Home | History | Annotate | Download | only in crypto 
      1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include <ostream>
      6 #include <vector>
      7 
      8 #include "base/basictypes.h"
      9 #include "base/strings/string_number_conversions.h"
     10 #include "crypto/secure_hash.h"
     11 #include "net/quic/crypto/crypto_utils.h"
     12 #include "net/quic/crypto/quic_crypto_server_config.h"
     13 #include "net/quic/crypto/quic_random.h"
     14 #include "net/quic/quic_flags.h"
     15 #include "net/quic/quic_socket_address_coder.h"
     16 #include "net/quic/quic_utils.h"
     17 #include "net/quic/test_tools/crypto_test_utils.h"
     18 #include "net/quic/test_tools/delayed_verify_strike_register_client.h"
     19 #include "net/quic/test_tools/mock_clock.h"
     20 #include "net/quic/test_tools/mock_random.h"
     21 #include "net/quic/test_tools/quic_test_utils.h"
     22 #include "testing/gtest/include/gtest/gtest.h"
     23 
     24 using base::StringPiece;
     25 using std::ostream;
     26 using std::string;
     27 using std::vector;
     28 
     29 namespace net {
     30 namespace test {
     31 
     32 class QuicCryptoServerConfigPeer {
     33  public:
     34   explicit QuicCryptoServerConfigPeer(QuicCryptoServerConfig* server_config)
     35       : server_config_(server_config) {}
     36 
     37   base::Lock* GetStrikeRegisterClientLock() {
     38     return &server_config_->strike_register_client_lock_;
     39   }
     40 
     41  private:
     42   QuicCryptoServerConfig* server_config_;
     43 };
     44 
     45 // Run tests with combinations of
     46 // {FLAGS_use_early_return_when_verifying_chlo,
     47 //  FLAGS_send_quic_crypto_reject_reason}.
     48 struct TestParams {
     49   TestParams(bool use_early_return_when_verifying_chlo,
     50              bool send_quic_crypto_reject_reason)
     51       : use_early_return_when_verifying_chlo(
     52             use_early_return_when_verifying_chlo),
     53         send_quic_crypto_reject_reason(send_quic_crypto_reject_reason) {
     54   }
     55 
     56   friend ostream& operator<<(ostream& os, const TestParams& p) {
     57     os << "{ use_early_return_when_verifying_chlo: "
     58        << p.use_early_return_when_verifying_chlo
     59        << " send_quic_crypto_reject_reason: "
     60        << p.send_quic_crypto_reject_reason << " }";
     61     return os;
     62   }
     63 
     64   bool use_early_return_when_verifying_chlo;
     65   bool send_quic_crypto_reject_reason;
     66 };
     67 
     68 // Constructs various test permutations.
