| // Copyright 2012 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "services/network/proxy_resolving_client_socket.h" |
| |
| #include <set> |
| #include <string> |
| #include <string_view> |
| #include <utility> |
| #include <vector> |
| |
| #include "base/compiler_specific.h" |
| #include "base/run_loop.h" |
| #include "base/strings/stringprintf.h" |
| #include "base/strings/utf_string_conversions.h" |
| #include "base/test/scoped_feature_list.h" |
| #include "base/test/task_environment.h" |
| #include "net/base/features.h" |
| #include "net/base/mock_proxy_delegate.h" |
| #include "net/base/net_errors.h" |
| #include "net/base/network_isolation_key.h" |
| #include "net/base/proxy_server.h" |
| #include "net/base/proxy_string_util.h" |
| #include "net/base/schemeful_site.h" |
| #include "net/base/test_completion_callback.h" |
| #include "net/dns/mock_host_resolver.h" |
| #include "net/http/http_proxy_connect_job.h" |
| #include "net/proxy_resolution/configured_proxy_resolution_service.h" |
| #include "net/proxy_resolution/mock_proxy_resolver.h" |
| #include "net/proxy_resolution/proxy_config_service_fixed.h" |
| #include "net/proxy_resolution/proxy_config_with_annotation.h" |
| #include "net/socket/client_socket_pool_manager.h" |
| #include "net/socket/connect_job_factory.h" |
| #include "net/socket/socket_test_util.h" |
| #include "net/spdy/spdy_test_util_common.h" |
| #include "net/test/gtest_util.h" |
| #include "net/traffic_annotation/network_traffic_annotation_test_helper.h" |
| #include "net/url_request/url_request_context_builder.h" |
| #include "net/url_request/url_request_test_util.h" |
| #include "services/network/proxy_resolving_client_socket_factory.h" |
| #include "testing/gtest/include/gtest/gtest.h" |
| #include "url/gurl.h" |
| #include "url/scheme_host_port.h" |
| |
| namespace network { |
| |
| namespace { |
| |
| std::unique_ptr<net::ConfiguredProxyResolutionService> |
| CreateProxyResolutionService(std::string_view pac_result) { |
| return net::ConfiguredProxyResolutionService::CreateFixedFromPacResultForTest( |
| static_cast<std::string>(pac_result), TRAFFIC_ANNOTATION_FOR_TESTS); |
| } |
| |
| } // namespace |
| |
| class ProxyResolvingClientSocketTest |
| : public testing::Test, |
| public testing::WithParamInterface<bool> { |
| protected: |
| ProxyResolvingClientSocketTest() : use_tls_(GetParam()) { |
| feature_list_.InitAndEnableFeature( |
| net::features::kPartitionConnectionsByNetworkIsolationKey); |
| } |
| |
| ~ProxyResolvingClientSocketTest() override {} |
| |
| void TearDown() override { |
| // Clear out any messages posted by ProxyResolvingClientSocket's |
| // destructor. |
| base::RunLoop().RunUntilIdle(); |
| } |
| |
| std::unique_ptr<net::URLRequestContextBuilder> CreateBuilder( |
| std::string_view pac_result = "PROXY bad:99; PROXY maybe:80; DIRECT") { |
| auto builder = net::CreateTestURLRequestContextBuilder(); |
| builder->set_proxy_resolution_service( |
| CreateProxyResolutionService(pac_result)); |
| builder->set_client_socket_factory_for_testing( |
| &mock_client_socket_factory_); |
| return builder; |
| } |
| |
| base::test::TaskEnvironment task_environment_; |
| base::test::ScopedFeatureList feature_list_; |
| net::MockClientSocketFactory mock_client_socket_factory_; |
| const bool use_tls_; |
| }; |
| |
| INSTANTIATE_TEST_SUITE_P(All, |
| ProxyResolvingClientSocketTest, |
| ::testing::Bool()); |
| |
| // Checks the correct NetworkAnonymizationKey is used for host resolution in the |
| // case no proxy is in use. |
| TEST_P(ProxyResolvingClientSocketTest, NetworkIsolationKeyDirect) { |
| // This deliberately uses a different origin than the one being connected to. |
| const net::SchemefulSite kNetworkIsolationKeySite = |
| net::SchemefulSite(GURL("https://foopy.test")); |
| const net::NetworkIsolationKey kNetworkIsolationKey(kNetworkIsolationKeySite, |
| kNetworkIsolationKeySite); |
| const net::NetworkAnonymizationKey kNetworkAnonymizationKey = |
| net::NetworkAnonymizationKey::CreateFromNetworkIsolationKey( |
| kNetworkIsolationKey); |
| auto url_request_context = CreateBuilder("DIRECT")->Build(); |
| |
| const GURL kDestination("https://dest.test/"); |
| net::StaticSocketDataProvider socket_data; |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| net::SSLSocketDataProvider ssl_data(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| url_request_context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, kNetworkAnonymizationKey, use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| |
| // Check that the URL in kDestination is in the HostCache, with |
| // kNetworkIsolationInfo. |
| const net::HostPortPair kDestinationHostPortPair = |
| net::HostPortPair::FromURL(kDestination); |
| net::HostResolver::ResolveHostParameters params; |
| params.source = net::HostResolverSource::LOCAL_ONLY; |
| std::unique_ptr<net::HostResolver::ResolveHostRequest> request1 = |
| url_request_context->host_resolver()->CreateRequest( |
| kDestinationHostPortPair, kNetworkAnonymizationKey, |
| net::NetLogWithSource(), params); |
| net::TestCompletionCallback callback2; |
| int result = request1->Start(callback2.callback()); |
| EXPECT_EQ(net::OK, callback2.GetResult(result)); |
| |
| // Check that the hostname is not in the DNS cache for other possible NIKs. |
| const url::Origin kDestinationOrigin = url::Origin::Create(kDestination); |
| const net::NetworkAnonymizationKey kOtherNaks[] = { |
| net::NetworkAnonymizationKey(), |
| net::NetworkAnonymizationKey::CreateSameSite( |
| net::SchemefulSite(kDestinationOrigin)), |
| }; |
| for (const auto& other_nak : kOtherNaks) { |
| std::unique_ptr<net::HostResolver::ResolveHostRequest> request2 = |
| url_request_context->host_resolver()->CreateRequest( |
