net: don't allow SSLv3 fallback for Google properties.

net/http/http_network_transaction_ssl_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/scoped_vector.h"
 #include "net/base/net_util.h"
@@ skipping 114 matching lines @@
   SSLSocketDataProvider ssl_data2(ASYNC, ERR_SSL_PROTOCOL_ERROR);
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data2);
   StaticSocketDataProvider data2(NULL, 0, NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data2);
 
   scoped_refptr<HttpNetworkSession> session(
       new HttpNetworkSession(session_params_));
   scoped_ptr<HttpNetworkTransaction> trans(
       new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
 
-  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
-  ssl_config.unrestricted_ssl3_fallback_enabled = false;
-
   TestCompletionCallback callback;
   // This will consume only |ssl_data1|. |ssl_data2| will not be consumed.
   int rv = callback.GetResult(
       trans->Start(GetRequestInfo("https://www.google.com/"),
                    callback.callback(), BoundNetLog()));
   EXPECT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
 
   SocketDataProviderArray<SocketDataProvider>& mock_data =
       mock_socket_factory_.mock_data();
   // Confirms that only |ssl_data1| is consumed.
   EXPECT_EQ(1u, mock_data.next_index());
 
+  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
   // |version_max| never fallbacks to SSLv3 for Google properties.
   EXPECT_EQ(SSL_PROTOCOL_VERSION_TLS1, ssl_config.version_max);
   EXPECT_FALSE(ssl_config.version_fallback);
 }
 
 // Tests that HttpNetworkTransaction attempts to fallback to SSL 3.0
 // when a TLS 1.0 handshake fails and:
 // * the site is pinned to the Google pin list (indicating that
 //   it is a Google site);
 // * unrestricted SSL 3.0 fallback is enabled.
@@ skipping 58 matching lines @@
   SSLSocketDataProvider ssl_data2(ASYNC, ERR_SSL_PROTOCOL_ERROR);
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data2);
   StaticSocketDataProvider data2(NULL, 0, NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data2);
 
   scoped_refptr<HttpNetworkSession> session(
       new HttpNetworkSession(session_params_));
   scoped_ptr<HttpNetworkTransaction> trans(
       new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
 
-  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
-  ssl_config.unrestricted_ssl3_fallback_enabled = false;
-
   TestCompletionCallback callback;
   // This will consume |ssl_data1| and |ssl_data2|.
   int rv = callback.GetResult(
       trans->Start(GetRequestInfo("https://www.paypal.com/"),
                    callback.callback(), BoundNetLog()));
   EXPECT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
 
   SocketDataProviderArray<SocketDataProvider>& mock_data =
       mock_socket_factory_.mock_data();
   // Confirms that both |ssl_data1| and |ssl_data2| are consumed.
   EXPECT_EQ(2u, mock_data.next_index());
 
+  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
   // |version_max| fallbacks to SSL 3.0.
   EXPECT_EQ(SSL_PROTOCOL_VERSION_SSL3, ssl_config.version_max);
   EXPECT_TRUE(ssl_config.version_fallback);
 }
 
 // Tests that HttpNetworkTransaction attempts to fallback from
 // TLS 1.1 to TLS 1.0, then from TLS 1.0 to SSL 3.0.
 TEST_F(HttpNetworkTransactionSSLTest, SSLFallback) {
   ssl_config_service_ = new TLS11SSLConfigService;
   session_params_.ssl_config_service = ssl_config_service_.get();
@@ skipping 18 matching lines @@
   SSLSocketDataProvider ssl_data3(ASYNC, ERR_SSL_PROTOCOL_ERROR);
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data3);
   StaticSocketDataProvider data3(NULL, 0, NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data3);
 
   scoped_refptr<HttpNetworkSession> session(
       new HttpNetworkSession(session_params_));
   scoped_ptr<HttpNetworkTransaction> trans(
       new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
 
-  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
-  ssl_config.unrestricted_ssl3_fallback_enabled = true;
-
   TestCompletionCallback callback;
   // This will consume |ssl_data1|, |ssl_data2| and |ssl_data3|.
   int rv = callback.GetResult(
       trans->Start(GetRequestInfo("https://www.paypal.com/"),
                    callback.callback(), BoundNetLog()));
   EXPECT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
 
   SocketDataProviderArray<SocketDataProvider>& mock_data =
       mock_socket_factory_.mock_data();
   // Confirms that |ssl_data1|, |ssl_data2| and |ssl_data3| are consumed.
   EXPECT_EQ(3u, mock_data.next_index());
 
+  SSLConfig& ssl_config = GetServerSSLConfig(trans.get());
   // |version_max| fallbacks to SSL 3.0.
   EXPECT_EQ(SSL_PROTOCOL_VERSION_SSL3, ssl_config.version_max);
   EXPECT_TRUE(ssl_config.version_fallback);
 }
 
 }  // namespace net