| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/crypto/quic_crypto_server_config.h" | 5 #include "net/quic/crypto/quic_crypto_server_config.h" |
| 6 | 6 |
| 7 #include <stdarg.h> | 7 #include <stdarg.h> |
| 8 | 8 |
| 9 #include <memory> | 9 #include <memory> |
| 10 | 10 |
| 11 #include "base/stl_util.h" | 11 #include "base/stl_util.h" |
| 12 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h" | 12 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h" |
| 13 #include "net/quic/crypto/cert_compressor.h" | 13 #include "net/quic/crypto/cert_compressor.h" |
| 14 #include "net/quic/crypto/chacha20_poly1305_rfc7539_encrypter.h" | 14 #include "net/quic/crypto/chacha20_poly1305_encrypter.h" |
| 15 #include "net/quic/crypto/crypto_handshake_message.h" | 15 #include "net/quic/crypto/crypto_handshake_message.h" |
| 16 #include "net/quic/crypto/crypto_secret_boxer.h" | 16 #include "net/quic/crypto/crypto_secret_boxer.h" |
| 17 #include "net/quic/crypto/crypto_server_config_protobuf.h" | 17 #include "net/quic/crypto/crypto_server_config_protobuf.h" |
| 18 #include "net/quic/crypto/quic_random.h" | 18 #include "net/quic/crypto/quic_random.h" |
| 19 #include "net/quic/crypto/strike_register_client.h" | 19 #include "net/quic/crypto/strike_register_client.h" |
| 20 #include "net/quic/quic_flags.h" | 20 #include "net/quic/quic_flags.h" |
| 21 #include "net/quic/quic_time.h" | 21 #include "net/quic/quic_time.h" |
| 22 #include "net/quic/test_tools/crypto_test_utils.h" | 22 #include "net/quic/test_tools/crypto_test_utils.h" |
| 23 #include "net/quic/test_tools/mock_clock.h" | 23 #include "net/quic/test_tools/mock_clock.h" |
| 24 #include "net/quic/test_tools/quic_test_utils.h" | 24 #include "net/quic/test_tools/quic_test_utils.h" |
| (...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 239 std::unique_ptr<CryptoHandshakeMessage> message(server.AddDefaultConfig( | 239 std::unique_ptr<CryptoHandshakeMessage> message(server.AddDefaultConfig( |
| 240 rand, &clock, QuicCryptoServerConfig::ConfigOptions())); | 240 rand, &clock, QuicCryptoServerConfig::ConfigOptions())); |
| 241 | 241 |
| 242 // The default configuration should have AES-GCM and at least one ChaCha20 | 242 // The default configuration should have AES-GCM and at least one ChaCha20 |
| 243 // cipher. | 243 // cipher. |
| 244 const QuicTag* aead_tags; | 244 const QuicTag* aead_tags; |
| 245 size_t aead_len; | 245 size_t aead_len; |
| 246 ASSERT_EQ(QUIC_NO_ERROR, message->GetTaglist(kAEAD, &aead_tags, &aead_len)); | 246 ASSERT_EQ(QUIC_NO_ERROR, message->GetTaglist(kAEAD, &aead_tags, &aead_len)); |
| 247 vector<QuicTag> aead(aead_tags, aead_tags + aead_len); | 247 vector<QuicTag> aead(aead_tags, aead_tags + aead_len); |
| 248 EXPECT_THAT(aead, ::testing::Contains(kAESG)); | 248 EXPECT_THAT(aead, ::testing::Contains(kAESG)); |
| 249 if (ChaCha20Poly1305Rfc7539Encrypter::IsSupported()) { | 249 EXPECT_LE(1u, aead.size()); |
| 250 EXPECT_LE(2u, aead.size()); | |
| 251 } else { | |
| 252 EXPECT_LE(1u, aead.size()); | |
| 253 } | |
| 254 } | 250 } |
| 255 | 251 |
| 256 TEST(QuicCryptoServerConfigTest, ServerConfigDisableChaCha) { | 252 TEST(QuicCryptoServerConfigTest, ServerConfigDisableChaCha) { |