| kDestinationHostPortPair, other_nak, net::NetLogWithSource(), |
| params); |
| net::TestCompletionCallback callback3; |
| result = request2->Start(callback3.callback()); |
| EXPECT_EQ(net::ERR_NAME_NOT_RESOLVED, callback3.GetResult(result)); |
| } |
| } |
| |
| // Checks the correct NetworkAnonymizationKey is used for host resolution in the |
| // case an H2 proxy is in use. In the non-H2 proxy case, the |
| // NetworkAnonymizationKey makes little difference, but in the H2 case, it |
| // affects which requests use the same session. Unlike other tests, this test |
| // creates a ProxyResolvingClientSocket instead of using the factory class, |
| // because it uses SpdySessionDependencies to create a NetworkSession configured |
| // to test H2. |
| // |
| // TODO(crbug.com/40946183): SPDY isn't currently supported, even through |
| // proxies, by ProxyResolvingClientSocket. Change that or switch to using an H1 |
| // proxy. |
| TEST_P(ProxyResolvingClientSocketTest, NetworkIsolationKeyWithH2Proxy) { |
| // Don't bother running this test in the SSL case - it's complicated enough |
| // without it, and testing HTTPS on top of H2 provides minimal value, since |
| // SSL is mocked out anyways and there are other tests that cover it on top of |
| // HTTP/1.x tunnels. |
| if (GetParam() == true) |
| return; |
| net::SpdySessionDependencies session_deps; |
| session_deps.proxy_resolution_service = |
| CreateProxyResolutionService("HTTPS proxy.test:80"); |
| std::unique_ptr<net::HttpNetworkSession> http_network_session = |
| net::SpdySessionDependencies::SpdyCreateSession(&session_deps); |
| |
| net::NetworkIsolationKey kNetworkIsolationKey1 = |
| net::NetworkIsolationKey::CreateTransientForTesting(); |
| net::NetworkIsolationKey kNetworkIsolationKey2 = |
| net::NetworkIsolationKey::CreateTransientForTesting(); |
| net::NetworkAnonymizationKey kNetworkAnonymizationKey1 = |
| net::NetworkAnonymizationKey::CreateFromNetworkIsolationKey( |
| kNetworkIsolationKey1); |
| net::NetworkAnonymizationKey kNetworkAnonymizationKey2 = |
| net::NetworkAnonymizationKey::CreateFromNetworkIsolationKey( |
| kNetworkIsolationKey2); |
| const GURL kDestination1("https://dest1.test/"); |
| const GURL kDestination2("https://dest2.test/"); |
| const GURL kDestination3("https://dest3.test/"); |
| |
| // A tunnel to kDestination1 and kDestination3 is requested using |
| // kNetworkIsolationKey1, so they should use the same H2 session, and a tunnel |
| // to kDestination2 is requested using kNetworkIsolationKey2, which should use |
| // a different session. |
| net::SpdyTestUtil spdy_util1; |
| spdy::SpdySerializedFrame connect_dest1(spdy_util1.ConstructSpdyConnect( |
| base::span<const std::string_view>(), 1, |
| net::HttpProxyConnectJob::kH2QuicTunnelPriority, |
| net::HostPortPair::FromURL(kDestination1))); |
| spdy::SpdySerializedFrame connect_dest1_resp(spdy_util1.ConstructSpdyGetReply( |
| base::span<const std::string_view>(), 1)); |
| spdy::SpdySerializedFrame connect_dest3(spdy_util1.ConstructSpdyConnect( |
| base::span<const std::string_view>(), 3, |
| net::HttpProxyConnectJob::kH2QuicTunnelPriority, |
| net::HostPortPair::FromURL(kDestination3))); |
| spdy::SpdySerializedFrame connect_dest3_resp(spdy_util1.ConstructSpdyGetReply( |
| base::span<const std::string_view>(), 3)); |
| |
| net::MockWrite spdy_writes[] = { |
| net::CreateMockWrite(connect_dest1, 0), |
| net::CreateMockWrite(connect_dest3, 2), |
| }; |
| |
| net::MockRead spdy_reads[] = { |
| net::CreateMockRead(connect_dest1_resp, 1, net::ASYNC), |
| net::CreateMockRead(connect_dest3_resp, 3, net::ASYNC), |
| net::MockRead(net::SYNCHRONOUS, 0, 4), |
| }; |
| |
| net::SequencedSocketData socket_data(spdy_reads, spdy_writes); |
| session_deps.socket_factory->AddSocketDataProvider(&socket_data); |
| net::SSLSocketDataProvider ssl_data(net::ASYNC, net::OK); |
| ssl_data.next_proto = net::NextProto::kProtoHTTP2; |
| session_deps.socket_factory->AddSSLSocketDataProvider(&ssl_data); |
| |
| net::SpdyTestUtil spdy_util2; |
| spdy::SpdySerializedFrame connect_dest2(spdy_util2.ConstructSpdyConnect( |
| base::span<const std::string_view>(), 1, |
| net::HttpProxyConnectJob::kH2QuicTunnelPriority, |
| net::HostPortPair::FromURL(kDestination2))); |
| spdy::SpdySerializedFrame connect_dest2_resp(spdy_util2.ConstructSpdyGetReply( |
| base::span<const std::string_view>(), 1)); |
| |
| net::MockWrite spdy_writes2[] = { |
| net::CreateMockWrite(connect_dest2, 0), |
| }; |
| |
| net::MockRead spdy_reads2[] = { |
| net::CreateMockRead(connect_dest2_resp, 1, net::ASYNC), |
| net::MockRead(net::SYNCHRONOUS, 0, 2), |
| }; |
| |
| net::SequencedSocketData socket_data2(spdy_reads2, spdy_writes2); |
| session_deps.socket_factory->AddSocketDataProvider(&socket_data2); |
| net::SSLSocketDataProvider ssl_data2(net::ASYNC, net::OK); |
| ssl_data2.next_proto = net::NextProto::kProtoHTTP2; |
| session_deps.socket_factory->AddSSLSocketDataProvider(&ssl_data2); |
| |
| net::ConnectJobFactory connect_job_factory; |
| |
| // Connect to kDestination1 using kNetworkIsolationKey1. It should use a new |
| // H2 session. |
| net::CommonConnectJobParams common_connect_job_params = |
| http_network_session->CreateCommonConnectJobParams(); |
| ProxyResolvingClientSocket socket1( |
| http_network_session.get(), &common_connect_job_params, kDestination1, |
| kNetworkAnonymizationKey1, false /* use_tls */, &connect_job_factory); |
| net::TestCompletionCallback callback1; |
| int result = socket1.Connect(callback1.callback()); |
| EXPECT_THAT(callback1.GetResult(result), net::test::IsOk()); |
| |
| // Connect to kDestination2 using kNetworkIsolationKey2. It should use a new |
| // H2 session. |
| ProxyResolvingClientSocket socket2( |
