relnote: remove insecure QUIC support

net/quic/crypto/quic_crypto_client_config_test.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_client_config.h"
 
 #include "net/quic/crypto/proof_verifier.h"
 #include "net/quic/quic_server_id.h"
+#include "net/quic/test_tools/crypto_test_utils.h"
 #include "net/quic/test_tools/mock_random.h"
 #include "net/quic/test_tools/quic_test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using std::string;
 using std::vector;
 
 namespace net {
 namespace test {
 namespace {
@@ skipping 125 matching lines @@
   EXPECT_EQ(state.server_config(), other.server_config());
   EXPECT_EQ(state.source_address_token(), other.source_address_token());
   EXPECT_EQ(state.certs(), other.certs());
   EXPECT_EQ(1u, other.generation_counter());
   EXPECT_FALSE(state.has_server_designated_connection_id());
   EXPECT_FALSE(state.has_server_nonce());
 }
 
 TEST(QuicCryptoClientConfigTest, InchoateChlo) {
   QuicCryptoClientConfig::CachedState state;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   QuicCryptoNegotiatedParameters params;
   CryptoHandshakeMessage msg;
-  QuicServerId server_id("www.google.com", 80, false, PRIVACY_MODE_DISABLED);
+  QuicServerId server_id("www.google.com", 80, PRIVACY_MODE_DISABLED);
   config.FillInchoateClientHello(server_id, QuicVersionMax(), &state,
                                  &params, &msg);
 
   QuicTag cver;
   EXPECT_EQ(QUIC_NO_ERROR, msg.GetUint32(kVER, &cver));
   EXPECT_EQ(QuicVersionToQuicTag(QuicVersionMax()), cver);
 }
 
 TEST(QuicCryptoClientConfigTest, PreferAesGcm) {
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   if (config.aead.size() > 1)
     EXPECT_NE(kAESG, config.aead[0]);
   config.PreferAesGcm();
   EXPECT_EQ(kAESG, config.aead[0]);
 }
 
 TEST(QuicCryptoClientConfigTest, InchoateChloSecure) {
   QuicCryptoClientConfig::CachedState state;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   QuicCryptoNegotiatedParameters params;
   CryptoHandshakeMessage msg;
-  QuicServerId server_id("www.google.com", 443, true, PRIVACY_MODE_DISABLED);
+  QuicServerId server_id("www.google.com", 443, PRIVACY_MODE_DISABLED);
   config.FillInchoateClientHello(server_id, QuicVersionMax(), &state,
                                  &params, &msg);
 
   QuicTag pdmd;
   EXPECT_EQ(QUIC_NO_ERROR, msg.GetUint32(kPDMD, &pdmd));
   EXPECT_EQ(kX509, pdmd);
 }
 
 TEST(QuicCryptoClientConfigTest, InchoateChloSecureNoEcdsa) {
   QuicCryptoClientConfig::CachedState state;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   config.DisableEcdsa();
   QuicCryptoNegotiatedParameters params;
   CryptoHandshakeMessage msg;
-  QuicServerId server_id("www.google.com", 443, true, PRIVACY_MODE_DISABLED);
+  QuicServerId server_id("www.google.com", 443, PRIVACY_MODE_DISABLED);
   config.FillInchoateClientHello(server_id, QuicVersionMax(), &state,
                                  &params, &msg);
 
   QuicTag pdmd;
   EXPECT_EQ(QUIC_NO_ERROR, msg.GetUint32(kPDMD, &pdmd));
   EXPECT_EQ(kX59R, pdmd);
 }
 
 TEST(QuicCryptoClientConfigTest, FillClientHello) {
   QuicCryptoClientConfig::CachedState state;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   QuicCryptoNegotiatedParameters params;
   QuicConnectionId kConnectionId = 1234;
   string error_details;
   MockRandom rand;
   CryptoHandshakeMessage chlo;
-  QuicServerId server_id("www.google.com", 80, false, PRIVACY_MODE_DISABLED);
+  QuicServerId server_id("www.google.com", 80, PRIVACY_MODE_DISABLED);
   config.FillClientHello(server_id,
                          kConnectionId,
                          QuicVersionMax(),
                          &state,
                          QuicWallTime::Zero(),
                          &rand,
                          nullptr,  // channel_id_key
                          &params,
                          &chlo,
                          &error_details);
@@ skipping 15 matching lines @@
     supported_version_tags.push_back(
         QuicVersionToQuicTag(supported_versions[i - 1]));
   }
   CryptoHandshakeMessage msg;
   msg.set_tag(kSHLO);
   msg.SetVector(kVER, supported_version_tags);
 