     69 vector<TestParams> GetTestParams() {
     70   vector<TestParams> params;
     71   params.push_back(TestParams(false, false));
     72   params.push_back(TestParams(false, true));
     73   params.push_back(TestParams(true, false));
     74   params.push_back(TestParams(true, true));
     75   return params;
     76 }
     77 
     78 class CryptoServerTest : public ::testing::TestWithParam<TestParams> {
     79  public:
     80   CryptoServerTest()
     81       : rand_(QuicRandom::GetInstance()),
     82         client_address_(Loopback4(), 1234),
     83         config_(QuicCryptoServerConfig::TESTING, rand_) {
     84     config_.SetProofSource(CryptoTestUtils::ProofSourceForTesting());
     85     supported_versions_ = QuicSupportedVersions();
     86     client_version_ = QuicUtils::TagToString(
     87         QuicVersionToQuicTag(supported_versions_.front()));
     88 
     89     FLAGS_use_early_return_when_verifying_chlo =
     90         GetParam().use_early_return_when_verifying_chlo;
     91     FLAGS_send_quic_crypto_reject_reason =
     92         GetParam().send_quic_crypto_reject_reason;
     93   }
     94 
     95   virtual void SetUp() {
     96     scoped_ptr<CryptoHandshakeMessage> msg(
     97         config_.AddDefaultConfig(rand_, &clock_,
     98         config_options_));
     99 
    100     StringPiece orbit;
    101     CHECK(msg->GetStringPiece(kORBT, &orbit));
    102     CHECK_EQ(sizeof(orbit_), orbit.size());
    103     memcpy(orbit_, orbit.data(), orbit.size());
    104 
    105     char public_value[32];
    106     memset(public_value, 42, sizeof(public_value));
    107 
    108     const string nonce_str = GenerateNonce();
    109     nonce_hex_ = "#" + base::HexEncode(nonce_str.data(), nonce_str.size());
    110     pub_hex_ = "#" + base::HexEncode(public_value, sizeof(public_value));
    111 
    112     CryptoHandshakeMessage client_hello = CryptoTestUtils::Message(
    113         "CHLO",
    114         "AEAD", "AESG",
    115         "KEXS", "C255",
    116         "PUBS", pub_hex_.c_str(),
    117         "NONC", nonce_hex_.c_str(),
    118         "VER\0", client_version_.data(),
    119         "$padding", static_cast<int>(kClientHelloMinimumSize),
    120         NULL);
    121     ShouldSucceed(client_hello);
    122     // The message should be rejected because the source-address token is
    123     // missing.
    124     ASSERT_EQ(kREJ, out_.tag());
    125     const HandshakeFailureReason kRejectReasons[] = {
    126       SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    127     };
    128     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    129 
    130     StringPiece srct;
    131     ASSERT_TRUE(out_.GetStringPiece(kSourceAddressTokenTag, &srct));
    132     srct_hex_ = "#" + base::HexEncode(srct.data(), srct.size());
    133 
    134     StringPiece scfg;
    135     ASSERT_TRUE(out_.GetStringPiece(kSCFG, &scfg));
    136     server_config_.reset(CryptoFramer::ParseMessage(scfg));
    137 
    138     StringPiece scid;
    139     ASSERT_TRUE(server_config_->GetStringPiece(kSCID, &scid));
    140     scid_hex_ = "#" + base::HexEncode(scid.data(), scid.size());
    141   }
    142 
    143   // Helper used to accept the result of ValidateClientHello and pass
    144   // it on to ProcessClientHello.
    145   class ValidateCallback : public ValidateClientHelloResultCallback {
    146    public:
    147     ValidateCallback(CryptoServerTest* test,
    148                      bool should_succeed,
    149                      const char* error_substr,
    150                      bool* called)
    151         : test_(test),
    152           should_succeed_(should_succeed),
    153           error_substr_(error_substr),
    154           called_(called) {
    155       *called_ = false;
    156     }
    157 
    158     virtual void RunImpl(const CryptoHandshakeMessage& client_hello,
    159                          const Result& result) OVERRIDE {
    160       {
    161         // Ensure that the strike register client lock is not held.
    162         QuicCryptoServerConfigPeer peer(&test_->config_);
    163         base::Lock* m = peer.GetStrikeRegisterClientLock();
    164         // In Chromium, we will dead lock if the lock is held by the current
    165         // thread. Chromium doesn't have AssertNotHeld API call.
