Landing Recent QUIC changes until Mon Nov 14 04:43:50 2016 +0000

net/quic/core/crypto/crypto_server_test.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <cstdint>
 #include <memory>
 #include <ostream>
 #include <vector>
 
@@ skipping 94 matching lines @@
  public:
   CryptoServerTest()
       : rand_(QuicRandom::GetInstance()),
         client_address_(Loopback4(), 1234),
         config_(QuicCryptoServerConfig::TESTING,
                 rand_,
                 CryptoTestUtils::ProofSourceForTesting()),
         compressed_certs_cache_(
             QuicCompressedCertsCache::kQuicCompressedCertsCacheSize),
         params_(new QuicCryptoNegotiatedParameters),
-        crypto_proof_(new QuicCryptoProof),
+        signed_config_(new QuicSignedServerConfig),
         chlo_packet_size_(kDefaultMaxPacketSize) {
     supported_versions_ = GetParam().supported_versions;
     config_.set_enable_serving_sct(true);
 
     client_version_ = supported_versions_.front();
     client_version_string_ =
-        QuicUtils::TagToString(QuicVersionToQuicTag(client_version_));
+        QuicTagToString(QuicVersionToQuicTag(client_version_));
 
     FLAGS_quic_require_handshake_confirmation_pre33 = false;
     FLAGS_enable_quic_stateless_reject_support =
         GetParam().enable_stateless_rejects;
     use_stateless_rejects_ = GetParam().use_stateless_rejects;
   }
 
   void SetUp() override {
     QuicCryptoServerConfig::ConfigOptions old_config_options;
     old_config_options.id = kOldConfigId;
@@ skipping 43 matching lines @@
     srct_hex_ = "#" + QuicUtils::HexEncode(srct);
 
     StringPiece scfg;
     ASSERT_TRUE(out_.GetStringPiece(kSCFG, &scfg));
     server_config_.reset(CryptoFramer::ParseMessage(scfg));
 
     StringPiece scid;
     ASSERT_TRUE(server_config_->GetStringPiece(kSCID, &scid));
     scid_hex_ = "#" + QuicUtils::HexEncode(scid);
 
-    crypto_proof_ = scoped_refptr<QuicCryptoProof>(new QuicCryptoProof());
-    DCHECK(crypto_proof_->chain.get() == nullptr);
+    signed_config_ =
+        scoped_refptr<QuicSignedServerConfig>(new QuicSignedServerConfig());
+    DCHECK(signed_config_->chain.get() == nullptr);
   }
 
   // Helper used to accept the result of ValidateClientHello and pass
   // it on to ProcessClientHello.
   class ValidateCallback : public ValidateClientHelloResultCallback {
    public:
     ValidateCallback(CryptoServerTest* test,
                      bool should_succeed,
                      const char* error_substr,
                      bool* called)
         : test_(test),
           should_succeed_(should_succeed),
           error_substr_(error_substr),
           called_(called) {
       *called_ = false;
     }
 
     void Run(scoped_refptr<Result> result,
              std::unique_ptr<ProofSource::Details> /* details */) override {
-      {
-        // Ensure that the strike register client lock is not held.
-        QuicCryptoServerConfigPeer peer(&test_->config_);
-        base::Lock* m = peer.GetStrikeRegisterClientLock();
-        // In Chromium, we will dead lock if the lock is held by the current
-        // thread. Chromium doesn't have AssertNotHeld API call.
-        // m->AssertNotHeld();
-        base::AutoLock lock(*m);
-      }
       ASSERT_FALSE(*called_);
       test_->ProcessValidationResult(std::move(result), should_succeed_,
                                      error_substr_);
       *called_ = true;
     }
 
    private:
     CryptoServerTest* test_;
     const bool should_succeed_;
     const char* const error_substr_;
@@ skipping 15 matching lines @@
     ASSERT_TRUE(decoder.Decode(address.data(), address.size()));
     EXPECT_EQ(client_address_.address(), decoder.ip());
     EXPECT_EQ(client_address_.port(), decoder.port());
   }
 
   void ShouldSucceed(const CryptoHandshakeMessage& message) {
     bool called = false;
     IPAddress server_ip;
     config_.ValidateClientHello(
         message, client_address_.address(), server_ip,
-        supported_versions_.front(), &clock_, crypto_proof_,
+        supported_versions_.front(), &clock_, signed_config_,
         std::unique_ptr<ValidateCallback>(
             new ValidateCallback(this, true, "", &called)));
     EXPECT_TRUE(called);
   }
 
