| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
| 6 | 6 |
| 7 #include "net/base/address_list.h" | 7 #include "net/base/address_list.h" |
| 8 #include "net/base/cert_test_util.h" | 8 #include "net/base/cert_test_util.h" |
| 9 #include "net/base/host_resolver.h" | 9 #include "net/base/host_resolver.h" |
| 10 #include "net/base/io_buffer.h" | 10 #include "net/base/io_buffer.h" |
| (...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 103 EXPECT_EQ(net::OK, rv); | 103 EXPECT_EQ(net::OK, rv); |
| 104 EXPECT_TRUE(sock->IsConnected()); | 104 EXPECT_TRUE(sock->IsConnected()); |
| 105 log.GetEntries(&entries); | 105 log.GetEntries(&entries); |
| 106 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 106 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 107 | 107 |
| 108 sock->Disconnect(); | 108 sock->Disconnect(); |
| 109 EXPECT_FALSE(sock->IsConnected()); | 109 EXPECT_FALSE(sock->IsConnected()); |
| 110 } | 110 } |
| 111 | 111 |
| 112 TEST_F(SSLClientSocketTest, ConnectExpired) { | 112 TEST_F(SSLClientSocketTest, ConnectExpired) { |
| 113 net::TestServer::HTTPSOptions https_options( | 113 net::TestServer::SSLOptions ssl_options( |
| 114 net::TestServer::HTTPSOptions::CERT_EXPIRED); | 114 net::TestServer::SSLOptions::CERT_EXPIRED); |
| 115 net::TestServer test_server(https_options, FilePath()); | 115 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 116 ssl_options, |
| 117 FilePath()); |
| 116 ASSERT_TRUE(test_server.Start()); | 118 ASSERT_TRUE(test_server.Start()); |
| 117 | 119 |
| 118 cert_verifier_->set_default_result(net::ERR_CERT_DATE_INVALID); | 120 cert_verifier_->set_default_result(net::ERR_CERT_DATE_INVALID); |
| 119 | 121 |
| 120 net::AddressList addr; | 122 net::AddressList addr; |
| 121 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 123 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 122 | 124 |
| 123 net::TestCompletionCallback callback; | 125 net::TestCompletionCallback callback; |
| 124 net::CapturingNetLog log; | 126 net::CapturingNetLog log; |
| 125 net::StreamSocket* transport = new net::TCPClientSocket( | 127 net::StreamSocket* transport = new net::TCPClientSocket( |
| (...skipping 22 matching lines...) Expand all Loading... |
| 148 | 150 |
| 149 // Rather than testing whether or not the underlying socket is connected, | 151 // Rather than testing whether or not the underlying socket is connected, |
| 150 // test that the handshake has finished. This is because it may be | 152 // test that the handshake has finished. This is because it may be |
| 151 // desirable to disconnect the socket before showing a user prompt, since | 153 // desirable to disconnect the socket before showing a user prompt, since |
| 152 // the user may take indefinitely long to respond. | 154 // the user may take indefinitely long to respond. |
| 153 log.GetEntries(&entries); | 155 log.GetEntries(&entries); |
| 154 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 156 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 155 } | 157 } |
| 156 | 158 |
| 157 TEST_F(SSLClientSocketTest, ConnectMismatched) { | 159 TEST_F(SSLClientSocketTest, ConnectMismatched) { |
| 158 net::TestServer::HTTPSOptions https_options( | 160 net::TestServer::SSLOptions ssl_options( |
| 159 net::TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); | 161 net::TestServer::SSLOptions::CERT_MISMATCHED_NAME); |
| 160 net::TestServer test_server(https_options, FilePath()); | 162 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 163 ssl_options, |
| 164 FilePath()); |
| 161 ASSERT_TRUE(test_server.Start()); | 165 ASSERT_TRUE(test_server.Start()); |
| 162 | 166 |
| 163 cert_verifier_->set_default_result(net::ERR_CERT_COMMON_NAME_INVALID); | 167 cert_verifier_->set_default_result(net::ERR_CERT_COMMON_NAME_INVALID); |
| 164 | 168 |
| 165 net::AddressList addr; | 169 net::AddressList addr; |
| 166 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 170 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 167 | 171 |
| 168 net::TestCompletionCallback callback; | 172 net::TestCompletionCallback callback; |
| 169 net::CapturingNetLog log; | 173 net::CapturingNetLog log; |
| 170 net::StreamSocket* transport = new net::TCPClientSocket( | 174 net::StreamSocket* transport = new net::TCPClientSocket( |
| (...skipping 24 matching lines...) Expand all Loading... |
| 195 // test that the handshake has finished. This is because it may be | 199 // test that the handshake has finished. This is because it may be |
| 196 // desirable to disconnect the socket before showing a user prompt, since | 200 // desirable to disconnect the socket before showing a user prompt, since |