    166         // m->AssertNotHeld();
    167         base::AutoLock lock(*m);
    168       }
    169       ASSERT_FALSE(*called_);
    170       test_->ProcessValidationResult(
    171           client_hello, result, should_succeed_, error_substr_);
    172       *called_ = true;
    173     }
    174 
    175    private:
    176     CryptoServerTest* test_;
    177     bool should_succeed_;
    178     const char* error_substr_;
    179     bool* called_;
    180   };
    181 
    182   void CheckServerHello(const CryptoHandshakeMessage& server_hello) {
    183     const QuicTag* versions;
    184     size_t num_versions;
    185     server_hello.GetTaglist(kVER, &versions, &num_versions);
    186     ASSERT_EQ(QuicSupportedVersions().size(), num_versions);
    187     for (size_t i = 0; i < num_versions; ++i) {
    188       EXPECT_EQ(QuicVersionToQuicTag(QuicSupportedVersions()[i]), versions[i]);
    189     }
    190 
    191     StringPiece address;
    192     ASSERT_TRUE(server_hello.GetStringPiece(kCADR, &address));
    193     QuicSocketAddressCoder decoder;
    194     ASSERT_TRUE(decoder.Decode(address.data(), address.size()));
    195     EXPECT_EQ(client_address_.address(), decoder.ip());
    196     EXPECT_EQ(client_address_.port(), decoder.port());
    197   }
    198 
    199   void ShouldSucceed(const CryptoHandshakeMessage& message) {
    200     bool called = false;
    201     RunValidate(message, new ValidateCallback(this, true, "", &called));
    202     EXPECT_TRUE(called);
    203   }
    204 
    205   void RunValidate(
    206       const CryptoHandshakeMessage& message,
    207       ValidateClientHelloResultCallback* cb) {
    208     config_.ValidateClientHello(message, client_address_, &clock_, cb);
    209   }
    210 
    211   void ShouldFailMentioning(const char* error_substr,
    212                             const CryptoHandshakeMessage& message) {
    213     bool called = false;
    214     ShouldFailMentioning(error_substr, message, &called);
    215     EXPECT_TRUE(called);
    216   }
    217 
    218   void ShouldFailMentioning(const char* error_substr,
    219                             const CryptoHandshakeMessage& message,
    220                             bool* called) {
    221     config_.ValidateClientHello(
    222         message, client_address_, &clock_,
    223         new ValidateCallback(this, false, error_substr, called));
    224   }
    225 
    226   void ProcessValidationResult(const CryptoHandshakeMessage& message,
    227                                const ValidateCallback::Result& result,
    228                                bool should_succeed,
    229                                const char* error_substr) {
    230     string error_details;
    231     QuicErrorCode error = config_.ProcessClientHello(
    232         result, 1 /* ConnectionId */, client_address_,
    233         supported_versions_.front(), supported_versions_, &clock_, rand_,
    234         &params_, &out_, &error_details);
    235 
    236     if (should_succeed) {
    237       ASSERT_EQ(error, QUIC_NO_ERROR)
    238           << "Message failed with error " << error_details << ": "
    239           << message.DebugString();
    240     } else {
    241       ASSERT_NE(error, QUIC_NO_ERROR)
    242           << "Message didn't fail: " << message.DebugString();
    243 
    244       EXPECT_TRUE(error_details.find(error_substr) != string::npos)
    245           << error_substr << " not in " << error_details;
    246     }
    247   }
    248 
    249   CryptoHandshakeMessage InchoateClientHello(const char* message_tag, ...) {
    250     va_list ap;
    251     va_start(ap, message_tag);
    252 
    253     CryptoHandshakeMessage message =
    254         CryptoTestUtils::BuildMessage(message_tag, ap);