   void ShouldFailMentioning(const char* error_substr,
                             const CryptoHandshakeMessage& message) {
     bool called = false;
     ShouldFailMentioning(error_substr, message, &called);
     EXPECT_TRUE(called);
   }
 
   void ShouldFailMentioning(const char* error_substr,
                             const CryptoHandshakeMessage& message,
                             bool* called) {
     IPAddress server_ip;
     config_.ValidateClientHello(
         message, client_address_.address(), server_ip,
-        supported_versions_.front(), &clock_, crypto_proof_,
+        supported_versions_.front(), &clock_, signed_config_,
         std::unique_ptr<ValidateCallback>(
             new ValidateCallback(this, false, error_substr, called)));
   }
 
   class ProcessCallback : public ProcessClientHelloResultCallback {
    public:
     ProcessCallback(scoped_refptr<ValidateCallback::Result> result,
                     bool should_succeed,
                     const char* error_substr,
                     bool* called,
@@ skipping 41 matching lines @@
                                bool should_succeed,
                                const char* error_substr) {
     IPAddress server_ip;
     QuicConnectionId server_designated_connection_id =
         rand_for_id_generation_.RandUint64();
     bool called;
     config_.ProcessClientHello(
         result, /*reject_only=*/false, /*connection_id=*/1, server_ip,
         client_address_, supported_versions_.front(), supported_versions_,
         use_stateless_rejects_, server_designated_connection_id, &clock_, rand_,
-        &compressed_certs_cache_, params_, crypto_proof_,
+        &compressed_certs_cache_, params_, signed_config_,
         /*total_framing_overhead=*/50, chlo_packet_size_,
         std::unique_ptr<ProcessCallback>(new ProcessCallback(
             result, should_succeed, error_substr, &called, &out_)));
     EXPECT_TRUE(called);
   }
 
   string GenerateNonce() {
     string nonce;
     CryptoUtils::GenerateNonce(
         clock_.WallNow(), rand_,
@@ skipping 30 matching lines @@
       ASSERT_EQ(QUIC_NO_ERROR,
                 out_.GetUint64(kRCID, &server_designated_connection_id));
       EXPECT_EQ(rand_for_id_generation_.RandUint64(),
                 server_designated_connection_id);
     }
     rand_for_id_generation_.ChangeValue();
   }
 
   void CheckRejectTag() {
     if (RejectsAreStateless()) {
-      ASSERT_EQ(kSREJ, out_.tag()) << QuicUtils::TagToString(out_.tag());
+      ASSERT_EQ(kSREJ, out_.tag()) << QuicTagToString(out_.tag());
     } else {
-      ASSERT_EQ(kREJ, out_.tag()) << QuicUtils::TagToString(out_.tag());
+      ASSERT_EQ(kREJ, out_.tag()) << QuicTagToString(out_.tag());
     }
   }
 
   bool RejectsAreStateless() {
     return GetParam().enable_stateless_rejects &&
            GetParam().use_stateless_rejects;
   }
 
   string XlctHexString() {
     uint64_t xlct = CryptoTestUtils::LeafCertHashForTesting();
     return "#" +
            QuicUtils::HexEncode(reinterpret_cast<char*>(&xlct), sizeof(xlct));
   }
 
  protected:
   QuicFlagSaver flags_;  // Save/restore all QUIC flag values.
   QuicRandom* const rand_;
   MockRandom rand_for_id_generation_;
   MockClock clock_;
   IPEndPoint client_address_;
   QuicVersionVector supported_versions_;
   QuicVersion client_version_;
   string client_version_string_;
   QuicCryptoServerConfig config_;
   QuicCompressedCertsCache compressed_certs_cache_;
   QuicCryptoServerConfig::ConfigOptions config_options_;
   scoped_refptr<QuicCryptoNegotiatedParameters> params_;
-  scoped_refptr<QuicCryptoProof> crypto_proof_;
+  scoped_refptr<QuicSignedServerConfig> signed_config_;
   CryptoHandshakeMessage out_;
   uint8_t orbit_[kOrbitSize];
   bool use_stateless_rejects_;
   size_t chlo_packet_size_;
 
   // These strings contain hex escaped values from the server suitable for using
   // when constructing client hello messages.
   string nonce_hex_, pub_hex_, srct_hex_, scid_hex_;
   std::unique_ptr<CryptoHandshakeMessage> server_config_;
 };
@@ skipping 286 matching lines @@
 }
 
