IsSecureTLSCipherSuite should not classify DHE_RSA as secure.

net/ssl/ssl_cipher_suite_names_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_cipher_suite_names.h"
 
 #include "base/basictypes.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ skipping 46 matching lines @@
   };
 
   for (size_t i = 0; i < arraysize(cipher_strings); ++i) {
     uint16 cipher_suite = 0;
     EXPECT_FALSE(ParseSSLCipherString(cipher_strings[i], &cipher_suite));
   }
 }
 
 TEST(CipherSuiteNamesTest, SecureCipherSuites) {
   // Picked some random cipher suites.
-  EXPECT_FALSE(IsSecureTLSCipherSuite(0x0));
-  EXPECT_FALSE(IsSecureTLSCipherSuite(0x39));
-  EXPECT_FALSE(IsSecureTLSCipherSuite(0xc5));
-  EXPECT_FALSE(IsSecureTLSCipherSuite(0xc00f));
-  EXPECT_FALSE(IsSecureTLSCipherSuite(0xc083));
+  EXPECT_FALSE(IsSecureTLSCipherSuite(0x0 /* TLS_NULL_WITH_NULL_NULL */));
+  EXPECT_FALSE(
+      IsSecureTLSCipherSuite(0x39 /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(IsSecureTLSCipherSuite(
+      0xc5 /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */));
+  EXPECT_FALSE(
+      IsSecureTLSCipherSuite(0xc00f /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(IsSecureTLSCipherSuite(
+      0xc083 /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */));
+  EXPECT_FALSE(
+      IsSecureTLSCipherSuite(0x9e /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */));
+  EXPECT_FALSE(
+      IsSecureTLSCipherSuite(0xc014 /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(
+      IsSecureTLSCipherSuite(0x9c /* TLS_RSA_WITH_AES_128_GCM_SHA256 */));
 
   // Non-existent cipher suite.
   EXPECT_FALSE(IsSecureTLSCipherSuite(0xffff)) << "Doesn't exist!";
 
   // Secure ones.
-  EXPECT_TRUE(IsSecureTLSCipherSuite(0xcc13));
-  EXPECT_TRUE(IsSecureTLSCipherSuite(0xcc14));
-  EXPECT_TRUE(IsSecureTLSCipherSuite(0xcc15));

[davidben, 2015/10/16 21:39:19]

(0xcc15 is the non-standard DHE_RSA CHACHA20_POLY1305 cipher. Neither BoringSSL
or NSS supports it at all now.)

+  EXPECT_TRUE(IsSecureTLSCipherSuite(
+      0xc02f /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */));
+  EXPECT_TRUE(IsSecureTLSCipherSuite(
+      0xcc13 /* ECDHE_RSA_WITH_CHACHA20_POLY1305 (non-standard) */));
+  EXPECT_TRUE(IsSecureTLSCipherSuite(
+      0xcc14 /* ECDHE_ECDSA_WITH_CHACHA20_POLY1305 (non-standard) */));
+}
+
+TEST(CipherSuiteNamesTest, HTTP2CipherSuites) {
+  // Picked some random cipher suites.
+  EXPECT_FALSE(
+      IsTLSCipherSuiteAllowedByHTTP2(0x0 /* TLS_NULL_WITH_NULL_NULL */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0x39 /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xc5 /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xc00f /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xc083 /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xc014 /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */));
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
+      0x9c /* TLS_RSA_WITH_AES_128_GCM_SHA256 */));
+
+  // Non-existent cipher suite.
+  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(0xffff)) << "Doesn't exist!";
+
+  // HTTP/2-compatible ones.
+  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
+      0x9e /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */));
+  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xc02f /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */));
+  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xcc13 /* ECDHE_RSA_WITH_CHACHA20_POLY1305 (non-standard) */));
+  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
+      0xcc14 /* ECDHE_ECDSA_WITH_CHACHA20_POLY1305 (non-standard) */));
 }
 
 }  // anonymous namespace
 
 }  // namespace net