| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <algorithm> | 5 #include <algorithm> |
| 6 #include <cstdint> | 6 #include <cstdint> |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <ostream> | 8 #include <ostream> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| (...skipping 416 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 427 "PDMD", "X509", | 427 "PDMD", "X509", |
| 428 "VER\0", client_version_string_.c_str(), | 428 "VER\0", client_version_string_.c_str(), |
| 429 "$padding", static_cast<int>(kClientHelloMinimumSize), | 429 "$padding", static_cast<int>(kClientHelloMinimumSize), |
| 430 nullptr); | 430 nullptr); |
| 431 // clang-format on | 431 // clang-format on |
| 432 | 432 |
| 433 ShouldSucceed(msg); | 433 ShouldSucceed(msg); |
| 434 StringPiece cert, proof, cert_sct; | 434 StringPiece cert, proof, cert_sct; |
| 435 EXPECT_TRUE(out_.GetStringPiece(kCertificateTag, &cert)); | 435 EXPECT_TRUE(out_.GetStringPiece(kCertificateTag, &cert)); |
| 436 EXPECT_TRUE(out_.GetStringPiece(kPROF, &proof)); | 436 EXPECT_TRUE(out_.GetStringPiece(kPROF, &proof)); |
| 437 EXPECT_EQ(client_version_ > QUIC_VERSION_29, | 437 EXPECT_TRUE(out_.GetStringPiece(kCertificateSCTTag, &cert_sct)); |
| 438 out_.GetStringPiece(kCertificateSCTTag, &cert_sct)); | |
| 439 EXPECT_NE(0u, cert.size()); | 438 EXPECT_NE(0u, cert.size()); |
| 440 EXPECT_NE(0u, proof.size()); | 439 EXPECT_NE(0u, proof.size()); |
| 441 const HandshakeFailureReason kRejectReasons[] = { | 440 const HandshakeFailureReason kRejectReasons[] = { |
| 442 SERVER_CONFIG_INCHOATE_HELLO_FAILURE}; | 441 SERVER_CONFIG_INCHOATE_HELLO_FAILURE}; |
| 443 CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons)); | 442 CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons)); |
| 444 EXPECT_EQ(client_version_ > QUIC_VERSION_29, cert_sct.size() > 0); | 443 EXPECT_LT(0u, cert_sct.size()); |
| 445 } | 444 } |
| 446 | 445 |
| 447 TEST_P(CryptoServerTest, RejectTooLarge) { | 446 TEST_P(CryptoServerTest, RejectTooLarge) { |
| 448 // Check that the server replies with no certificate when a CHLO is | 447 // Check that the server replies with no certificate when a CHLO is |
| 449 // constructed with a PDMD but no SKT when the REJ would be too large. | 448 // constructed with a PDMD but no SKT when the REJ would be too large. |
| 450 // clang-format off | 449 // clang-format off |
| 451 CryptoHandshakeMessage msg = CryptoTestUtils::Message( | 450 CryptoHandshakeMessage msg = CryptoTestUtils::Message( |
| 452 "CHLO", | 451 "CHLO", |
| 453 "PDMD", "X509", | 452 "PDMD", "X509", |
| 454 "AEAD", "AESG", | 453 "AEAD", "AESG", |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 492 nullptr); | 491 nullptr); |
| 493 // clang-format on | 492 // clang-format on |
| 494 | 493 |
| 495 // The REJ will be larger than the CHLO so no PROF or CRT will be sent. | 494 // The REJ will be larger than the CHLO so no PROF or CRT will be sent. |
| 496 config_.set_chlo_multiplier(1); | 495 config_.set_chlo_multiplier(1); |
| 497 | 496 |
| 498 ShouldSucceed(msg); | 497 ShouldSucceed(msg); |
| 499 StringPiece cert, proof, cert_sct; | 498 StringPiece cert, proof, cert_sct; |
| 500 EXPECT_TRUE(out_.GetStringPiece(kCertificateTag, &cert)); | 499 EXPECT_TRUE(out_.GetStringPiece(kCertificateTag, &cert)); |
| 501 EXPECT_TRUE(out_.GetStringPiece(kPROF, &proof)); | 500 EXPECT_TRUE(out_.GetStringPiece(kPROF, &proof)); |