| http_network_session.get(), &common_connect_job_params, kDestination2, |
| kNetworkAnonymizationKey2, false /* use_tls */, &connect_job_factory); |
| net::TestCompletionCallback callback2; |
| result = socket2.Connect(callback2.callback()); |
| EXPECT_THAT(callback2.GetResult(result), net::test::IsOk()); |
| EXPECT_TRUE(socket_data2.AllWriteDataConsumed()); |
| EXPECT_TRUE(socket_data2.AllReadDataConsumed()); |
| |
| // Connect to kDestination3 using kNetworkIsolationKey1. It should reuse the |
| // first H2 session. |
| ProxyResolvingClientSocket socket3( |
| http_network_session.get(), &common_connect_job_params, kDestination3, |
| kNetworkAnonymizationKey1, false /* use_tls */, &connect_job_factory); |
| net::TestCompletionCallback callback3; |
| result = socket3.Connect(callback3.callback()); |
| EXPECT_THAT(callback3.GetResult(result), net::test::IsOk()); |
| EXPECT_TRUE(socket_data.AllWriteDataConsumed()); |
| EXPECT_TRUE(socket_data.AllReadDataConsumed()); |
| } |
| |
| // Tests that the global socket pool limit |
| // (ClientSocketPoolManager::max_sockets_per_group) doesn't apply to this |
| // type of sockets. |
| TEST_P(ProxyResolvingClientSocketTest, SocketLimitNotApply) { |
| const int kNumSockets = net::ClientSocketPoolManager::max_sockets_per_group( |
| net::HttpNetworkSession::NORMAL_SOCKET_POOL) + |
| 10; |
| const GURL kDestination("https://example.com:443"); |
| net::MockClientSocketFactory socket_factory; |
| net::MockWrite writes[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n")}; |
| net::MockRead reads[] = {net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| std::vector<std::unique_ptr<net::StaticSocketDataProvider>> socket_data; |
| std::vector<std::unique_ptr<net::SSLSocketDataProvider>> ssl_data; |
| for (int i = 0; i < kNumSockets; ++i) { |
| socket_data.push_back( |
| std::make_unique<net::StaticSocketDataProvider>(reads, writes)); |
| socket_data[i]->set_connect_data(net::MockConnect(net::ASYNC, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(socket_data[i].get()); |
| ssl_data.push_back( |
| std::make_unique<net::SSLSocketDataProvider>(net::ASYNC, net::OK)); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(ssl_data[i].get()); |
| } |
| |
| auto context = CreateBuilder()->Build(); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::vector<std::unique_ptr<ProxyResolvingClientSocket>> sockets; |
| for (int i = 0; i < kNumSockets; ++i) { |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| sockets.push_back(std::move(socket)); |
| } |
| for (int i = 0; i < kNumSockets; ++i) { |
| EXPECT_TRUE(socket_data[i]->AllReadDataConsumed()); |
| EXPECT_TRUE(socket_data[i]->AllWriteDataConsumed()); |
| EXPECT_EQ(use_tls_, ssl_data[i]->ConnectDataConsumed()); |
| } |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ConnectError) { |
| const struct TestData { |
| // Whether the error is encountered synchronously as opposed to |
| // asynchronously. |
| bool is_error_sync; |
| // Whether it is using a direct connection as opposed to a proxy connection. |
| bool is_direct; |
| } kTestCases[] = { |
| {true, true}, {true, false}, {false, true}, {false, false}, |
| }; |
| const GURL kDestination("https://example.com:443"); |
| for (auto test : kTestCases) { |
| std::string_view pac_result = |
| test.is_direct ? "DIRECT" : "PROXY myproxy.com:89"; |
| auto context = CreateBuilder(pac_result)->Build(); |
| net::StaticSocketDataProvider socket_data; |
| socket_data.set_connect_data(net::MockConnect( |
| test.is_error_sync ? net::SYNCHRONOUS : net::ASYNC, net::ERR_FAILED)); |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| if (test.is_direct) { |
| EXPECT_EQ(net::ERR_FAILED, status); |
| } else { |
| EXPECT_EQ(net::ERR_PROXY_CONNECTION_FAILED, status); |
| } |
| EXPECT_TRUE(socket_data.AllReadDataConsumed()); |
| EXPECT_TRUE(socket_data.AllWriteDataConsumed()); |
| } |
| } |
| |
| // Tests that the connection is established to the proxy. Also verifies that |
| // the proxy SSL connection will only negotiate H1 via ALPN, and SSL connections |
| // to the server receive no ALPN data. |
| TEST_P(ProxyResolvingClientSocketTest, ConnectToProxy) { |
| const GURL kDestination("https://example.com:443"); |
| // Use a different port than that of |kDestination|. |
| const int kProxyPort = 8009; |
| const int kDirectPort = 443; |
| for (bool is_direct : {true, false}) { |
| net::MockClientSocketFactory socket_factory; |
| std::string pac_result; |
| if (is_direct) { |
| pac_result = "DIRECT"; |
| } else { |
| pac_result = base::StringPrintf("HTTPS myproxy.com:%d", kProxyPort); |
| } |
| auto context = CreateBuilder(pac_result)->Build(); |
| |
| // Use same StaticSocketDataProvider for the direct and proxy cases. In the |
| // direct case, the data won't actually be read/written. |
| net::MockRead reads[] = {net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| net::MockWrite writes[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n")}; |
| net::IPEndPoint remote_addr(net::IPAddress(127, 0, 0, 1), |
| is_direct ? kDirectPort : kProxyPort); |
| net::StaticSocketDataProvider socket_data(reads, writes); |
| socket_data.set_connect_data( |
| net::MockConnect(net::ASYNC, net::OK, remote_addr)); |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| |
| // SSL data for the proxy case. |
| net::SSLSocketDataProvider proxy_ssl_data(net::ASYNC, net::OK); |
| // Only H1 be allowed for the proxy. |
| // |
| // TODO(crbug.com/40946183): Investigate changing that. |
| proxy_ssl_data.next_protos_expected_in_ssl_config = |
| net::NextProtoVector{net::NextProto::kProtoHTTP11}; |
| |
| if (!is_direct) { |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&proxy_ssl_data); |
| } |
| |