| 197 // the user may take indefinitely long to respond. | 201 // the user may take indefinitely long to respond. |
| 198 log.GetEntries(&entries); | 202 log.GetEntries(&entries); |
| 199 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 203 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 200 } | 204 } |
| 201 | 205 |
| 202 // Attempt to connect to a page which requests a client certificate. It should | 206 // Attempt to connect to a page which requests a client certificate. It should |
| 203 // return an error code on connect. | 207 // return an error code on connect. |
| 204 TEST_F(SSLClientSocketTest, ConnectClientAuthCertRequested) { | 208 TEST_F(SSLClientSocketTest, ConnectClientAuthCertRequested) { |
| 205 net::TestServer::HTTPSOptions https_options; | 209 net::TestServer::SSLOptions ssl_options; |
| 206 https_options.request_client_certificate = true; | 210 ssl_options.request_client_certificate = true; |
| 207 net::TestServer test_server(https_options, FilePath()); | 211 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 212 ssl_options, |
| 213 FilePath()); |
| 208 ASSERT_TRUE(test_server.Start()); | 214 ASSERT_TRUE(test_server.Start()); |
| 209 | 215 |
| 210 net::AddressList addr; | 216 net::AddressList addr; |
| 211 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 217 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 212 | 218 |
| 213 net::TestCompletionCallback callback; | 219 net::TestCompletionCallback callback; |
| 214 net::CapturingNetLog log; | 220 net::CapturingNetLog log; |
| 215 net::StreamSocket* transport = new net::TCPClientSocket( | 221 net::StreamSocket* transport = new net::TCPClientSocket( |
| 216 addr, &log, net::NetLog::Source()); | 222 addr, &log, net::NetLog::Source()); |
| 217 int rv = transport->Connect(callback.callback()); | 223 int rv = transport->Connect(callback.callback()); |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 255 entries, 0, net::NetLog::TYPE_SSL_CONNECT, net::NetLog::PHASE_END); | 261 entries, 0, net::NetLog::TYPE_SSL_CONNECT, net::NetLog::PHASE_END); |
| 256 EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv); | 262 EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv); |
| 257 EXPECT_FALSE(sock->IsConnected()); | 263 EXPECT_FALSE(sock->IsConnected()); |
| 258 } | 264 } |
| 259 | 265 |
| 260 // Connect to a server requesting optional client authentication. Send it a | 266 // Connect to a server requesting optional client authentication. Send it a |
| 261 // null certificate. It should allow the connection. | 267 // null certificate. It should allow the connection. |
| 262 // | 268 // |
| 263 // TODO(davidben): Also test providing an actual certificate. | 269 // TODO(davidben): Also test providing an actual certificate. |
| 264 TEST_F(SSLClientSocketTest, ConnectClientAuthSendNullCert) { | 270 TEST_F(SSLClientSocketTest, ConnectClientAuthSendNullCert) { |
| 265 net::TestServer::HTTPSOptions https_options; | 271 net::TestServer::SSLOptions ssl_options; |
| 266 https_options.request_client_certificate = true; | 272 ssl_options.request_client_certificate = true; |
| 267 net::TestServer test_server(https_options, FilePath()); | 273 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 274 ssl_options, |
| 275 FilePath()); |
| 268 ASSERT_TRUE(test_server.Start()); | 276 ASSERT_TRUE(test_server.Start()); |
| 269 | 277 |
| 270 net::AddressList addr; | 278 net::AddressList addr; |
| 271 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 279 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 272 | 280 |
| 273 net::TestCompletionCallback callback; | 281 net::TestCompletionCallback callback; |
| 274 net::CapturingNetLog log; | 282 net::CapturingNetLog log; |
| 275 net::StreamSocket* transport = new net::TCPClientSocket( | 283 net::StreamSocket* transport = new net::TCPClientSocket( |
| 276 addr, &log, net::NetLog::Source()); | 284 addr, &log, net::NetLog::Source()); |
| 277 int rv = transport->Connect(callback.callback()); | 285 int rv = transport->Connect(callback.callback()); |
| (...skipping 382 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 660 // performing client authentication, it will not be tested here. | 668 // performing client authentication, it will not be tested here. |
| 661 TEST_F(SSLClientSocketTest, CipherSuiteDisables) { | 669 TEST_F(SSLClientSocketTest, CipherSuiteDisables) { |
| 662 // Rather than exhaustively disabling every RC4 ciphersuite defined at | 670 // Rather than exhaustively disabling every RC4 ciphersuite defined at |
| 663 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml, | 671 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml, |