 TEST_P(CryptoServerTest, DowngradeAttack) {
   if (supported_versions_.size() == 1) {
     // No downgrade attack is possible if the server only supports one version.
     return;
   }
   // Set the client's preferred version to a supported version that
   // is not the "current" version (supported_versions_.front()).
   string bad_version =
-      QuicUtils::TagToString(QuicVersionToQuicTag(supported_versions_.back()));
+      QuicTagToString(QuicVersionToQuicTag(supported_versions_.back()));
 
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
       "PDMD", "X509",
       "VER\0", bad_version.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldFailMentioning("Downgrade", msg);
@@ skipping 88 matching lines @@
       "NONP", (string(1, 'X') + nonce_hex_).c_str(),
       "SNO\0", (string(1, 'X') + nonce_hex_).c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
   ShouldSucceed(msg);
   CheckRejectTag();
 
-  if (client_version_ <= QUIC_VERSION_32) {
-    const HandshakeFailureReason kRejectReasons[] = {
-        SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE, CLIENT_NONCE_INVALID_FAILURE,
-        SERVER_NONCE_DECRYPTION_FAILURE};
-    CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
-  } else {
-    const HandshakeFailureReason kRejectReasons[] = {
-        SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE, CLIENT_NONCE_INVALID_FAILURE};
-    CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
-  };
+  const HandshakeFailureReason kRejectReasons[] = {
+      SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE, CLIENT_NONCE_INVALID_FAILURE};
+  CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 TEST_P(CryptoServerTest, NoServerNonce) {
   // When no server nonce is present and no strike register is configured,
   // the CHLO should be rejected.
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
       "PDMD", "X509",
       "AEAD", "AESG",
       "KEXS", "C255",
       "SCID", scid_hex_.c_str(),
       "#004b5453", srct_hex_.c_str(),
       "PUBS", pub_hex_.c_str(),
       "NONC", nonce_hex_.c_str(),
       "NONP", nonce_hex_.c_str(),
       "XLCT", XlctHexString().c_str(),
       "VER\0", client_version_string_.c_str(),
       "$padding", static_cast<int>(kClientHelloMinimumSize),
       nullptr);
   // clang-format on
 
   ShouldSucceed(msg);
 
-  if (client_version_ <= QUIC_VERSION_32) {
-    CheckRejectTag();
-    const HandshakeFailureReason kRejectReasons[] = {
-        SERVER_NONCE_REQUIRED_FAILURE};
-    CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
-  } else {
-    // Even without a server nonce, this ClientHello should be accepted in
-    // version 33.
-    ASSERT_EQ(kSHLO, out_.tag());
-    CheckServerHello(out_);
-  }
+  // Even without a server nonce, this ClientHello should be accepted in
+  // version 33.
+  ASSERT_EQ(kSHLO, out_.tag());
+  CheckServerHello(out_);
 }
 
 TEST_P(CryptoServerTest, ProofForSuppliedServerConfig) {
   client_address_ = IPEndPoint(Loopback6(), 1234);
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
       "AEAD", "AESG",
       "KEXS", "C255",
       "PDMD", "X509",
@@ skipping 229 matching lines @@
   const HandshakeFailureReason kRejectReasons[] = {
       SERVER_CONFIG_INCHOATE_HELLO_FAILURE};
   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
 }
 
 class CryptoServerTestOldVersion : public CryptoServerTest {
  public:
   void SetUp() override {
     client_version_ = supported_versions_.back();
     client_version_string_ =
-        QuicUtils::TagToString(QuicVersionToQuicTag(client_version_));
+        QuicTagToString(QuicVersionToQuicTag(client_version_));
     CryptoServerTest::SetUp();
   }
 };
 
 TEST_P(CryptoServerTestOldVersion, ServerIgnoresXlct) {
   // clang-format off
   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
       "CHLO",
       "PDMD", "X509",
       "AEAD", "AESG",
@@ skipping 33 matching lines @@
   // clang-format on
   // If replay protection isn't disabled, then
   // QuicCryptoServerConfig::EvaluateClientHello will leave info.unique as false
   // and cause ProcessClientHello to exit early (and generate a REJ message).
   config_.set_replay_protection(false);
 