    255     va_end(ap);
    256 
    257     message.SetStringPiece(kPAD, string(kClientHelloMinimumSize, '-'));
    258     return message;
    259   }
    260 
    261   string GenerateNonce() {
    262     string nonce;
    263     CryptoUtils::GenerateNonce(
    264         clock_.WallNow(), rand_,
    265         StringPiece(reinterpret_cast<const char*>(orbit_), sizeof(orbit_)),
    266         &nonce);
    267     return nonce;
    268   }
    269 
    270   void CheckRejectReasons(
    271       const HandshakeFailureReason* expected_handshake_failures,
    272       size_t expected_count) {
    273     const uint32* reject_reasons;
    274     size_t num_reject_reasons;
    275     COMPILE_ASSERT(sizeof(QuicTag) == sizeof(uint32), header_out_of_sync);
    276     QuicErrorCode error_code = out_.GetTaglist(kRREJ, &reject_reasons,
    277                                                &num_reject_reasons);
    278     if (!FLAGS_send_quic_crypto_reject_reason) {
    279       ASSERT_EQ(QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND, error_code);
    280       return;
    281     }
    282     ASSERT_EQ(QUIC_NO_ERROR, error_code);
    283 
    284     if (FLAGS_use_early_return_when_verifying_chlo) {
    285       EXPECT_EQ(1u, num_reject_reasons);
    286     } else {
    287       EXPECT_EQ(expected_count, num_reject_reasons);
    288     }
    289     for (size_t i = 0; i < num_reject_reasons; ++i) {
    290       EXPECT_EQ(expected_handshake_failures[i], reject_reasons[i]);
    291     }
    292   }
    293 
    294  protected:
    295   QuicRandom* const rand_;
    296   MockClock clock_;
    297   const IPEndPoint client_address_;
    298   QuicVersionVector supported_versions_;
    299   string client_version_;
    300   QuicCryptoServerConfig config_;
    301   QuicCryptoServerConfig::ConfigOptions config_options_;
    302   QuicCryptoNegotiatedParameters params_;
    303   CryptoHandshakeMessage out_;
    304   uint8 orbit_[kOrbitSize];
    305 
    306   // These strings contain hex escaped values from the server suitable for
    307   // passing to |InchoateClientHello| when constructing client hello messages.
    308   string nonce_hex_, pub_hex_, srct_hex_, scid_hex_;
    309   scoped_ptr<CryptoHandshakeMessage> server_config_;
    310 };
    311 
    312 // Run all CryptoServerTest with all combinations of
    313 // FLAGS_use_early_return_when_verifying_chlo and
    314 // FLAGS_send_quic_crypto_reject_reason.
    315 INSTANTIATE_TEST_CASE_P(CryptoServerTests,
    316                         CryptoServerTest,
    317                         ::testing::ValuesIn(GetTestParams()));
    318 
    319 TEST_P(CryptoServerTest, BadSNI) {
    320   static const char* kBadSNIs[] = {
    321     "",
    322     "foo",
    323     "#00",
    324     "#ff00",
    325     "127.0.0.1",
    326     "ffee::1",
    327   };
    328 
    329   string client_version = QuicUtils::TagToString(
    330       QuicVersionToQuicTag(supported_versions_.front()));
    331 
    332   for (size_t i = 0; i < arraysize(kBadSNIs); i++) {
    333     ShouldFailMentioning("SNI", InchoateClientHello(
    334         "CHLO",
    335         "SNI", kBadSNIs[i],
    336         "VER\0", client_version.data(),
    337         NULL));
    338     const HandshakeFailureReason kRejectReasons[] = {
    339       SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    340     };
    341     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    342   }
    343 }
    344 
    345 // TODO(rtenneti): Enable the DefaultCert test after implementing ProofSource.
    346 TEST_F(CryptoServerTest, DISABLED_DefaultCert) {
    347   // Check that the server replies with a default certificate when no SNI is
    348   // specified.