| // If using TLS to talk to the server, set up the SSL data for that. ALPN |
| // should not be enabled for the destination server at all, as this may not |
| // even be an HTTP connection. |
| net::SSLSocketDataProvider server_ssl_data(net::ASYNC, net::OK); |
| server_ssl_data.next_protos_expected_in_ssl_config = net::NextProtoVector(); |
| server_ssl_data.expected_early_data_enabled = false; |
| if (use_tls_) { |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&server_ssl_data); |
| } |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| EXPECT_EQ(net::OK, status); |
| net::IPEndPoint actual_remote_addr; |
| status = socket->GetPeerAddress(&actual_remote_addr); |
| if (!is_direct) { |
| // ProxyResolvingClientSocket::GetPeerAddress() hides the ip of the |
| // proxy, so call private member to make sure address is correct. |
| EXPECT_EQ(net::ERR_NAME_NOT_RESOLVED, status); |
| status = socket->socket_->GetPeerAddress(&actual_remote_addr); |
| } |
| EXPECT_EQ(net::OK, status); |
| EXPECT_EQ(remote_addr.ToString(), actual_remote_addr.ToString()); |
| if (!is_direct) { |
| EXPECT_TRUE(proxy_ssl_data.ConnectDataConsumed()); |
| } |
| if (use_tls_) { |
| EXPECT_TRUE(server_ssl_data.ConnectDataConsumed()); |
| } |
| } |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, SocketDestroyedBeforeConnectComplete) { |
| const GURL kDestination("https://example.com:443"); |
| net::StaticSocketDataProvider socket_data; |
| socket_data.set_connect_data(net::MockConnect(net::ASYNC, net::OK)); |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| auto context = CreateBuilder("DIRECT")->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| socket.reset(); |
| // Makes sure there is no UAF and socket request is canceled properly. |
| base::RunLoop().RunUntilIdle(); |
| } |
| |
| // Tests that connection itself is successful but an error occurred during |
| // Read()/Write(). |
| TEST_P(ProxyResolvingClientSocketTest, ReadWriteErrors) { |
| const GURL kDestination("http://example.com:80"); |
| const struct TestData { |
| // Whether there is a read error as opposed to a write error. |
| bool is_read_error; |
| // Whether the error is encountered synchronously as opposed to |
| // asynchronously. |
| bool is_error_sync; |
| // Whether it is using a direct connection as opposed to a proxy connection. |
| bool is_direct; |
| } kTestCases[] = { |
| {true, true, true}, {true, true, false}, {false, true, true}, |
| {false, true, false}, {true, false, true}, {true, false, false}, |
| {false, false, true}, {false, false, false}, |
| }; |
| // Use a different port than that of |kDestination|. |
| const int kProxyPort = 8009; |
| const int kDirectPort = 80; |
| for (auto test : kTestCases) { |
| std::string pac_result; |
| if (test.is_direct) { |
| pac_result = "DIRECT"; |
| } else { |
| pac_result = base::StringPrintf("PROXY myproxy.com:%d", kProxyPort); |
| } |
| auto context = CreateBuilder(pac_result)->Build(); |
| std::vector<net::MockWrite> writes; |
| std::vector<net::MockRead> reads; |
| if (!test.is_direct) { |
| writes.emplace_back( |
| "CONNECT example.com:80 HTTP/1.1\r\n" |
| "Host: example.com:80\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n"); |
| reads.emplace_back("HTTP/1.1 200 Success\r\n\r\n"); |
| } |
| if (test.is_read_error) { |
| reads.emplace_back(test.is_error_sync ? net::SYNCHRONOUS : net::ASYNC, |
| net::ERR_FAILED); |
| } else { |
| writes.emplace_back(test.is_error_sync ? net::SYNCHRONOUS : net::ASYNC, |
| net::ERR_FAILED); |
| } |
| net::StaticSocketDataProvider socket_data(reads, writes); |
| net::IPEndPoint remote_addr(net::IPAddress(127, 0, 0, 1), |
| test.is_direct ? kDirectPort : kProxyPort); |
| socket_data.set_connect_data( |
| net::MockConnect(net::ASYNC, net::OK, remote_addr)); |
| net::MockClientSocketFactory socket_factory; |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| EXPECT_EQ(net::OK, status); |
| net::IPEndPoint actual_remote_addr; |
| status = socket->GetPeerAddress(&actual_remote_addr); |
| if (!test.is_direct) { |
| // ProxyResolvingClientSocket::GetPeerAddress() hides the ip of the |
| // proxy, so call private member to make sure address is correct. |
| EXPECT_EQ(net::ERR_NAME_NOT_RESOLVED, status); |
| status = socket->socket_->GetPeerAddress(&actual_remote_addr); |
| } |
| EXPECT_EQ(net::OK, status); |
| EXPECT_EQ(remote_addr.ToString(), actual_remote_addr.ToString()); |
| |
| net::TestCompletionCallback read_write_callback; |
| int read_write_result; |
| std::string test_data_string("test data"); |
| auto read_buffer = base::MakeRefCounted<net::IOBufferWithSize>(10); |
| auto write_buffer = |
| base::MakeRefCounted<net::StringIOBuffer>(test_data_string); |
| if (test.is_read_error) { |
| read_write_result = |
| socket->Read(read_buffer.get(), 10, read_write_callback.callback()); |
| } else { |
| read_write_result = socket->Write( |
| write_buffer.get(), test_data_string.size(), |
| read_write_callback.callback(), TRAFFIC_ANNOTATION_FOR_TESTS); |
| } |
| if (read_write_result == net::ERR_IO_PENDING) { |
| EXPECT_TRUE(!test.is_error_sync); |
| read_write_result = read_write_callback.WaitForResult(); |
| } |
| EXPECT_EQ(net::ERR_FAILED, read_write_result); |
| EXPECT_TRUE(socket_data.AllReadDataConsumed()); |
| EXPECT_TRUE(socket_data.AllWriteDataConsumed()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ReportsBadProxies) { |
| const GURL kDestination("https://example.com:443"); |
| |
| net::StaticSocketDataProvider socket_data1; |
| socket_data1.set_connect_data( |
| net::MockConnect(net::ASYNC, net::ERR_ADDRESS_UNREACHABLE)); |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data1); |
| |
| net::MockRead reads[] = {net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| net::MockWrite writes[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n")}; |