   ShouldSucceed(msg);
   EXPECT_EQ(kSHLO, out_.tag());
 }
 
-class AsyncStrikeServerVerificationTest : public CryptoServerTest {
- protected:
-  AsyncStrikeServerVerificationTest() {}
-
-  void SetUp() override {
-    const string kOrbit = "12345678";
-    config_options_.orbit = kOrbit;
-    strike_register_client_ = new DelayedVerifyStrikeRegisterClient(
-        10000,  // strike_register_max_entries
-        static_cast<uint32_t>(clock_.WallNow().ToUNIXSeconds()),
-        60,  // strike_register_window_secs
-        reinterpret_cast<const uint8_t*>(kOrbit.c_str()),
-        StrikeRegister::NO_STARTUP_PERIOD_NEEDED);
-    config_.SetStrikeRegisterClient(strike_register_client_);
-    ASSERT_NO_FATAL_FAILURE(CryptoServerTest::SetUp());
-    strike_register_client_->StartDelayingVerification();
-  }
-
-  DelayedVerifyStrikeRegisterClient* strike_register_client_;
-};
-
-TEST_P(AsyncStrikeServerVerificationTest, AsyncReplayProtection) {
-  // This tests async validation with a strike register works.
-  // clang-format off
-  CryptoHandshakeMessage msg = CryptoTestUtils::Message(
-      "CHLO",
-      "PDMD", "X509",
-      "AEAD", "AESG",
-      "KEXS", "C255",
-      "SCID", scid_hex_.c_str(),
-      "#004b5453", srct_hex_.c_str(),
-      "PUBS", pub_hex_.c_str(),
-      "NONC", nonce_hex_.c_str(),
-      "VER\0", client_version_string_.c_str(),
-      "$padding", static_cast<int>(kClientHelloMinimumSize),
-      nullptr);
-  // clang-format on
-
-  // Clear the message tag.
-  out_.set_tag(0);
-
-  bool called = false;
-  IPAddress server_ip;
-  config_.ValidateClientHello(
-      msg, client_address_.address(), server_ip, client_version_, &clock_,
-      crypto_proof_, std::unique_ptr<ValidateCallback>(
-                         new ValidateCallback(this, true, "", &called)));
-  // The verification request was queued.
-  ASSERT_FALSE(called);
-  EXPECT_EQ(0u, out_.tag());
-  EXPECT_EQ(1, strike_register_client_->PendingVerifications());
-
-  // Continue processing the verification request.
-  strike_register_client_->RunPendingVerifications();
-  ASSERT_TRUE(called);
-  EXPECT_EQ(0, strike_register_client_->PendingVerifications());
-  // The message should be accepted now.
-  EXPECT_EQ(kSHLO, out_.tag());
-
-  // Rejected if replayed.
-  config_.ValidateClientHello(
-      msg, client_address_.address(), server_ip, client_version_, &clock_,
-      crypto_proof_, std::unique_ptr<ValidateCallback>(
-                         new ValidateCallback(this, true, "", &called)));
-  // The verification request was queued.
-  ASSERT_FALSE(called);
-  EXPECT_EQ(1, strike_register_client_->PendingVerifications());
-
-  strike_register_client_->RunPendingVerifications();
-  ASSERT_TRUE(called);
-  EXPECT_EQ(0, strike_register_client_->PendingVerifications());
-  // The message should be rejected now.
-  CheckRejectTag();
-}
-
-TEST_P(AsyncStrikeServerVerificationTest, RequireHandshakeCofirmationPre33) {
-  FLAGS_quic_require_handshake_confirmation = false;
-  FLAGS_quic_require_handshake_confirmation_pre33 = true;
-  // clang-format off
-  CryptoHandshakeMessage msg = CryptoTestUtils::Message(
-      "CHLO",
-      "PDMD", "X509",
-      "AEAD", "AESG",
-      "KEXS", "C255",
-      "SNI", "foobar1.example.com",
-      "SCID", scid_hex_.c_str(),
-      "#004b5453", srct_hex_.c_str(),
-      "PUBS", pub_hex_.c_str(),
-      "NONC", nonce_hex_.c_str(),
-      "VER\0", client_version_string_.c_str(),
-      "XLCT", XlctHexString().c_str(),
-      "$padding", static_cast<int>(kClientHelloMinimumSize),
-      nullptr);
-  // clang-format on
-
-  ShouldSucceed(msg);
-
-  if (client_version_ <= QUIC_VERSION_32) {
-    // clang-format off
-    const HandshakeFailureReason kRejectReasons[] = {
-      SERVER_NONCE_REQUIRED_FAILURE
-    };
-    // clang-format on
-    CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
-    EXPECT_EQ(0, strike_register_client_->PendingVerifications());
-  } else {
-    // version 33.
-    ASSERT_EQ(kSHLO, out_.tag());
-    CheckServerHello(out_);
-  }
-}
-
 }  // namespace test
 }  // namespace net