| 257 ValueRestore<bool> old_flag( | 253 ValueRestore<bool> old_flag( |
| 258 &FLAGS_quic_crypto_server_config_default_has_chacha20, false); | 254 &FLAGS_quic_crypto_server_config_default_has_chacha20, false); |
| 259 QuicRandom* rand = QuicRandom::GetInstance(); | 255 QuicRandom* rand = QuicRandom::GetInstance(); |
| 260 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, | 256 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, |
| 261 CryptoTestUtils::ProofSourceForTesting()); | 257 CryptoTestUtils::ProofSourceForTesting()); |
| 262 MockClock clock; | 258 MockClock clock; |
| 263 | 259 |
| (...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 297 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, | 293 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, |
| 298 CryptoTestUtils::ProofSourceForTesting()); | 294 CryptoTestUtils::ProofSourceForTesting()); |
| 299 QuicCryptoServerConfigPeer peer(&server); | 295 QuicCryptoServerConfigPeer peer(&server); |
| 300 | 296 |
| 301 vector<string> certs = {"testcert"}; | 297 vector<string> certs = {"testcert"}; |
| 302 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); | 298 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); |
| 303 | 299 |
| 304 string compressed = | 300 string compressed = |
| 305 peer.CompressChain(&compressed_certs_cache, chain, "", "", nullptr); | 301 peer.CompressChain(&compressed_certs_cache, chain, "", "", nullptr); |
| 306 | 302 |
| 307 if (FLAGS_quic_use_cached_compressed_certs) { | 303 EXPECT_EQ(compressed_certs_cache.Size(), 1u); |
| 308 EXPECT_EQ(compressed_certs_cache.Size(), 1u); | |
| 309 } else { | |
| 310 EXPECT_EQ(compressed_certs_cache.Size(), 0u); | |
| 311 } | |
| 312 } | 304 } |
| 313 | 305 |
| 314 TEST(QuicCryptoServerConfigTest, CompressSameCertsTwice) { | 306 TEST(QuicCryptoServerConfigTest, CompressSameCertsTwice) { |
| 315 QuicCompressedCertsCache compressed_certs_cache( | 307 QuicCompressedCertsCache compressed_certs_cache( |
| 316 QuicCompressedCertsCache::kQuicCompressedCertsCacheSize); | 308 QuicCompressedCertsCache::kQuicCompressedCertsCacheSize); |
| 317 | 309 |
| 318 QuicRandom* rand = QuicRandom::GetInstance(); | 310 QuicRandom* rand = QuicRandom::GetInstance(); |
| 319 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, | 311 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, |
| 320 CryptoTestUtils::ProofSourceForTesting()); | 312 CryptoTestUtils::ProofSourceForTesting()); |
| 321 QuicCryptoServerConfigPeer peer(&server); | 313 QuicCryptoServerConfigPeer peer(&server); |
| 322 | 314 |
| 323 // Compress the certs for the first time. | 315 // Compress the certs for the first time. |
| 324 vector<string> certs = {"testcert"}; | 316 vector<string> certs = {"testcert"}; |
| 325 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); | 317 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); |
| 326 string common_certs = ""; | 318 string common_certs = ""; |
| 327 string cached_certs = ""; | 319 string cached_certs = ""; |
| 328 | 320 |
| 329 string compressed = peer.CompressChain(&compressed_certs_cache, chain, | 321 string compressed = peer.CompressChain(&compressed_certs_cache, chain, |
| 330 common_certs, cached_certs, nullptr); | 322 common_certs, cached_certs, nullptr); |