| net::StaticSocketDataProvider socket_data2(reads, writes); |
| socket_data2.set_connect_data(net::MockConnect(net::ASYNC, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data2); |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| auto context = CreateBuilder()->Build(); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| EXPECT_EQ(net::OK, status); |
| |
| const net::ProxyRetryInfoMap& retry_info = |
| context->proxy_resolution_service()->proxy_retry_info(); |
| |
| EXPECT_EQ(1u, retry_info.size()); |
| net::ProxyRetryInfoMap::const_iterator iter = retry_info.find( |
| ProxyUriToProxyChain("bad:99", net::ProxyServer::SCHEME_HTTP)); |
| EXPECT_TRUE(iter != retry_info.end()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ResetSocketAfterTunnelAuth) { |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect without credentials. The server responds with a 407. |
| net::MockWrite kConnectWrites1[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads1[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm\"\r\n" |
| "\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData1(kConnectReads1, kConnectWrites1); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData1); |
| |
| auto context = CreateBuilder()->Build(); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), |
| net::test::IsError(net::ERR_PROXY_AUTH_REQUESTED)); |
| // Make sure |socket_| is closed appropriately. |
| EXPECT_FALSE(socket->socket_); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, MultiroundAuth) { |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect without credentials. The server responds with a 407. |
| net::MockWrite kConnectWrites1[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads1[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm\"\r\n" |
| "\r\n")}; |
| |
| // Second connect attempt includes credentials for test_realm. |
| net::MockWrite kConnectWrites2[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads2[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm2\"\r\n" |
| "\r\n")}; |
| |
| // Third connect attempt include credentials for test_realm2. |
| net::MockWrite kConnectWrites3[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Proxy-Authorization: Basic dXNlcjI6cGFzc3dvcmQy\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads3[] = { |
| net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData1(kConnectReads1, kConnectWrites1); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData1); |
| |
| net::StaticSocketDataProvider kSocketData2(kConnectReads2, kConnectWrites2); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData2); |
| net::StaticSocketDataProvider kSocketData3(kConnectReads3, kConnectWrites3); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData3); |
| |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| auto context = CreateBuilder()->Build(); |
| |
| net::HttpAuthCache* auth_cache = |
| context->http_transaction_factory()->GetSession()->http_auth_cache(); |
| |
| auth_cache->Add(url::SchemeHostPort(GURL("http://bad:99")), |
| net::HttpAuth::AUTH_PROXY, "test_realm", |
| net::HttpAuth::AUTH_SCHEME_BASIC, |
| net::NetworkAnonymizationKey(), "Basic realm=\"test_realm\"", |
| net::AuthCredentials(u"user", u"password"), std::string()); |
| |
| auth_cache->Add(url::SchemeHostPort(GURL("http://bad:99")), |
| net::HttpAuth::AUTH_PROXY, "test_realm2", |
| net::HttpAuth::AUTH_SCHEME_BASIC, |
| net::NetworkAnonymizationKey(), "Basic realm=\"test_realm2\"", |
| net::AuthCredentials(u"user2", u"password2"), std::string()); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ReusesHTTPAuthCache_Lookup) { |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect without credentials. The server responds with a 407. |
| net::MockWrite kConnectWrites1[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads1[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm\"\r\n" |
| "\r\n")}; |
| |
| // Second connect attempt includes credentials. |
| net::MockWrite kConnectWrites2[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads2[] = { |
| net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData1(kConnectReads1, kConnectWrites1); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData1); |
| |
| net::StaticSocketDataProvider kSocketData2(kConnectReads2, kConnectWrites2); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData2); |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| auto context = CreateBuilder()->Build(); |
| |
| net::HttpAuthCache* auth_cache = |
| context->http_transaction_factory()->GetSession()->http_auth_cache(); |
| |
| // We are adding these credentials at an empty path so that it won't be picked |
| // up by the preemptive authentication step and will only be picked up via |
| // origin + realm + scheme lookup. |
| auth_cache->Add(url::SchemeHostPort(GURL("http://bad:99")), |
| net::HttpAuth::AUTH_PROXY, "test_realm", |
| net::HttpAuth::AUTH_SCHEME_BASIC, |
| net::NetworkAnonymizationKey(), "Basic realm=\"test_realm\"", |
| net::AuthCredentials(u"user", u"password"), std::string()); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| |
| // Make sure that if HttpAuthCache is updated e.g through normal URLRequests, |
| // ProxyResolvingClientSocketFactory uses the latest cache for creating new |
| // sockets. |
| TEST_P(ProxyResolvingClientSocketTest, FactoryUsesLatestHTTPAuthCache) { |
| auto context = CreateBuilder()->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| |
| // After creating |socket_factory|, updates the auth cache with credentials. |
| // New socket connections should pick up this change. |
| net::HttpAuthCache* auth_cache = |
| context->http_transaction_factory()->GetSession()->http_auth_cache(); |