| 664 // only disabling those cipher suites that the test server actually | 672 // only disabling those cipher suites that the test server actually |
| 665 // implements. | 673 // implements. |
| 666 const uint16 kCiphersToDisable[] = { | 674 const uint16 kCiphersToDisable[] = { |
| 667 0x0005, // TLS_RSA_WITH_RC4_128_SHA | 675 0x0005, // TLS_RSA_WITH_RC4_128_SHA |
| 668 }; | 676 }; |
| 669 | 677 |
| 670 net::TestServer::HTTPSOptions https_options; | 678 net::TestServer::SSLOptions ssl_options; |
| 671 // Enable only RC4 on the test server. | 679 // Enable only RC4 on the test server. |
| 672 https_options.bulk_ciphers = | 680 ssl_options.bulk_ciphers = |
| 673 net::TestServer::HTTPSOptions::BULK_CIPHER_RC4; | 681 net::TestServer::SSLOptions::BULK_CIPHER_RC4; |
| 674 net::TestServer test_server(https_options, FilePath()); | 682 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 683 ssl_options, |
| 684 FilePath()); |
| 675 ASSERT_TRUE(test_server.Start()); | 685 ASSERT_TRUE(test_server.Start()); |
| 676 | 686 |
| 677 net::AddressList addr; | 687 net::AddressList addr; |
| 678 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 688 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 679 | 689 |
| 680 net::TestCompletionCallback callback; | 690 net::TestCompletionCallback callback; |
| 681 net::CapturingNetLog log; | 691 net::CapturingNetLog log; |
| 682 net::StreamSocket* transport = new net::TCPClientSocket( | 692 net::StreamSocket* transport = new net::TCPClientSocket( |
| 683 addr, &log, net::NetLog::Source()); | 693 addr, &log, net::NetLog::Source()); |
| 684 int rv = transport->Connect(callback.callback()); | 694 int rv = transport->Connect(callback.callback()); |
| (...skipping 177 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 862 cert_verifier_->AddResultForCert(certs[0], verify_result, net::OK); | 872 cert_verifier_->AddResultForCert(certs[0], verify_result, net::OK); |
| 863 | 873 |
| 864 // Load and install the root for the validated chain. | 874 // Load and install the root for the validated chain. |
| 865 scoped_refptr<net::X509Certificate> root_cert = | 875 scoped_refptr<net::X509Certificate> root_cert = |
| 866 net::ImportCertFromFile(net::GetTestCertsDirectory(), | 876 net::ImportCertFromFile(net::GetTestCertsDirectory(), |
| 867 "redundant-validated-chain-root.pem"); | 877 "redundant-validated-chain-root.pem"); |
| 868 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), root_cert); | 878 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), root_cert); |
| 869 net::ScopedTestRoot scoped_root(root_cert); | 879 net::ScopedTestRoot scoped_root(root_cert); |
| 870 | 880 |
| 871 // Set up a test server with CERT_CHAIN_WRONG_ROOT. | 881 // Set up a test server with CERT_CHAIN_WRONG_ROOT. |
| 872 net::TestServer::HTTPSOptions https_options( | 882 net::TestServer::SSLOptions ssl_options( |
| 873 net::TestServer::HTTPSOptions::CERT_CHAIN_WRONG_ROOT); | 883 net::TestServer::SSLOptions::CERT_CHAIN_WRONG_ROOT); |
| 874 net::TestServer test_server(https_options, | 884 net::TestServer test_server(net::TestServer::TYPE_HTTPS, |
| 885 ssl_options, |
| 875 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 886 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
| 876 ASSERT_TRUE(test_server.Start()); | 887 ASSERT_TRUE(test_server.Start()); |
| 877 | 888 |
| 878 net::AddressList addr; | 889 net::AddressList addr; |
| 879 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 890 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 880 | 891 |
| 881 net::TestCompletionCallback callback; | 892 net::TestCompletionCallback callback; |
| 882 net::CapturingNetLog log; | 893 net::CapturingNetLog log; |
| 883 net::StreamSocket* transport = new net::TCPClientSocket( | 894 net::StreamSocket* transport = new net::TCPClientSocket( |
| 884 addr, &log, net::NetLog::Source()); | 895 addr, &log, net::NetLog::Source()); |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 917 ssl_info.cert->os_cert_handle(), certs[0]->os_cert_handle())); | 928 ssl_info.cert->os_cert_handle(), certs[0]->os_cert_handle())); |
| 918 EXPECT_TRUE(net::X509Certificate::IsSameOSCert( | 929 EXPECT_TRUE(net::X509Certificate::IsSameOSCert( |
| 919 intermediates[0], certs[1]->os_cert_handle())); | 930 intermediates[0], certs[1]->os_cert_handle())); |
| 920 EXPECT_TRUE(net::X509Certificate::IsSameOSCert( | 931 EXPECT_TRUE(net::X509Certificate::IsSameOSCert( |
| 921 intermediates[1], certs[2]->os_cert_handle())); | 932 intermediates[1], certs[2]->os_cert_handle())); |
| 922 | 933 |
| 923 sock->Disconnect(); | 934 sock->Disconnect(); |
| 924 EXPECT_FALSE(sock->IsConnected()); | 935 EXPECT_FALSE(sock->IsConnected()); |
| 925 } | 936 } |
| 926 | 937 |
| OLD | NEW |