    349   ShouldSucceed(InchoateClientHello(
    350       "CHLO",
    351       "AEAD", "AESG",
    352       "KEXS", "C255",
    353       "SCID", scid_hex_.c_str(),
    354       "#004b5453", srct_hex_.c_str(),
    355       "PUBS", pub_hex_.c_str(),
    356       "NONC", nonce_hex_.c_str(),
    357       "$padding", static_cast<int>(kClientHelloMinimumSize),
    358       "PDMD", "X509",
    359       "VER\0", client_version_.data(),
    360       NULL));
    361 
    362   StringPiece cert, proof;
    363   EXPECT_TRUE(out_.GetStringPiece(kCertificateTag, &cert));
    364   EXPECT_TRUE(out_.GetStringPiece(kPROF, &proof));
    365   EXPECT_NE(0u, cert.size());
    366   EXPECT_NE(0u, proof.size());
    367   const HandshakeFailureReason kRejectReasons[] = {
    368     CLIENT_NONCE_INVALID_TIME_FAILURE
    369   };
    370   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    371 }
    372 
    373 TEST_P(CryptoServerTest, TooSmall) {
    374   ShouldFailMentioning("too small", CryptoTestUtils::Message(
    375         "CHLO",
    376         "VER\0", client_version_.data(),
    377         NULL));
    378   const HandshakeFailureReason kRejectReasons[] = {
    379     SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    380   };
    381   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    382 }
    383 
    384 TEST_P(CryptoServerTest, BadSourceAddressToken) {
    385   // Invalid source-address tokens should be ignored.
    386   static const char* kBadSourceAddressTokens[] = {
    387     "",
    388     "foo",
    389     "#0000",
    390     "#0000000000000000000000000000000000000000",
    391   };
    392 
    393   for (size_t i = 0; i < arraysize(kBadSourceAddressTokens); i++) {
    394     ShouldSucceed(InchoateClientHello(
    395         "CHLO",
    396         "STK", kBadSourceAddressTokens[i],
    397         "VER\0", client_version_.data(),
    398         NULL));
    399     const HandshakeFailureReason kRejectReasons[] = {
    400       SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    401     };
    402     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    403   }
    404 }
    405 
    406 TEST_P(CryptoServerTest, BadClientNonce) {
    407   // Invalid nonces should be ignored.
    408   static const char* kBadNonces[] = {
    409     "",
    410     "#0000",
    411     "#0000000000000000000000000000000000000000",
    412   };
    413 
    414   for (size_t i = 0; i < arraysize(kBadNonces); i++) {
    415     ShouldSucceed(InchoateClientHello(
    416         "CHLO",
    417         "NONC", kBadNonces[i],
    418         "VER\0", client_version_.data(),
    419         NULL));
    420     const HandshakeFailureReason kRejectReasons[] = {
    421       SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    422     };
    423     CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    424   }
    425 }
    426 
    427 TEST_P(CryptoServerTest, DowngradeAttack) {
    428   if (supported_versions_.size() == 1) {
    429     // No downgrade attack is possible if the server only supports one version.
    430     return;
    431   }
    432   // Set the client's preferred version to a supported version that
    433   // is not the "current" version (supported_versions_.front()).
    434   string bad_version = QuicUtils::TagToString(
    435       QuicVersionToQuicTag(supported_versions_.back()));
    436 
    437   ShouldFailMentioning("Downgrade", InchoateClientHello(
    438       "CHLO",
    439       "VER\0", bad_version.data(),
    440       NULL));
    441   const HandshakeFailureReason kRejectReasons[] = {
    442     SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    443   };
    444   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    445 }
    446 
    447 TEST_P(CryptoServerTest, CorruptServerConfig) {
    448   // This tests corrupted server config.
    449   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    450       "CHLO",
    451       "AEAD", "AESG",
    452       "KEXS", "C255",
    453       "SCID", (string(1, 'X') + scid_hex_).c_str(),
    454       "#004b5453", srct_hex_.c_str(),
    455       "PUBS", pub_hex_.c_str(),
    456       "NONC", nonce_hex_.c_str(),
    457       "VER\0", client_version_.data(),
    458       "$padding", static_cast<int>(kClientHelloMinimumSize),
    459       NULL);
    460   ShouldSucceed(msg);
    461   ASSERT_EQ(kREJ, out_.tag());
    462   const HandshakeFailureReason kRejectReasons[] = {
    463     SERVER_CONFIG_UNKNOWN_CONFIG_FAILURE
    464   };
    465   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    466 }
    467 
    468 TEST_P(CryptoServerTest, CorruptSourceAddressToken) {
    469   // This tests corrupted source address token.