| |
| // We are adding these credentials at an empty path so that it won't be picked |
| // up by the preemptive authentication step and will only be picked up via |
| // origin + realm + scheme lookup. |
| auth_cache->Add(url::SchemeHostPort(GURL("http://bad:99")), |
| net::HttpAuth::AUTH_PROXY, "test_realm", |
| net::HttpAuth::AUTH_SCHEME_BASIC, |
| net::NetworkAnonymizationKey(), "Basic realm=\"test_realm\"", |
| net::AuthCredentials(u"user", u"password"), std::string()); |
| |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect without credentials. The server responds with a 407. |
| net::MockWrite kConnectWrites[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "\r\n"), |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm\"\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Content-Length: 0\r\n" |
| "\r\n"), |
| net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData(kConnectReads, kConnectWrites); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData); |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ReusesHTTPAuthCache_Preemptive) { |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect uses preemptive credentials. That is all. |
| net::MockWrite kConnectWrites[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads[] = { |
| net::MockRead("HTTP/1.1 200 Success\r\n\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData(kConnectReads, kConnectWrites); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData); |
| net::SSLSocketDataProvider ssl_socket(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_socket); |
| |
| auto context = CreateBuilder()->Build(); |
| |
| net::HttpAuthCache* auth_cache = |
| context->http_transaction_factory()->GetSession()->http_auth_cache(); |
| |
| auth_cache->Add(url::SchemeHostPort(GURL("http://bad:99")), |
| net::HttpAuth::AUTH_PROXY, "test_realm", |
| net::HttpAuth::AUTH_SCHEME_BASIC, |
| net::NetworkAnonymizationKey(), "Basic realm=\"test_realm\"", |
| net::AuthCredentials(u"user", u"password"), "/"); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| EXPECT_EQ(use_tls_, ssl_socket.ConnectDataConsumed()); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, ReusesHTTPAuthCache_NoCredentials) { |
| const GURL kDestination("https://example.com:443"); |
| |
| // Initial connect uses preemptive credentials. That is all. |
| net::MockWrite kConnectWrites[] = { |
| net::MockWrite("CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n" |
| "\r\n")}; |
| net::MockRead kConnectReads[] = { |
| net::MockRead("HTTP/1.1 407 Proxy Authentication Required\r\n" |
| "Proxy-Authenticate: Basic realm=\"test_realm\"\r\n" |
| "\r\n")}; |
| |
| net::StaticSocketDataProvider kSocketData(kConnectReads, kConnectWrites); |
| mock_client_socket_factory_.AddSocketDataProvider(&kSocketData); |
| |
| auto context = CreateBuilder()->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::ERR_PROXY_AUTH_REQUESTED); |
| } |
| |
| // Make sure that url is sanitized before it is disclosed to the proxy. |
| TEST_P(ProxyResolvingClientSocketTest, URLSanitized) { |
| GURL url("http://username:password@www.example.com:79/?ref#hash#hash"); |
| |
| auto context_builder = CreateBuilder(); |
| net::ProxyConfig proxy_config; |
| proxy_config.set_pac_url(GURL("http://foopy/proxy.pac")); |
| proxy_config.set_pac_mandatory(true); |
| net::MockAsyncProxyResolver resolver; |
| auto proxy_resolver_factory = |
| std::make_unique<net::MockAsyncProxyResolverFactory>(false); |
| net::MockAsyncProxyResolverFactory* proxy_resolver_factory_raw = |
| proxy_resolver_factory.get(); |
| context_builder->set_proxy_resolution_service( |
| std::make_unique<net::ConfiguredProxyResolutionService>( |
| std::make_unique<net::ProxyConfigServiceFixed>( |
| net::ProxyConfigWithAnnotation(proxy_config, |
| TRAFFIC_ANNOTATION_FOR_TESTS)), |
| std::move(proxy_resolver_factory), nullptr, |
| /*quick_check_enabled=*/true)); |
| auto context = context_builder->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| url, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| base::RunLoop().RunUntilIdle(); |
| ASSERT_EQ(1u, proxy_resolver_factory_raw->pending_requests().size()); |
| EXPECT_EQ( |
| GURL("http://foopy/proxy.pac"), |
| proxy_resolver_factory_raw->pending_requests()[0]->script_data()->url()); |
| proxy_resolver_factory_raw->pending_requests()[0]->CompleteNowWithForwarder( |
| net::OK, &resolver); |
| ASSERT_EQ(1u, resolver.pending_jobs().size()); |
| // The URL should have been simplified, stripping the username/password/hash. |
| EXPECT_EQ(GURL("http://www.example.com:79/?ref"), |
| resolver.pending_jobs()[0]->url()); |
| } |
| |
| // Tests that socket is destroyed before proxy resolution can complete |
| // asynchronously. |
| TEST_P(ProxyResolvingClientSocketTest, |
| SocketDestroyedBeforeProxyResolutionCompletes) { |
| GURL url("http://www.example.com:79"); |
| |
| auto context_builder = CreateBuilder(); |
| net::ProxyConfig proxy_config; |
| proxy_config.set_pac_url(GURL("http://foopy/proxy.pac")); |
| proxy_config.set_pac_mandatory(true); |
| net::MockAsyncProxyResolver resolver; |
| auto proxy_resolver_factory = |
| std::make_unique<net::MockAsyncProxyResolverFactory>(false); |
| net::MockAsyncProxyResolverFactory* proxy_resolver_factory_raw = |
| proxy_resolver_factory.get(); |
| context_builder->set_proxy_resolution_service( |
| std::make_unique<net::ConfiguredProxyResolutionService>( |
| std::make_unique<net::ProxyConfigServiceFixed>( |
| net::ProxyConfigWithAnnotation(proxy_config, |
| TRAFFIC_ANNOTATION_FOR_TESTS)), |
| std::move(proxy_resolver_factory), nullptr, |
| /*quick_check_enabled=*/true)); |