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   EXPECT_EQ(QUIC_VERSION_NEGOTIATION_MISMATCH,
             config.ProcessServerHello(msg, 0, supported_versions.front(),
                                       supported_versions, &cached, &out_params,
                                       &error));
   EXPECT_EQ("Downgrade attack detected", error);
 }
 
 TEST(QuicCryptoClientConfigTest, InitializeFrom) {
-  QuicCryptoClientConfig config;
-  QuicServerId canonical_server_id("www.google.com", 80, false,
-                                   PRIVACY_MODE_DISABLED);
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
+  QuicServerId canonical_server_id("www.google.com", 80, PRIVACY_MODE_DISABLED);
   QuicCryptoClientConfig::CachedState* state =
       config.LookupOrCreate(canonical_server_id);
   // TODO(rch): Populate other fields of |state|.
   state->set_source_address_token("TOKEN");
   state->SetProofValid();
 
-  QuicServerId other_server_id("mail.google.com", 80, false,
-                               PRIVACY_MODE_DISABLED);
+  QuicServerId other_server_id("mail.google.com", 80, PRIVACY_MODE_DISABLED);
   config.InitializeFrom(other_server_id, canonical_server_id, &config);
   QuicCryptoClientConfig::CachedState* other =
       config.LookupOrCreate(other_server_id);
 
   EXPECT_EQ(state->server_config(), other->server_config());
   EXPECT_EQ(state->source_address_token(), other->source_address_token());
   EXPECT_EQ(state->certs(), other->certs());
   EXPECT_EQ(1u, other->generation_counter());
 }
 
 TEST(QuicCryptoClientConfigTest, Canonical) {
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   config.AddCanonicalSuffix(".google.com");
-  QuicServerId canonical_id1("www.google.com", 80, false,
-                             PRIVACY_MODE_DISABLED);
-  QuicServerId canonical_id2("mail.google.com", 80, false,
-                             PRIVACY_MODE_DISABLED);
+  QuicServerId canonical_id1("www.google.com", 80, PRIVACY_MODE_DISABLED);
+  QuicServerId canonical_id2("mail.google.com", 80, PRIVACY_MODE_DISABLED);
   QuicCryptoClientConfig::CachedState* state =
       config.LookupOrCreate(canonical_id1);
   // TODO(rch): Populate other fields of |state|.
   state->set_source_address_token("TOKEN");
   state->SetProofValid();
 
   QuicCryptoClientConfig::CachedState* other =
       config.LookupOrCreate(canonical_id2);
 
   EXPECT_TRUE(state->IsEmpty());
   EXPECT_EQ(state->server_config(), other->server_config());
   EXPECT_EQ(state->source_address_token(), other->source_address_token());
   EXPECT_EQ(state->certs(), other->certs());
   EXPECT_EQ(1u, other->generation_counter());
 
-  QuicServerId different_id("mail.google.org", 80, false,
-                            PRIVACY_MODE_DISABLED);
+  QuicServerId different_id("mail.google.org", 80, PRIVACY_MODE_DISABLED);
   EXPECT_TRUE(config.LookupOrCreate(different_id)->IsEmpty());
 }
 
 TEST(QuicCryptoClientConfigTest, CanonicalNotUsedIfNotValid) {
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   config.AddCanonicalSuffix(".google.com");
-  QuicServerId canonical_id1("www.google.com", 80, false,
-                             PRIVACY_MODE_DISABLED);
-  QuicServerId canonical_id2("mail.google.com", 80, false,
-                             PRIVACY_MODE_DISABLED);
+  QuicServerId canonical_id1("www.google.com", 80, PRIVACY_MODE_DISABLED);
+  QuicServerId canonical_id2("mail.google.com", 80, PRIVACY_MODE_DISABLED);
   QuicCryptoClientConfig::CachedState* state =
       config.LookupOrCreate(canonical_id1);
   // TODO(rch): Populate other fields of |state|.
   state->set_source_address_token("TOKEN");
 
   // Do not set the proof as valid, and check that it is not used
   // as a canonical entry.
   EXPECT_TRUE(config.LookupOrCreate(canonical_id2)->IsEmpty());
 }
 
 TEST(QuicCryptoClientConfigTest, ClearCachedStates) {
-  QuicCryptoClientConfig config;
-  QuicServerId server_id("www.google.com", 80, false, PRIVACY_MODE_DISABLED);
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
+  QuicServerId server_id("www.google.com", 80, PRIVACY_MODE_DISABLED);
   QuicCryptoClientConfig::CachedState* state = config.LookupOrCreate(server_id);
   // TODO(rch): Populate other fields of |state|.
   vector<string> certs(1);
   certs[0] = "Hello Cert";
   state->SetProof(certs, "signature");
   state->set_source_address_token("TOKEN");
   state->SetProofValid();
   EXPECT_EQ(1u, state->generation_counter());
 