| 331 if (FLAGS_quic_use_cached_compressed_certs) { | 323 EXPECT_EQ(compressed_certs_cache.Size(), 1u); |
| 332 EXPECT_EQ(compressed_certs_cache.Size(), 1u); | |
| 333 } | |
| 334 | 324 |
| 335 // Compress the same certs, should use cache if available. | 325 // Compress the same certs, should use cache if available. |
| 336 string compressed2 = peer.CompressChain(&compressed_certs_cache, chain, | 326 string compressed2 = peer.CompressChain(&compressed_certs_cache, chain, |
| 337 common_certs, cached_certs, nullptr); | 327 common_certs, cached_certs, nullptr); |
| 338 EXPECT_EQ(compressed, compressed2); | 328 EXPECT_EQ(compressed, compressed2); |
| 339 if (FLAGS_quic_use_cached_compressed_certs) { | 329 EXPECT_EQ(compressed_certs_cache.Size(), 1u); |
| 340 EXPECT_EQ(compressed_certs_cache.Size(), 1u); | |
| 341 } | |
| 342 } | 330 } |
| 343 | 331 |
| 344 TEST(QuicCryptoServerConfigTest, CompressDifferentCerts) { | 332 TEST(QuicCryptoServerConfigTest, CompressDifferentCerts) { |
| 345 // This test compresses a set of similar but not identical certs. Cache if | 333 // This test compresses a set of similar but not identical certs. Cache if |
| 346 // used should return cache miss and add all the compressed certs. | 334 // used should return cache miss and add all the compressed certs. |
| 347 QuicCompressedCertsCache compressed_certs_cache( | 335 QuicCompressedCertsCache compressed_certs_cache( |
| 348 QuicCompressedCertsCache::kQuicCompressedCertsCacheSize); | 336 QuicCompressedCertsCache::kQuicCompressedCertsCacheSize); |
| 349 | 337 |
| 350 QuicRandom* rand = QuicRandom::GetInstance(); | 338 QuicRandom* rand = QuicRandom::GetInstance(); |
| 351 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, | 339 QuicCryptoServerConfig server(QuicCryptoServerConfig::TESTING, rand, |
| 352 CryptoTestUtils::ProofSourceForTesting()); | 340 CryptoTestUtils::ProofSourceForTesting()); |
| 353 QuicCryptoServerConfigPeer peer(&server); | 341 QuicCryptoServerConfigPeer peer(&server); |
| 354 | 342 |
| 355 vector<string> certs = {"testcert"}; | 343 vector<string> certs = {"testcert"}; |
| 356 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); | 344 scoped_refptr<ProofSource::Chain> chain(new ProofSource::Chain(certs)); |
| 357 string common_certs = ""; | 345 string common_certs = ""; |
| 358 string cached_certs = ""; | 346 string cached_certs = ""; |
| 359 | 347 |
| 360 string compressed = peer.CompressChain(&compressed_certs_cache, chain, | 348 string compressed = peer.CompressChain(&compressed_certs_cache, chain, |
| 361 common_certs, cached_certs, nullptr); | 349 common_certs, cached_certs, nullptr); |
| 362 if (FLAGS_quic_use_cached_compressed_certs) { | 350 EXPECT_EQ(compressed_certs_cache.Size(), 1u); |
| 363 EXPECT_EQ(compressed_certs_cache.Size(), 1u); | |
| 364 } | |
| 365 | 351 |
| 366 // Compress a similar certs which only differs in the chain. | 352 // Compress a similar certs which only differs in the chain. |
| 367 scoped_refptr<ProofSource::Chain> chain2(new ProofSource::Chain(certs)); | 353 scoped_refptr<ProofSource::Chain> chain2(new ProofSource::Chain(certs)); |
| 368 | 354 |
| 369 string compressed2 = peer.CompressChain(&compressed_certs_cache, chain2, | 355 string compressed2 = peer.CompressChain(&compressed_certs_cache, chain2, |