    470   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    471       "CHLO",
    472       "AEAD", "AESG",
    473       "KEXS", "C255",
    474       "SCID", scid_hex_.c_str(),
    475       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
    476       "PUBS", pub_hex_.c_str(),
    477       "NONC", nonce_hex_.c_str(),
    478       "VER\0", client_version_.data(),
    479       "$padding", static_cast<int>(kClientHelloMinimumSize),
    480       NULL);
    481   ShouldSucceed(msg);
    482   ASSERT_EQ(kREJ, out_.tag());
    483   const HandshakeFailureReason kRejectReasons[] = {
    484     SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE
    485   };
    486   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    487 }
    488 
    489 TEST_P(CryptoServerTest, CorruptClientNonceAndSourceAddressToken) {
    490   // This test corrupts client nonce and source address token.
    491   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    492       "CHLO",
    493       "AEAD", "AESG",
    494       "KEXS", "C255",
    495       "SCID", scid_hex_.c_str(),
    496       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
    497       "PUBS", pub_hex_.c_str(),
    498       "NONC", (string(1, 'X') + nonce_hex_).c_str(),
    499       "VER\0", client_version_.data(),
    500       "$padding", static_cast<int>(kClientHelloMinimumSize),
    501       NULL);
    502   ShouldSucceed(msg);
    503   ASSERT_EQ(kREJ, out_.tag());
    504   const HandshakeFailureReason kRejectReasons[] = {
    505     SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE,
    506     CLIENT_NONCE_INVALID_FAILURE
    507   };
    508   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    509 }
    510 
    511 TEST_P(CryptoServerTest, CorruptMultipleTags) {
    512   // This test corrupts client nonce, server nonce and source address token.
    513   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    514       "CHLO",
    515       "AEAD", "AESG",
    516       "KEXS", "C255",
    517       "SCID", scid_hex_.c_str(),
    518       "#004b5453", (string(1, 'X') + srct_hex_).c_str(),
    519       "PUBS", pub_hex_.c_str(),
    520       "NONC", (string(1, 'X') + nonce_hex_).c_str(),
    521       "SNO\0", (string(1, 'X') + nonce_hex_).c_str(),
    522       "VER\0", client_version_.data(),
    523       "$padding", static_cast<int>(kClientHelloMinimumSize),
    524       NULL);
    525   ShouldSucceed(msg);
    526   ASSERT_EQ(kREJ, out_.tag());
    527   const HandshakeFailureReason kRejectReasons[] = {
    528     SOURCE_ADDRESS_TOKEN_DECRYPTION_FAILURE,
    529     CLIENT_NONCE_INVALID_FAILURE,
    530     SERVER_NONCE_DECRYPTION_FAILURE,
    531   };
    532   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    533 }
    534 
    535 TEST_P(CryptoServerTest, ReplayProtection) {
    536   // This tests that disabling replay protection works.
    537   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    538       "CHLO",
    539       "AEAD", "AESG",
    540       "KEXS", "C255",
    541       "SCID", scid_hex_.c_str(),
    542       "#004b5453", srct_hex_.c_str(),
    543       "PUBS", pub_hex_.c_str(),
    544       "NONC", nonce_hex_.c_str(),
    545       "VER\0", client_version_.data(),
    546       "$padding", static_cast<int>(kClientHelloMinimumSize),
    547       NULL);
    548   ShouldSucceed(msg);
    549   // The message should be rejected because the strike-register is still
    550   // quiescent.
    551   ASSERT_EQ(kREJ, out_.tag());
    552 
    553   const HandshakeFailureReason kRejectReasons[] = {
    554     CLIENT_NONCE_INVALID_TIME_FAILURE
    555   };
    556   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    557 
    558   config_.set_replay_protection(false);
    559 
    560   ShouldSucceed(msg);
    561   // The message should be accepted now.
