Require support for X509 certificates in QUIC CHLO PDMDs. Protected by --quic_require_x509

net/quic/crypto/crypto_server_test.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <cstdint>
 #include <memory>
 #include <ostream>
 #include <vector>
 
@@ skipping 131 matching lines @@
 
     char public_value[32];
     memset(public_value, 42, sizeof(public_value));
 
     nonce_hex_ = "#" + QuicUtils::HexEncode(GenerateNonce());
     pub_hex_ = "#" + QuicUtils::HexEncode(public_value, sizeof(public_value));
 
     // clang-format off
     CryptoHandshakeMessage client_hello = CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "AEAD", "AESG",
         "KEXS", "C255",
         "PUBS", pub_hex_.c_str(),
         "NONC", nonce_hex_.c_str(),
         "CSCT", "",
         "VER\0", client_version_string_.c_str(),
         "$padding", static_cast<int>(kClientHelloMinimumSize),
         nullptr);
     // clang-format on
     ShouldSucceed(client_hello);
@@ skipping 230 matching lines @@
     "#ff00",
     "127.0.0.1",
     "ffee::1",
   };
   // clang-format on
 
   for (size_t i = 0; i < arraysize(kBadSNIs); i++) {
     // clang-format off
     CryptoHandshakeMessage msg = CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "SNI", kBadSNIs[i],
         "VER\0", client_version_string_.c_str(),
         "$padding", static_cast<int>(kClientHelloMinimumSize),
         nullptr);
     // clang-format on
     ShouldFailMentioning("SNI", msg);
     const HandshakeFailureReason kRejectReasons[] = {
         SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
   }
@@ skipping 29 matching lines @@
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
   EXPECT_EQ(client_version_ > QUIC_VERSION_29, cert_sct.size() > 0);
 }
 
 TEST_P(CryptoServerTest, RejectTooLarge) {
   // Check that the server replies with no certificate when a CHLO is
   // constructed with a PDMD but no SKT when the REJ would be too large.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "PDMD", "X509",
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
 
   // The REJ will be larger than the CHLO so no PROF or CRT will be sent.
   config_.set_chlo_multiplier(1);
 
   ShouldSucceed(msg);
   StringPiece cert, proof, cert_sct;
   EXPECT_FALSE(out_.GetStringPiece(kCertificateTag, &cert));
   EXPECT_FALSE(out_.GetStringPiece(kPROF, &proof));
   EXPECT_FALSE(out_.GetStringPiece(kCertificateSCTTag, &cert_sct));
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, RejectTooLargeButValidSTK) {
   // Check that the server replies with no certificate when a CHLO is
   // constructed with a PDMD but no SKT when the REJ would be too large.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PDMD", "X509",
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
@@ skipping 11 matching lines @@
   EXPECT_NE(0u, proof.size());
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, TooSmall) {
   // clang-format off
   ShouldFailMentioning("too small", CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "VER\0", client_version_string_.c_str(),
         nullptr));
   // clang-format on
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, BadSourceAddressToken) {
   // Invalid source-address tokens should be ignored.
   // clang-format off
   static const char* const kBadSourceAddressTokens[] = {
     "",
     "foo",
     "#0000",
     "#0000000000000000000000000000000000000000",
   };
   // clang-format on
 
   for (size_t i = 0; i < arraysize(kBadSourceAddressTokens); i++) {
     // clang-format off
     CryptoHandshakeMessage msg = CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "STK", kBadSourceAddressTokens[i],
         "VER\0", client_version_string_.c_str(),
         "$padding", static_cast<int>(kClientHelloMinimumSize), nullptr);
     // clang-format on
     ShouldSucceed(msg);
     const HandshakeFailureReason kRejectReasons[] = {
         SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
   }
 }
 
 TEST_P(CryptoServerTest, BadClientNonce) {
   // clang-format off
   static const char* const kBadNonces[] = {
     "",
     "#0000",
     "#0000000000000000000000000000000000000000",
   };
   // clang-format on
 
   for (size_t i = 0; i < arraysize(kBadNonces); i++) {
     // Invalid nonces should be ignored, in an inchoate CHLO.
     // clang-format off
     CryptoHandshakeMessage msg = CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "NONC", kBadNonces[i],
         "VER\0", client_version_string_.c_str(),
         "$padding", static_cast<int>(kClientHelloMinimumSize),
         nullptr);
     // clang-format on
     ShouldSucceed(msg);
     const HandshakeFailureReason kRejectReasons[] = {
         SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 
     // Invalid nonces should result in CLIENT_NONCE_INVALID_FAILURE.
     // clang-format off
     CryptoHandshakeMessage msg1 = CryptoTestUtils::Message(
         "CHLO",
+        "PDMD", "X509",
         "AEAD", "AESG",
         "KEXS", "C255",
         "SCID", scid_hex_.c_str(),
         "#004b5453", srct_hex_.c_str(),
         "PUBS", pub_hex_.c_str(),
         "NONC", kBadNonces[i],
         "NONP", kBadNonces[i],
         "XLCT", XlctHexString().c_str(),
         "VER\0", client_version_string_.c_str(),
         "$padding", static_cast<int>(kClientHelloMinimumSize),
         nullptr);
     // clang-format on
 