| auto context = context_builder->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| url, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| EXPECT_EQ(net::ERR_IO_PENDING, socket->Connect(callback.callback())); |
| socket.reset(); |
| ASSERT_EQ(1u, proxy_resolver_factory_raw->pending_requests().size()); |
| proxy_resolver_factory_raw->pending_requests()[0]->CompleteNowWithForwarder( |
| net::OK, &resolver); |
| base::RunLoop().RunUntilIdle(); |
| } |
| |
| // Regression test for crbug.com/849300. If proxy resolution is successful but |
| // the proxy scheme is not supported, do not continue with connection |
| // establishment. |
| TEST_P(ProxyResolvingClientSocketTest, NoSupportedProxies) { |
| const GURL kDestination("https://example.com:443"); |
| |
| auto context_builder = CreateBuilder(); |
| net::ProxyConfig proxy_config; |
| // Use an unsupported proxy scheme. |
| proxy_config.proxy_rules().ParseFromString("quic://foopy:8080"); |
| auto proxy_resolver_factory = |
| std::make_unique<net::MockAsyncProxyResolverFactory>(false); |
| context_builder->set_proxy_resolution_service( |
| std::make_unique<net::ConfiguredProxyResolutionService>( |
| std::make_unique<net::ProxyConfigServiceFixed>( |
| net::ProxyConfigWithAnnotation(proxy_config, |
| TRAFFIC_ANNOTATION_FOR_TESTS)), |
| std::move(proxy_resolver_factory), nullptr, |
| /*quick_check_enabled=*/true)); |
| auto context = context_builder->Build(); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| status = callback.GetResult(status); |
| EXPECT_EQ(net::ERR_NO_SUPPORTED_PROXIES, status); |
| } |
| |
| class ReconsiderProxyAfterErrorTest |
| : public testing::Test, |
| public testing::WithParamInterface<::testing::tuple<bool, bool, int>> { |
| public: |
| ReconsiderProxyAfterErrorTest() : use_tls_(::testing::get<0>(GetParam())) {} |
| ~ReconsiderProxyAfterErrorTest() override = default; |
| |
| base::test::TaskEnvironment task_environment_; |
| net::MockClientSocketFactory mock_client_socket_factory_; |
| const bool use_tls_; |
| }; |
| |
| // List of errors that are used in the proxy resolution tests. |
| // |
| // Note: ProxyResolvingClientSocket currently removes |
| // net::ProxyServer::SCHEME_QUIC, so this list excludes errors that are |
| // retryable only for QUIC proxies. |
| const int kProxyTestMockErrors[] = { |
| net::ERR_PROXY_CONNECTION_FAILED, net::ERR_NAME_NOT_RESOLVED, |
| net::ERR_ADDRESS_UNREACHABLE, net::ERR_CONNECTION_RESET, |
| net::ERR_CONNECTION_REFUSED, net::ERR_CONNECTION_ABORTED, |
| net::ERR_SOCKS_CONNECTION_FAILED, net::ERR_TIMED_OUT, |
| net::ERR_CONNECTION_TIMED_OUT, net::ERR_PROXY_CERTIFICATE_INVALID, |
| net::ERR_SSL_PROTOCOL_ERROR}; |
| |
| INSTANTIATE_TEST_SUITE_P( |
| All, |
| ReconsiderProxyAfterErrorTest, |
| testing::Combine(testing::Bool(), |
| testing::Bool(), |
| testing::ValuesIn(kProxyTestMockErrors))); |
| |
| TEST_P(ReconsiderProxyAfterErrorTest, ReconsiderProxyAfterError) { |
| net::IoMode io_mode = |
| ::testing::get<1>(GetParam()) ? net::SYNCHRONOUS : net::ASYNC; |
| const int mock_error = ::testing::get<2>(GetParam()); |
| auto context_builder = net::CreateTestURLRequestContextBuilder(); |
| context_builder->set_proxy_resolution_service(CreateProxyResolutionService( |
| "HTTPS badproxy:99; HTTPS badfallbackproxy:98; DIRECT")); |
| context_builder->set_client_socket_factory_for_testing( |
| &mock_client_socket_factory_); |
| auto context = context_builder->Build(); |
| |
| // Before starting the test, verify that there are no proxies marked as bad. |
| ASSERT_TRUE(context->proxy_resolution_service()->proxy_retry_info().empty()) |
| << mock_error; |
| |
| // Configure the HTTP CONNECT to fail with `mock_error`. |
| // |
| // TODO(crbug.com/40810987): Test this more accurately. Errors like |
| // `ERR_PROXY_CONNECTION_FAILED` or `ERR_PROXY_CERTIFICATE_INVALID` are |
| // surfaced in response to other errors in TCP or TLS connection setup. |
| static constexpr std::string_view kHttpConnect = |
| "CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n"; |
| const net::MockWrite kWrites[] = {{net::ASYNC, kHttpConnect}}; |
| const net::MockRead kReads[] = {{net::ASYNC, mock_error}}; |
| |
| // Connect to first broken proxy. |
| net::StaticSocketDataProvider data1(kReads, kWrites); |
| net::SSLSocketDataProvider ssl_data1(io_mode, net::OK); |
| data1.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data1); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data1); |
| |
| // Connect to second broken proxy. |
| net::StaticSocketDataProvider data2(kReads, kWrites); |
| net::SSLSocketDataProvider ssl_data2(io_mode, net::OK); |
| data2.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data2); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data2); |
| |
| // Connect using direct. |
| net::StaticSocketDataProvider data3; |
| net::SSLSocketDataProvider ssl_data3(io_mode, net::OK); |
| data3.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data3); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data3); |
| |
| const GURL kDestination("https://example.com:443"); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| EXPECT_EQ(net::OK, status); |
| |
| const net::ProxyRetryInfoMap& retry_info = |
| context->proxy_resolution_service()->proxy_retry_info(); |
| EXPECT_EQ(2u, retry_info.size()) << mock_error; |
| EXPECT_NE(retry_info.end(), |
| retry_info.find(ProxyUriToProxyChain( |
| "https://badproxy:99", net::ProxyServer::SCHEME_HTTPS))); |
| EXPECT_NE(retry_info.end(), retry_info.find(ProxyUriToProxyChain( |
| "https://badfallbackproxy:98", |
| net::ProxyServer::SCHEME_HTTPS))); |
| // Should always use HTTPS to talk to HTTPS proxy. |
| EXPECT_TRUE(ssl_data1.ConnectDataConsumed()); |
| EXPECT_TRUE(ssl_data2.ConnectDataConsumed()); |
| // This depends on whether the consumer has requested to use TLS. |