    562   ASSERT_EQ(kSHLO, out_.tag());
    563   CheckServerHello(out_);
    564 
    565   ShouldSucceed(msg);
    566   // The message should accepted twice when replay protection is off.
    567   ASSERT_EQ(kSHLO, out_.tag());
    568   CheckServerHello(out_);
    569 }
    570 
    571 TEST(CryptoServerConfigGenerationTest, Determinism) {
    572   // Test that using a deterministic PRNG causes the server-config to be
    573   // deterministic.
    574 
    575   MockRandom rand_a, rand_b;
    576   const QuicCryptoServerConfig::ConfigOptions options;
    577   MockClock clock;
    578 
    579   QuicCryptoServerConfig a(QuicCryptoServerConfig::TESTING, &rand_a);
    580   QuicCryptoServerConfig b(QuicCryptoServerConfig::TESTING, &rand_b);
    581   scoped_ptr<CryptoHandshakeMessage> scfg_a(
    582       a.AddDefaultConfig(&rand_a, &clock, options));
    583   scoped_ptr<CryptoHandshakeMessage> scfg_b(
    584       b.AddDefaultConfig(&rand_b, &clock, options));
    585 
    586   ASSERT_EQ(scfg_a->DebugString(), scfg_b->DebugString());
    587 }
    588 
    589 TEST(CryptoServerConfigGenerationTest, SCIDVaries) {
    590   // This test ensures that the server config ID varies for different server
    591   // configs.
    592 
    593   MockRandom rand_a, rand_b;
    594   const QuicCryptoServerConfig::ConfigOptions options;
    595   MockClock clock;
    596 
    597   QuicCryptoServerConfig a(QuicCryptoServerConfig::TESTING, &rand_a);
    598   rand_b.ChangeValue();
    599   QuicCryptoServerConfig b(QuicCryptoServerConfig::TESTING, &rand_b);
    600   scoped_ptr<CryptoHandshakeMessage> scfg_a(
    601       a.AddDefaultConfig(&rand_a, &clock, options));
    602   scoped_ptr<CryptoHandshakeMessage> scfg_b(
    603       b.AddDefaultConfig(&rand_b, &clock, options));
    604 
    605   StringPiece scid_a, scid_b;
    606   EXPECT_TRUE(scfg_a->GetStringPiece(kSCID, &scid_a));
    607   EXPECT_TRUE(scfg_b->GetStringPiece(kSCID, &scid_b));
    608 
    609   EXPECT_NE(scid_a, scid_b);
    610 }
    611 
    612 
    613 TEST(CryptoServerConfigGenerationTest, SCIDIsHashOfServerConfig) {
    614   MockRandom rand_a;
    615   const QuicCryptoServerConfig::ConfigOptions options;
    616   MockClock clock;
    617 
    618   QuicCryptoServerConfig a(QuicCryptoServerConfig::TESTING, &rand_a);
    619   scoped_ptr<CryptoHandshakeMessage> scfg(
    620       a.AddDefaultConfig(&rand_a, &clock, options));
    621 
    622   StringPiece scid;
    623   EXPECT_TRUE(scfg->GetStringPiece(kSCID, &scid));
    624   // Need to take a copy of |scid| has we're about to call |Erase|.
    625   const string scid_str(scid.as_string());
    626 
    627   scfg->Erase(kSCID);
    628   scfg->MarkDirty();
    629   const QuicData& serialized(scfg->GetSerialized());
    630 
    631   scoped_ptr<crypto::SecureHash> hash(
    632       crypto::SecureHash::Create(crypto::SecureHash::SHA256));
    633   hash->Update(serialized.data(), serialized.length());
    634   uint8 digest[16];
    635   hash->Finish(digest, sizeof(digest));
    636 
    637   ASSERT_EQ(scid.size(), sizeof(digest));
    638   EXPECT_EQ(0, memcmp(digest, scid_str.data(), sizeof(digest)));
    639 }
    640 
    641 class CryptoServerTestNoConfig : public CryptoServerTest {
    642  public:
    643   virtual void SetUp() {
    644     // Deliberately don't add a config so that we can test this situation.