   // Verify LookupOrCreate returns the same data.
@@ skipping 52 matching lines @@
 }
 
 TEST(QuicCryptoClientConfigTest, ProcessReject) {
   CryptoHandshakeMessage rej;
   FillInDummyReject(&rej, /* stateless */ false);
 
   // Now process the rejection.
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   EXPECT_EQ(QUIC_NO_ERROR, config.ProcessRejection(
                                rej, QuicWallTime::FromUNIXSeconds(0), &cached,
-                               true,  // is_https
                                &out_params, &error));
   EXPECT_FALSE(cached.has_server_designated_connection_id());
   EXPECT_FALSE(cached.has_server_nonce());
 }
 
 TEST(QuicCryptoClientConfigTest, ProcessStatelessReject) {
   // Create a dummy reject message and mark it as stateless.
   CryptoHandshakeMessage rej;
   FillInDummyReject(&rej, /* stateless */ true);
   const QuicConnectionId kConnectionId = 0xdeadbeef;
   const string server_nonce = "SERVER_NONCE";
   rej.SetValue(kRCID, kConnectionId);
   rej.SetStringPiece(kServerNonceTag, server_nonce);
 
   // Now process the rejection.
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   EXPECT_EQ(QUIC_NO_ERROR, config.ProcessRejection(
                                rej, QuicWallTime::FromUNIXSeconds(0), &cached,
-                               true,  // is_https
                                &out_params, &error));
   EXPECT_TRUE(cached.has_server_designated_connection_id());
   EXPECT_EQ(kConnectionId, cached.GetNextServerDesignatedConnectionId());
   EXPECT_EQ(server_nonce, cached.GetNextServerNonce());
 }
 
 TEST(QuicCryptoClientConfigTest, BadlyFormattedStatelessReject) {
   // Create a dummy reject message and mark it as stateless.  Do not
   // add an server-designated connection-id.
   CryptoHandshakeMessage rej;
   FillInDummyReject(&rej, /* stateless */ true);
 
   // Now process the rejection.
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error;
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   EXPECT_EQ(
       QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND,
       config.ProcessRejection(rej, QuicWallTime::FromUNIXSeconds(0), &cached,
-                              true,  // is_https
                               &out_params, &error));
   EXPECT_FALSE(cached.has_server_designated_connection_id());
   EXPECT_EQ("Missing kRCID", error);
 }
 
 TEST(QuicCryptoClientConfigTest, ServerNonceinSHLO_BeforeQ027) {
   // Test that in QUIC_VERSION_26 and lower, the the server does not need to
   // include a nonce in the SHLO.
   CryptoHandshakeMessage msg;
   msg.set_tag(kSHLO);
   // Choose the lowest version.
   QuicVersionVector supported_versions;
   QuicVersion version = QuicSupportedVersions().back();
   supported_versions.push_back(version);
   EXPECT_LE(version, QUIC_VERSION_26);
   QuicTagVector versions;
   versions.push_back(QuicVersionToQuicTag(version));
   msg.SetVector(kVER, versions);
 
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error_details;
   config.ProcessServerHello(msg, 0, version, supported_versions, &cached,
                             &out_params, &error_details);
   EXPECT_NE("server hello missing server nonce", error_details);
 }
 
 TEST(QuicCryptoClientConfigTest, ServerNonceinSHLO_AfterQ027) {
   // Test that in QUIC_VERSION_27 and higher, the the server must include a
   // nonce in the SHLO.
   CryptoHandshakeMessage msg;
   msg.set_tag(kSHLO);
   // Choose the latest version.
   QuicVersionVector supported_versions;
   QuicVersion version = QuicSupportedVersions().front();
   supported_versions.push_back(version);
   EXPECT_LE(QUIC_VERSION_27, version);
   QuicTagVector versions;
   versions.push_back(QuicVersionToQuicTag(version));
   msg.SetVector(kVER, versions);
 
-  QuicCryptoClientConfig config;
+  QuicCryptoClientConfig config(CryptoTestUtils::ProofVerifierForTesting());
   QuicCryptoClientConfig::CachedState cached;
   QuicCryptoNegotiatedParameters out_params;
   string error_details;
   EXPECT_EQ(QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER,
             config.ProcessServerHello(msg, 0, version, supported_versions,
                                       &cached, &out_params, &error_details));
   EXPECT_EQ("server hello missing server nonce", error_details);
 }
 
 }  // namespace test
 }  // namespace net