| EXPECT_EQ(use_tls_, ssl_data3.ConnectDataConsumed()); |
| } |
| |
| // Confirms that ProxyResolvingClientSocket is passing net::ProxyDelegate to |
| // net::CanFalloverToNextProxy. |
| TEST_P(ReconsiderProxyAfterErrorTest, |
| ReconsiderProxyAfterErrorWithProxyDelegate) { |
| net::IoMode io_mode = |
| ::testing::get<1>(GetParam()) ? net::SYNCHRONOUS : net::ASYNC; |
| const int mock_error = ::testing::get<2>(GetParam()); |
| auto context_builder = net::CreateTestURLRequestContextBuilder(); |
| context_builder->set_proxy_resolution_service(CreateProxyResolutionService( |
| "HTTPS badproxy:99; HTTPS badfallbackproxy:98; DIRECT")); |
| context_builder->set_client_socket_factory_for_testing( |
| &mock_client_socket_factory_); |
| |
| auto proxy_delegate = std::make_unique<net::MockProxyDelegate>(); |
| // This is the only thing we really care about in this test: we want to make |
| // sure that ProxyDelegate::CanFalloverToNextProxyOverride is correctly called |
| // by ProxyResolvingClientSocket. We return std:nullopt not alter this test |
| // behavior from net::ReconsiderProxyAfterError's. |
| EXPECT_CALL(*proxy_delegate, |
| CanFalloverToNextProxyOverride(::testing::_, mock_error)) |
| .Times(2) |
| .WillRepeatedly(::testing::Return(std::nullopt)); |
| |
| context_builder->set_proxy_delegate(std::move(proxy_delegate)); |
| auto context = context_builder->Build(); |
| |
| // Before starting the test, verify that there are no proxies marked as bad. |
| ASSERT_TRUE(context->proxy_resolution_service()->proxy_retry_info().empty()) |
| << mock_error; |
| |
| // Configure the HTTP CONNECT to fail with `mock_error`. |
| // |
| // TODO(crbug.com/40810987): Test this more accurately. Errors like |
| // `ERR_PROXY_CONNECTION_FAILED` or `ERR_PROXY_CERTIFICATE_INVALID` are |
| // surfaced in response to other errors in TCP or TLS connection setup. |
| static constexpr std::string_view kHttpConnect = |
| "CONNECT example.com:443 HTTP/1.1\r\n" |
| "Host: example.com:443\r\n" |
| "Proxy-Connection: keep-alive\r\n\r\n"; |
| const net::MockWrite kWrites[] = {{net::ASYNC, kHttpConnect}}; |
| const net::MockRead kReads[] = {{net::ASYNC, mock_error}}; |
| |
| // Connect to first broken proxy. |
| net::StaticSocketDataProvider data1(kReads, kWrites); |
| net::SSLSocketDataProvider ssl_data1(io_mode, net::OK); |
| data1.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data1); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data1); |
| |
| // Connect to second broken proxy. |
| net::StaticSocketDataProvider data2(kReads, kWrites); |
| net::SSLSocketDataProvider ssl_data2(io_mode, net::OK); |
| data2.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data2); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data2); |
| |
| // Connect using direct. |
| net::StaticSocketDataProvider data3; |
| net::SSLSocketDataProvider ssl_data3(io_mode, net::OK); |
| data3.set_connect_data(net::MockConnect(io_mode, net::OK)); |
| mock_client_socket_factory_.AddSocketDataProvider(&data3); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data3); |
| |
| const GURL kDestination("https://example.com:443"); |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_EQ(net::ERR_IO_PENDING, status); |
| status = callback.WaitForResult(); |
| EXPECT_EQ(net::OK, status); |
| |
| const net::ProxyRetryInfoMap& retry_info = |
| context->proxy_resolution_service()->proxy_retry_info(); |
| EXPECT_EQ(2u, retry_info.size()) << mock_error; |
| EXPECT_NE(retry_info.end(), |
| retry_info.find(ProxyUriToProxyChain( |
| "https://badproxy:99", net::ProxyServer::SCHEME_HTTPS))); |
| EXPECT_NE(retry_info.end(), retry_info.find(ProxyUriToProxyChain( |
| "https://badfallbackproxy:98", |
| net::ProxyServer::SCHEME_HTTPS))); |
| // Should always use HTTPS to talk to HTTPS proxy. |
| EXPECT_TRUE(ssl_data1.ConnectDataConsumed()); |
| EXPECT_TRUE(ssl_data2.ConnectDataConsumed()); |
| // This depends on whether the consumer has requested to use TLS. |
| EXPECT_EQ(use_tls_, ssl_data3.ConnectDataConsumed()); |
| } |
| |
| TEST_P(ProxyResolvingClientSocketTest, |
| OnDestinationDnsAliasesResolved_ReturnsOK) { |
| const GURL kDestination("https://dest.test/"); |
| std::vector<std::string> aliases( |
| {"alias1", "alias2", kDestination.GetHost()}); |
| std::set<std::string> aliases_set(aliases.begin(), aliases.end()); |
| |
| // Create mock host resolver to return DNS aliases during host resolution. |
| std::unique_ptr<net::MockHostResolver> host_resolver_ = |
| std::make_unique<net::MockHostResolver>( |
| /*default_result=*/net::MockHostResolverBase::RuleResolver:: |
| GetLocalhostResult()); |
| host_resolver_->rules()->AddIPLiteralRuleWithDnsAliases( |
| kDestination.GetHost(), "2.2.2.2", std::move(aliases)); |
| |
| std::unique_ptr<net::URLRequestContextBuilder> url_request_context_builder = |
| CreateBuilder("DIRECT"); |
| url_request_context_builder->set_host_resolver(std::move(host_resolver_)); |
| auto url_request_context = url_request_context_builder->Build(); |
| |
| net::StaticSocketDataProvider socket_data; |
| mock_client_socket_factory_.AddSocketDataProvider(&socket_data); |
| net::SSLSocketDataProvider ssl_data(net::ASYNC, net::OK); |
| mock_client_socket_factory_.AddSSLSocketDataProvider(&ssl_data); |
| |
| ProxyResolvingClientSocketFactory proxy_resolving_socket_factory( |
| url_request_context.get()); |
| std::unique_ptr<ProxyResolvingClientSocket> socket = |
| proxy_resolving_socket_factory.CreateSocket( |
| kDestination, net::NetworkAnonymizationKey(), use_tls_); |
| |
| net::TestCompletionCallback callback; |
| int status = socket->Connect(callback.callback()); |
| EXPECT_THAT(callback.GetResult(status), net::test::IsOk()); |
| } |
| |
| } // namespace network |
