessions are resumable after receiving the server Finished message.
 TEST_F(SSLClientSocketFalseStartTest, SessionResumption) {
   // Start a server.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
 
   // Let a full handshake complete with False Start.
   ASSERT_NO_FATAL_FAILURE(
       TestFalseStart(server_options, client_config, true));
 
   // Make a second connection.
   TestCompletionCallback callback;
   scoped_ptr<StreamSocket> transport2(
       new TCPClientSocket(addr(), &log_, NetLog::Source()));
   EXPECT_EQ(OK, callback.GetResult(transport2->Connect(callback.callback())));
@@ skipping 14 matching lines @@
   // Start a server.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   ASSERT_TRUE(StartTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
 
   // Start a handshake up to the server Finished message.
   TestCompletionCallback callback;
   FakeBlockingStreamSocket* raw_transport1 = NULL;
   scoped_ptr<SSLClientSocket> sock1;
   ASSERT_NO_FATAL_FAILURE(CreateAndConnectUntilServerFinishedReceived(
       client_config, &callback, &raw_transport1, &sock1));
   // Although raw_transport1 has the server Finished blocked, the handshake
   // still completes.
   EXPECT_EQ(OK, callback.WaitForResult());
@@ skipping 37 matching lines @@
   // Start a server.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
       SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   ASSERT_TRUE(StartTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
 
   // Start a handshake up to the server Finished message.
   TestCompletionCallback callback;
   FakeBlockingStreamSocket* raw_transport1 = NULL;
   scoped_ptr<SSLClientSocket> sock1;
   ASSERT_NO_FATAL_FAILURE(CreateAndConnectUntilServerFinishedReceived(
       client_config, &callback, &raw_transport1, &sock1));
   // Although raw_transport1 has the server Finished blocked, the handshake
   // still completes.
   EXPECT_EQ(OK, callback.WaitForResult());
@@ skipping 96 matching lines @@
   SSLConfig ssl_config;
   ssl_config.channel_id_enabled = true;
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
 
   EXPECT_EQ(ERR_UNEXPECTED, rv);
   EXPECT_FALSE(sock_->IsConnected());
 }
 
+// Because of quirks of the NSS implementation, in the following NPN tests,
+// client_config.alpn_protos needs to be set, because NSS uses it for NPN (it
+// has to use the same string as for ALPN), and client_config.npn_protos needs
+// to be non-empty, otherwise NSS disables NPN.

[davidben, 2015/10/13 20:55:59]

Optional: Wrap the alpn_protos bits under #ifdef to make sure we don't read
alpn_protos in USE_OPENSSL ports.

[Bence, 2015/10/14 14:55:59]

Done.

+
 TEST_F(SSLClientSocketTest, NPN) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.npn_protocols.push_back(std::string("spdy/3.1"));
   server_options.npn_protocols.push_back(std::string("h2"));
   ASSERT_TRUE(ConnectToTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP2);
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP2);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP2);
+  client_config.npn_protos.push_back(kProtoHTTP11);
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv));
   EXPECT_EQ(OK, rv);
 
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoNegotiated, sock_->GetNextProto(&proto));
   EXPECT_EQ("h2", proto);
 }
 
 // In case of no overlap between client and server list, SSLClientSocket should
 // fall back to last one on the client list.
 TEST_F(SSLClientSocketTest, NPNNoOverlap) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.npn_protocols.push_back(std::string("http/1.1"));
   ASSERT_TRUE(ConnectToTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoSPDY31);
-  client_config.next_protos.push_back(kProtoHTTP2);
+  client_config.alpn_protos.push_back(kProtoSPDY31);
+  client_config.alpn_protos.push_back(kProtoHTTP2);
+  client_config.npn_protos.push_back(kProtoSPDY31);
+  client_config.npn_protos.push_back(kProtoHTTP2);
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv));
   EXPECT_EQ(OK, rv);
 
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoNoOverlap, sock_->GetNextProto(&proto));
   EXPECT_EQ("h2", proto);
 }
 
 // Server preference should be respected.  The list is in decreasing order of
 // preference.
 TEST_F(SSLClientSocketTest, NPNServerPreference) {
   SpawnedTestServer::SSLOptions server_options;
   server_options.npn_protocols.push_back(std::string("spdy/3.1"));
   server_options.npn_protocols.push_back(std::string("h2"));
   ASSERT_TRUE(ConnectToTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP2);
-  client_config.next_protos.push_back(kProtoSPDY31);
+  client_config.alpn_protos.push_back(kProtoHTTP2);
+  client_config.alpn_protos.push_back(kProtoSPDY31);
+  client_config.npn_protos.push_back(kProtoHTTP2);
+  client_config.npn_protos.push_back(kProtoSPDY31);
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv));
   EXPECT_EQ(OK, rv);
 
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoNegotiated, sock_->GetNextProto(&proto));
   EXPECT_EQ("spdy/3.1", proto);
 }
 
@@ skipping 11 matching lines @@
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoUnsupported,
             sock_->GetNextProto(&proto));
 }
 
 TEST_F(SSLClientSocketTest, NPNServerDisabled) {
   SpawnedTestServer::SSLOptions server_options;
   ASSERT_TRUE(ConnectToTestServer(server_options));
 
   SSLConfig client_config;
-  client_config.next_protos.push_back(kProtoHTTP11);
+  client_config.alpn_protos.push_back(kProtoHTTP11);
+  client_config.npn_protos.push_back(kProtoHTTP11);
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv));
   EXPECT_EQ(OK, rv);
 
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoUnsupported,
             sock_->GetNextProto(&proto));
 }
 
 }  // namespace net