| 502 EXPECT_EQ(client_version_ > QUIC_VERSION_29, | 501 EXPECT_TRUE(out_.GetStringPiece(kCertificateSCTTag, &cert_sct)); |
| 503 out_.GetStringPiece(kCertificateSCTTag, &cert_sct)); | |
| 504 EXPECT_NE(0u, cert.size()); | 502 EXPECT_NE(0u, cert.size()); |
| 505 EXPECT_NE(0u, proof.size()); | 503 EXPECT_NE(0u, proof.size()); |
| 506 const HandshakeFailureReason kRejectReasons[] = { | 504 const HandshakeFailureReason kRejectReasons[] = { |
| 507 SERVER_CONFIG_INCHOATE_HELLO_FAILURE}; | 505 SERVER_CONFIG_INCHOATE_HELLO_FAILURE}; |
| 508 CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons)); | 506 CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons)); |
| 509 } | 507 } |
| 510 | 508 |
| 511 TEST_P(CryptoServerTest, TooSmall) { | 509 TEST_P(CryptoServerTest, TooSmall) { |
| 512 // clang-format off | 510 // clang-format off |
| 513 ShouldFailMentioning("too small", CryptoTestUtils::Message( | 511 ShouldFailMentioning("too small", CryptoTestUtils::Message( |
| (...skipping 343 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 857 string chlo_hash; | 855 string chlo_hash; |
| 858 CryptoUtils::HashHandshakeMessage(msg, &chlo_hash); | 856 CryptoUtils::HashHandshakeMessage(msg, &chlo_hash); |
| 859 EXPECT_EQ(QUIC_SUCCESS, | 857 EXPECT_EQ(QUIC_SUCCESS, |
| 860 proof_verifier->VerifyProof( | 858 proof_verifier->VerifyProof( |
| 861 "test.example.com", 443, scfg_str.as_string(), client_version_, | 859 "test.example.com", 443, scfg_str.as_string(), client_version_, |
| 862 chlo_hash, certs, "", proof.as_string(), verify_context.get(), | 860 chlo_hash, certs, "", proof.as_string(), verify_context.get(), |
| 863 &error_details, &details, std::move(callback))); | 861 &error_details, &details, std::move(callback))); |
| 864 } | 862 } |
| 865 | 863 |
| 866 TEST_P(CryptoServerTest, RejectInvalidXlct) { | 864 TEST_P(CryptoServerTest, RejectInvalidXlct) { |
| 867 if (client_version_ <= QUIC_VERSION_25) { | |
| 868 // XLCT tag introduced in QUIC_VERSION_26. | |
| 869 return; | |
| 870 } | |
| 871 // clang-format off | 865 // clang-format off |
| 872 CryptoHandshakeMessage msg = CryptoTestUtils::Message( | 866 CryptoHandshakeMessage msg = CryptoTestUtils::Message( |
| 873 "CHLO", | 867 "CHLO", |
| 874 "PDMD", "X509", | 868 "PDMD", "X509", |
| 875 "AEAD", "AESG", | 869 "AEAD", "AESG", |
| 876 "KEXS", "C255", | 870 "KEXS", "C255", |
| 877 "SCID", scid_hex_.c_str(), | 871 "SCID", scid_hex_.c_str(), |
| 878 "#004b5453", srct_hex_.c_str(), | 872 "#004b5453", srct_hex_.c_str(), |
| 879 "PUBS", pub_hex_.c_str(), | 873 "PUBS", pub_hex_.c_str(), |
| 880 "NONC", nonce_hex_.c_str(), | 874 "NONC", nonce_hex_.c_str(), |
| (...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 917 // If replay protection isn't disabled, then | 911 // If replay protection isn't disabled, then |
| 918 // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false | 912 // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false |
| 919 // and cause ProcessClientHello to exit early (and generate a REJ message). | 913 // and cause ProcessClientHello to exit early (and generate a REJ message). |
| 920 config_.set_replay_protection(false); | 914 config_.set_replay_protection(false); |
| 921 | 915 |
| 922 ShouldSucceed(msg); | 916 ShouldSucceed(msg); |
| 923 EXPECT_EQ(kSHLO, out_.tag()); | 917 EXPECT_EQ(kSHLO, out_.tag()); |
| 924 } | 918 } |
| 925 | 919 |
| 926 TEST_P(CryptoServerTest, NonceInSHLO) { | 920 TEST_P(CryptoServerTest, NonceInSHLO) { |