| 370 common_certs, cached_certs, nullptr); | 356 common_certs, cached_certs, nullptr); |
| 371 if (FLAGS_quic_use_cached_compressed_certs) { | 357 EXPECT_EQ(compressed_certs_cache.Size(), 2u); |
| 372 EXPECT_EQ(compressed_certs_cache.Size(), 2u); | |
| 373 } | |
| 374 | 358 |
| 375 // Compress a similar certs which only differs in common certs field. | 359 // Compress a similar certs which only differs in common certs field. |
| 376 static const uint64_t set_hash = 42; | 360 static const uint64_t set_hash = 42; |
| 377 std::unique_ptr<CommonCertSets> common_sets( | 361 std::unique_ptr<CommonCertSets> common_sets( |
| 378 CryptoTestUtils::MockCommonCertSets(certs[0], set_hash, 1)); | 362 CryptoTestUtils::MockCommonCertSets(certs[0], set_hash, 1)); |
| 379 StringPiece different_common_certs(reinterpret_cast<const char*>(&set_hash), | 363 StringPiece different_common_certs(reinterpret_cast<const char*>(&set_hash), |
| 380 sizeof(set_hash)); | 364 sizeof(set_hash)); |
| 381 string compressed3 = peer.CompressChain(&compressed_certs_cache, chain, | 365 string compressed3 = peer.CompressChain(&compressed_certs_cache, chain, |
| 382 different_common_certs.as_string(), | 366 different_common_certs.as_string(), |
| 383 cached_certs, common_sets.get()); | 367 cached_certs, common_sets.get()); |
| 384 if (FLAGS_quic_use_cached_compressed_certs) { | 368 EXPECT_EQ(compressed_certs_cache.Size(), 3u); |
| 385 EXPECT_EQ(compressed_certs_cache.Size(), 3u); | |
| 386 } | |
| 387 } | 369 } |
| 388 | 370 |
| 389 class SourceAddressTokenTest : public ::testing::Test { | 371 class SourceAddressTokenTest : public ::testing::Test { |
| 390 public: | 372 public: |
| 391 SourceAddressTokenTest() | 373 SourceAddressTokenTest() |
| 392 : ip4_(Loopback4()), | 374 : ip4_(Loopback4()), |
| 393 ip4_dual_(ConvertIPv4ToIPv4MappedIPv6(ip4_)), | 375 ip4_dual_(ConvertIPv4ToIPv4MappedIPv6(ip4_)), |
| 394 ip6_(Loopback6()), | 376 ip6_(Loopback6()), |
| 395 original_time_(QuicWallTime::Zero()), | 377 original_time_(QuicWallTime::Zero()), |
| 396 rand_(QuicRandom::GetInstance()), | 378 rand_(QuicRandom::GetInstance()), |
| (...skipping 379 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 776 TEST_F(CryptoServerConfigsTest, InvalidConfigs) { | 758 TEST_F(CryptoServerConfigsTest, InvalidConfigs) { |
| 777 // Ensure that invalid configs don't change anything. | 759 // Ensure that invalid configs don't change anything. |
| 778 SetConfigs("a", 800, 1, "b", 900, 1, "c", 1100, 1, nullptr); | 760 SetConfigs("a", 800, 1, "b", 900, 1, "c", 1100, 1, nullptr); |
| 779 test_peer_.CheckConfigs("a", false, "b", true, "c", false, nullptr); | 761 test_peer_.CheckConfigs("a", false, "b", true, "c", false, nullptr); |
| 780 SetConfigs("a", 800, 1, "c", 1100, 1, "INVALID1", 1000, 1, nullptr); | 762 SetConfigs("a", 800, 1, "c", 1100, 1, "INVALID1", 1000, 1, nullptr); |
| 781 test_peer_.CheckConfigs("a", false, "b", true, "c", false, nullptr); | 763 test_peer_.CheckConfigs("a", false, "b", true, "c", false, nullptr); |
| 782 } | 764 } |
| 783 | 765 |
| 784 } // namespace test | 766 } // namespace test |
| 785 } // namespace net | 767 } // namespace net |
| OLD | NEW |