    645   }
    646 };
    647 
    648 TEST_P(CryptoServerTestNoConfig, DontCrash) {
    649   ShouldFailMentioning("No config", InchoateClientHello(
    650       "CHLO",
    651       "VER\0", client_version_.data(),
    652       NULL));
    653 
    654   const HandshakeFailureReason kRejectReasons[] = {
    655     SERVER_CONFIG_INCHOATE_HELLO_FAILURE
    656   };
    657   CheckRejectReasons(kRejectReasons, arraysize(kRejectReasons));
    658 }
    659 
    660 class AsyncStrikeServerVerificationTest : public CryptoServerTest {
    661  protected:
    662   AsyncStrikeServerVerificationTest() {
    663   }
    664 
    665   virtual void SetUp() {
    666     const string kOrbit = "12345678";
    667     config_options_.orbit = kOrbit;
    668     strike_register_client_ = new DelayedVerifyStrikeRegisterClient(
    669         10000,  // strike_register_max_entries
    670         static_cast<uint32>(clock_.WallNow().ToUNIXSeconds()),
    671         60,  // strike_register_window_secs
    672         reinterpret_cast<const uint8 *>(kOrbit.data()),
    673         StrikeRegister::NO_STARTUP_PERIOD_NEEDED);
    674     config_.SetStrikeRegisterClient(strike_register_client_);
    675     CryptoServerTest::SetUp();
    676     strike_register_client_->StartDelayingVerification();
    677   }
    678 
    679   DelayedVerifyStrikeRegisterClient* strike_register_client_;
    680 };
    681 
    682 TEST_P(AsyncStrikeServerVerificationTest, AsyncReplayProtection) {
    683   // This tests async validation with a strike register works.
    684   CryptoHandshakeMessage msg = CryptoTestUtils::Message(
    685       "CHLO",
    686       "AEAD", "AESG",
    687       "KEXS", "C255",
    688       "SCID", scid_hex_.c_str(),
    689       "#004b5453", srct_hex_.c_str(),
    690       "PUBS", pub_hex_.c_str(),
    691       "NONC", nonce_hex_.c_str(),
    692       "VER\0", client_version_.data(),
    693       "$padding", static_cast<int>(kClientHelloMinimumSize),
    694       NULL);
    695 
    696   // Clear the message tag.
    697   out_.set_tag(0);
    698 
    699   bool called = false;
    700   RunValidate(msg, new ValidateCallback(this, true, "", &called));
    701   // The verification request was queued.
    702   ASSERT_FALSE(called);
    703   EXPECT_EQ(0u, out_.tag());
    704   EXPECT_EQ(1, strike_register_client_->PendingVerifications());
    705 
    706   // Continue processing the verification request.
    707   strike_register_client_->RunPendingVerifications();
    708   ASSERT_TRUE(called);
    709   EXPECT_EQ(0, strike_register_client_->PendingVerifications());
    710   // The message should be accepted now.
    711   EXPECT_EQ(kSHLO, out_.tag());
    712 
    713   // Rejected if replayed.
    714   RunValidate(msg, new ValidateCallback(this, true, "", &called));
    715   // The verification request was queued.
    716   ASSERT_FALSE(called);
    717   EXPECT_EQ(1, strike_register_client_->PendingVerifications());
    718 
    719   strike_register_client_->RunPendingVerifications();
    720   ASSERT_TRUE(called);
    721   EXPECT_EQ(0, strike_register_client_->PendingVerifications());
    722   // The message should be rejected now.
    723   EXPECT_EQ(kREJ, out_.tag());
    724 }
    725 
    726 }  // namespace test
    727 }  // namespace net
    728