     ShouldSucceed(msg1);
 
     CheckRejectTag();
     const HandshakeFailureReason kRejectReasons1[] = {
         CLIENT_NONCE_INVALID_FAILURE};
     CheckRejectReasons(kRejectReasons1, arraysize(kRejectReasons1));
   }
 }
 
 TEST_P(CryptoServerTest, NoClientNonce) {
   // No client nonces should result in INCHOATE_HELLO_FAILURE.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
 
   ShouldSucceed(msg);
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 
   // clang-format off
   CryptoHandshakeMessage msg1 = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
@@ skipping 11 matching lines @@
     return;
   }
   // Set the client's preferred version to a supported version that
   // is not the "current" version (supported_versions_.front()).
   string bad_version =
       QuicUtils::TagToString(QuicVersionToQuicTag(supported_versions_.back()));
 
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "VER\0", bad_version.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldFailMentioning("Downgrade", msg);
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, CorruptServerConfig) {
   // This tests corrupted server config.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", (string(1, 'X') + scid_hex_).c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldSucceed(msg);
   CheckRejectTag();
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, CorruptSourceAddressToken) {
   // This tests corrupted source address token.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldSucceed(msg);
   CheckRejectTag();
   const HandshakeFailureReason kRejectReasons[] = {
       SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, CorruptClientNonceAndSourceAddressToken) {
   // This test corrupts client nonce and source address token.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", (string(1, 'X') + nonce_hex_).c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldSucceed(msg);
   CheckRejectTag();
   const HandshakeFailureReason kRejectReasons[] = {
       SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE, CLIENT_NONCE_INVALID_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, CorruptMultipleTags) {
   // This test corrupts client nonce, server nonce and source address token.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", (string(1, 'X') + nonce_hex_).c_str(),
       "NONP", (string(1, 'X') + nonce_hex_).c_str(),
       "SNO\0", (string(1, 'X') + nonce_hex_).c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
@@ skipping 14 matching lines @@
     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
   };
 }
 
 TEST_P(CryptoServerTest, NoServerNonce) {
   // When no server nonce is present and no strike register is configured,
   // the CHLO should be rejected.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "NONP", nonce_hex_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
@@ skipping 77 matching lines @@
 }
 
 TEST_P(CryptoServerTest, RejectInvalidXlct) {
   if (client_version_ <= QUIC_VERSION_25) {
     // XLCT tag introduced in QUIC_VERSION_26.
     return;
   }
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "XLCT", "#0102030405060708",
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   // If replay protection isn't disabled, then
   // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false
   // and cause ProcessClientHello to exit early (and generate a REJ message).
   config_.set_replay_protection(false);
 
   ShouldSucceed(msg);
   // clang-format off
   const HandshakeFailureReason kRejectReasons[] = {
     INVALID_EXPECTED_LEAF_CERTIFICATE
   };
   // clang-format on
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, ValidXlct) {
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "NONP", "123456789012345678901234567890",
       "VER\0", client_version_string_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   // If replay protection isn't disabled, then
   // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false
   // and cause ProcessClientHello to exit early (and generate a REJ message).
   config_.set_replay_protection(false);
 
   ShouldSucceed(msg);
   EXPECT_EQ(kSHLO, out_.tag());
 }
 
 TEST_P(CryptoServerTest, NonceInSHLO) {
   // After QUIC_VERSION_27, the SHLO should contain a nonce.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
@@ skipping 92 matching lines @@
  public:
   void SetUp() override {
     // Deliberately don't add a config so that we can test this situation.
   }
 };
 
 TEST_P(CryptoServerTestNoConfig, DontCrash) {
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldFailMentioning("No config", msg);
 
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 class CryptoServerTestOldVersion : public CryptoServerTest {
  public:
   void SetUp() override {
     client_version_ = supported_versions_.back();
     client_version_string_ =
         QuicUtils::TagToString(QuicVersionToQuicTag(client_version_));
     CryptoServerTest::SetUp();
   }
 };
 
 TEST_P(CryptoServerTestOldVersion, ServerIgnoresXlct) {
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "XLCT", "#0100000000000000",
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   // If replay protection isn't disabled, then
   // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false
   // and cause ProcessClientHello to exit early (and generate a REJ message).
   config_.set_replay_protection(false);
 
   ShouldSucceed(msg);
   EXPECT_EQ(kSHLO, out_.tag());
 }
 
 TEST_P(CryptoServerTestOldVersion, XlctNotRequired) {
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
@@ skipping 25 matching lines @@
   }
 
   DelayedVerifyStrikeRegisterClient* strike_register_client_;
 };
 
 TEST_P(AsyncStrikeServerVerificationTest, AsyncReplayProtection) {
   // This tests async validation with a strike register works.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
+      "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
@@ skipping 28 matching lines @@
 
   strike_register_client_->RunPendingVerifications();
   ASSERT_TRUE(called);
   EXPECT_EQ(0, strike_register_client_->PendingVerifications());
   // The message should be rejected now.
   CheckRejectTag();
 }
 
 }  // namespace test
 }  // namespace net