| 927 // After QUIC_VERSION_27, the SHLO should contain a nonce. | |
| 928 // clang-format off | 921 // clang-format off |
| 929 CryptoHandshakeMessage msg = CryptoTestUtils::Message( | 922 CryptoHandshakeMessage msg = CryptoTestUtils::Message( |
| 930 "CHLO", | 923 "CHLO", |
| 931 "PDMD", "X509", | 924 "PDMD", "X509", |
| 932 "AEAD", "AESG", | 925 "AEAD", "AESG", |
| 933 "KEXS", "C255", | 926 "KEXS", "C255", |
| 934 "SCID", scid_hex_.c_str(), | 927 "SCID", scid_hex_.c_str(), |
| 935 "#004b5453", srct_hex_.c_str(), | 928 "#004b5453", srct_hex_.c_str(), |
| 936 "PUBS", pub_hex_.c_str(), | 929 "PUBS", pub_hex_.c_str(), |
| 937 "NONC", nonce_hex_.c_str(), | 930 "NONC", nonce_hex_.c_str(), |
| 938 "VER\0", client_version_string_.c_str(), | 931 "VER\0", client_version_string_.c_str(), |
| 939 "XLCT", XlctHexString().c_str(), | 932 "XLCT", XlctHexString().c_str(), |
| 940 "$padding", static_cast<int>(kClientHelloMinimumSize), | 933 "$padding", static_cast<int>(kClientHelloMinimumSize), |
| 941 nullptr); | 934 nullptr); |
| 942 // clang-format on | 935 // clang-format on |
| 943 // If replay protection isn't disabled, then | 936 // If replay protection isn't disabled, then |
| 944 // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false | 937 // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false |
| 945 // and cause ProcessClientHello to exit early (and generate a REJ message). | 938 // and cause ProcessClientHello to exit early (and generate a REJ message). |
| 946 config_.set_replay_protection(false); | 939 config_.set_replay_protection(false); |
| 947 | 940 |
| 948 ShouldSucceed(msg); | 941 ShouldSucceed(msg); |
| 949 EXPECT_EQ(kSHLO, out_.tag()); | 942 EXPECT_EQ(kSHLO, out_.tag()); |
| 950 | 943 |
| 951 StringPiece nonce; | 944 StringPiece nonce; |
| 952 if (client_version_ <= QUIC_VERSION_26) { | 945 EXPECT_TRUE(out_.GetStringPiece(kServerNonceTag, &nonce)); |
| 953 EXPECT_FALSE(out_.GetStringPiece(kServerNonceTag, &nonce)); | |
| 954 } else { | |
| 955 EXPECT_TRUE(out_.GetStringPiece(kServerNonceTag, &nonce)); | |
| 956 } | |
| 957 } | 946 } |
| 958 | 947 |
| 959 TEST(CryptoServerConfigGenerationTest, Determinism) { | 948 TEST(CryptoServerConfigGenerationTest, Determinism) { |
| 960 // Test that using a deterministic PRNG causes the server-config to be | 949 // Test that using a deterministic PRNG causes the server-config to be |
| 961 // deterministic. | 950 // deterministic. |
| 962 | 951 |
| 963 MockRandom rand_a, rand_b; | 952 MockRandom rand_a, rand_b; |
| 964 const QuicCryptoServerConfig::ConfigOptions options; | 953 const QuicCryptoServerConfig::ConfigOptions options; |
| 965 MockClock clock; | 954 MockClock clock; |
| 966 | 955 |
| (...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1180 | 1169 |
| 1181 strike_register_client_->RunPendingVerifications(); | 1170 strike_register_client_->RunPendingVerifications(); |
| 1182 ASSERT_TRUE(called); | 1171 ASSERT_TRUE(called); |
| 1183 EXPECT_EQ(0, strike_register_client_->PendingVerifications()); | 1172 EXPECT_EQ(0, strike_register_client_->PendingVerifications()); |
| 1184 // The message should be rejected now. | 1173 // The message should be rejected now. |
| 1185 CheckRejectTag(); | 1174 CheckRejectTag(); |
| 1186 } | 1175 } |
| 1187 | 1176 |
| 1188 } // namespace test | 1177 } // namespace test |
| 1189 } // namespace net | 1178 } // namespace net |
| OLD | NEW |