net: disable SSLv3.

net/url_request/url_request_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <shlobj.h>
 #endif
@@ skipping 7062 matching lines @@
  public:
   TestSSLConfigService(bool ev_enabled,
                        bool online_rev_checking,
                        bool rev_checking_required_local_anchors)
       : ev_enabled_(ev_enabled),
         online_rev_checking_(online_rev_checking),
         rev_checking_required_local_anchors_(
             rev_checking_required_local_anchors),
         fallback_min_version_(0) {}
 
+  void set_min_version(uint16 version) {
+    min_version_ = version;
+  }
+
   void set_fallback_min_version(uint16 version) {
     fallback_min_version_ = version;
   }
 
   // SSLConfigService:
   void GetSSLConfig(SSLConfig* config) override {
     *config = SSLConfig();
     config->rev_checking_enabled = online_rev_checking_;
     config->verify_ev_cert = ev_enabled_;
     config->rev_checking_required_local_anchors =
         rev_checking_required_local_anchors_;
     if (fallback_min_version_) {
       config->version_fallback_min = fallback_min_version_;
     }
+    if (min_version_) {
+      config->version_min = min_version_;
+    }
   }
 
  protected:
   ~TestSSLConfigService() override {}
 
  private:
   const bool ev_enabled_;
   const bool online_rev_checking_;
   const bool rev_checking_required_local_anchors_;
+  uint16 min_version_;
   uint16 fallback_min_version_;
 };
 
 class FallbackTestURLRequestContext : public TestURLRequestContext {
  public:
   explicit FallbackTestURLRequestContext(bool delay_initialization)
       : TestURLRequestContext(delay_initialization) {}
 
   void set_fallback_min_version(uint16 version) {
     TestSSLConfigService *ssl_config_service =
         new TestSSLConfigService(true /* check for EV */,
                                  false /* online revocation checking */,
                                  false /* require rev. checking for local
                                           anchors */);
+    ssl_config_service->set_min_version(SSL_PROTOCOL_VERSION_SSL3);
     ssl_config_service->set_fallback_min_version(version);
     set_ssl_config_service(ssl_config_service);
   }
 };
 
 class HTTPSFallbackTest : public testing::Test {
  public:
   HTTPSFallbackTest() : context_(true) {}
   ~HTTPSFallbackTest() override {}
 
@@ skipping 115 matching lines @@
 }
 
 // Tests that the SSLv3 fallback doesn't happen by default.
 TEST_F(HTTPSFallbackTest, SSLv3Fallback) {
   SpawnedTestServer::SSLOptions ssl_options(
       SpawnedTestServer::SSLOptions::CERT_OK);
   ssl_options.tls_intolerant =
       SpawnedTestServer::SSLOptions::TLS_INTOLERANT_ALL;
 
   ASSERT_NO_FATAL_FAILURE(DoFallbackTest(ssl_options));
-  ExpectFailure(ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION);
+  ExpectFailure(ERR_SSL_VERSION_OR_CIPHER_MISMATCH);
 }
 
 // Tests that the SSLv3 fallback works when explicitly enabled.
 TEST_F(HTTPSFallbackTest, SSLv3FallbackEnabled) {
   SpawnedTestServer::SSLOptions ssl_options(
       SpawnedTestServer::SSLOptions::CERT_OK);
   ssl_options.tls_intolerant =
       SpawnedTestServer::SSLOptions::TLS_INTOLERANT_ALL;
   set_fallback_min_version(SSL_PROTOCOL_VERSION_SSL3);
 
@@ skipping 34 matching lines @@
 
   SSLClientSocket::ClearSessionCache();
 
   // Make a connection that does a probe fallback to SSLv3 but fails because
   // SSLv3 fallback is disabled. We don't wish a session for this connection to
   // be inserted locally.
   {
     TestDelegate delegate;
     FallbackTestURLRequestContext context(true);
 
+    context.set_fallback_min_version(SSL_PROTOCOL_VERSION_TLS1);

[davidben, 2014/10/29 00:32:05]

To make sure I'm not missing something, this is just to be explicit about it,
right? I.e. the test still passes with the current defaults.

[agl, 2014/10/29 01:01:18]

This triggers a TestSSLConfigService which sets the minimum version to be SSLv3.

[davidben, 2014/10/29 19:19:33]

Acknowledged.

     context.Init();
     scoped_ptr<URLRequest> request(context.CreateRequest(
         test_server.GetURL(std::string()), DEFAULT_PRIORITY, &delegate, NULL));
     request->Start();
 
     base::RunLoop().Run();
 
     EXPECT_EQ(1, delegate.response_started_count());
     EXPECT_FALSE(request->status().is_success());
     EXPECT_EQ(URLRequestStatus::FAILED, request->status().status());
@@ skipping 956 matching lines @@
 
     EXPECT_FALSE(r->is_pending());
     EXPECT_EQ(1, d->response_started_count());
     EXPECT_FALSE(d->received_data_before_response());
     EXPECT_EQ(d->bytes_received(), static_cast<int>(file_size));
   }
 }
 #endif  // !defined(DISABLE_FTP_SUPPORT)
 
 }  // namespace net