| OLD | NEW |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
| 6 | 6 |
| 7 #include "net/base/address_list.h" | 7 #include "net/base/address_list.h" |
| 8 #include "net/base/host_resolver.h" | 8 #include "net/base/host_resolver.h" |
| 9 #include "net/base/io_buffer.h" | 9 #include "net/base/io_buffer.h" |
| 10 #include "net/base/net_log.h" | 10 #include "net/base/net_log.h" |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 65 rv = callback.WaitForResult(); | 65 rv = callback.WaitForResult(); |
| 66 EXPECT_EQ(net::OK, rv); | 66 EXPECT_EQ(net::OK, rv); |
| 67 | 67 |
| 68 scoped_ptr<net::SSLClientSocket> sock( | 68 scoped_ptr<net::SSLClientSocket> sock( |
| 69 socket_factory_->CreateSSLClientSocket( | 69 socket_factory_->CreateSSLClientSocket( |
| 70 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); | 70 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); |
| 71 | 71 |
| 72 EXPECT_FALSE(sock->IsConnected()); | 72 EXPECT_FALSE(sock->IsConnected()); |
| 73 | 73 |
| 74 rv = sock->Connect(&callback); | 74 rv = sock->Connect(&callback); |
| 75 |
| 76 net::CapturingNetLog::EntryList entries; |
| 77 log.GetEntries(&entries); |
| 75 EXPECT_TRUE(net::LogContainsBeginEvent( | 78 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 76 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 79 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 77 if (rv == net::ERR_IO_PENDING) | 80 if (rv == net::ERR_IO_PENDING) |
| 78 rv = callback.WaitForResult(); | 81 rv = callback.WaitForResult(); |
| 79 EXPECT_EQ(net::OK, rv); | 82 EXPECT_EQ(net::OK, rv); |
| 80 EXPECT_TRUE(sock->IsConnected()); | 83 EXPECT_TRUE(sock->IsConnected()); |
| 81 EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1)); | 84 log.GetEntries(&entries); |
| 85 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 82 | 86 |
| 83 sock->Disconnect(); | 87 sock->Disconnect(); |
| 84 EXPECT_FALSE(sock->IsConnected()); | 88 EXPECT_FALSE(sock->IsConnected()); |
| 85 } | 89 } |
| 86 | 90 |
| 87 TEST_F(SSLClientSocketTest, ConnectExpired) { | 91 TEST_F(SSLClientSocketTest, ConnectExpired) { |
| 88 net::TestServer::HTTPSOptions https_options( | 92 net::TestServer::HTTPSOptions https_options( |
| 89 net::TestServer::HTTPSOptions::CERT_EXPIRED); | 93 net::TestServer::HTTPSOptions::CERT_EXPIRED); |
| 90 net::TestServer test_server(https_options, FilePath()); | 94 net::TestServer test_server(https_options, FilePath()); |
| 91 ASSERT_TRUE(test_server.Start()); | 95 ASSERT_TRUE(test_server.Start()); |
| (...skipping 10 matching lines...) Expand all Loading... |
| 102 rv = callback.WaitForResult(); | 106 rv = callback.WaitForResult(); |
| 103 EXPECT_EQ(net::OK, rv); | 107 EXPECT_EQ(net::OK, rv); |
| 104 | 108 |
| 105 scoped_ptr<net::SSLClientSocket> sock( | 109 scoped_ptr<net::SSLClientSocket> sock( |
| 106 socket_factory_->CreateSSLClientSocket( | 110 socket_factory_->CreateSSLClientSocket( |
| 107 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); | 111 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); |
| 108 | 112 |
| 109 EXPECT_FALSE(sock->IsConnected()); | 113 EXPECT_FALSE(sock->IsConnected()); |
| 110 | 114 |
| 111 rv = sock->Connect(&callback); | 115 rv = sock->Connect(&callback); |
| 116 |
| 117 net::CapturingNetLog::EntryList entries; |
| 118 log.GetEntries(&entries); |
| 112 EXPECT_TRUE(net::LogContainsBeginEvent( | 119 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 113 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 120 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 114 if (rv == net::ERR_IO_PENDING) | 121 if (rv == net::ERR_IO_PENDING) |
| 115 rv = callback.WaitForResult(); | 122 rv = callback.WaitForResult(); |
| 116 | 123 |
| 117 EXPECT_EQ(net::ERR_CERT_DATE_INVALID, rv); | 124 EXPECT_EQ(net::ERR_CERT_DATE_INVALID, rv); |
| 118 | 125 |
| 119 // Rather than testing whether or not the underlying socket is connected, | 126 // Rather than testing whether or not the underlying socket is connected, |
| 120 // test that the handshake has finished. This is because it may be | 127 // test that the handshake has finished. This is because it may be |
| 121 // desirable to disconnect the socket before showing a user prompt, since | 128 // desirable to disconnect the socket before showing a user prompt, since |
| 122 // the user may take indefinitely long to respond. | 129 // the user may take indefinitely long to respond. |
| 123 EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1)); | 130 log.GetEntries(&entries); |
| 131 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 124 } | 132 } |
| 125 | 133 |
| 126 TEST_F(SSLClientSocketTest, ConnectMismatched) { | 134 TEST_F(SSLClientSocketTest, ConnectMismatched) { |
| 127 net::TestServer::HTTPSOptions https_options( | 135 net::TestServer::HTTPSOptions https_options( |
| 128 net::TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); | 136 net::TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); |
| 129 net::TestServer test_server(https_options, FilePath()); | 137 net::TestServer test_server(https_options, FilePath()); |
| 130 ASSERT_TRUE(test_server.Start()); | 138 ASSERT_TRUE(test_server.Start()); |
| 131 | 139 |
| 132 net::AddressList addr; | 140 net::AddressList addr; |
| 133 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 141 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
| 134 | 142 |
| 135 TestCompletionCallback callback; | 143 TestCompletionCallback callback; |
| 136 net::CapturingNetLog log(net::CapturingNetLog::kUnbounded); | 144 net::CapturingNetLog log(net::CapturingNetLog::kUnbounded); |
| 137 net::ClientSocket* transport = new net::TCPClientSocket( | 145 net::ClientSocket* transport = new net::TCPClientSocket( |
| 138 addr, &log, net::NetLog::Source()); | 146 addr, &log, net::NetLog::Source()); |
| 139 int rv = transport->Connect(&callback); | 147 int rv = transport->Connect(&callback); |
| 140 if (rv == net::ERR_IO_PENDING) | 148 if (rv == net::ERR_IO_PENDING) |
| 141 rv = callback.WaitForResult(); | 149 rv = callback.WaitForResult(); |
| 142 EXPECT_EQ(net::OK, rv); | 150 EXPECT_EQ(net::OK, rv); |
| 143 | 151 |
| 144 scoped_ptr<net::SSLClientSocket> sock( | 152 scoped_ptr<net::SSLClientSocket> sock( |
| 145 socket_factory_->CreateSSLClientSocket( | 153 socket_factory_->CreateSSLClientSocket( |
| 146 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); | 154 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); |
| 147 | 155 |
| 148 EXPECT_FALSE(sock->IsConnected()); | 156 EXPECT_FALSE(sock->IsConnected()); |
| 149 | 157 |
| 150 rv = sock->Connect(&callback); | 158 rv = sock->Connect(&callback); |
| 151 | 159 |
| 160 net::CapturingNetLog::EntryList entries; |
| 161 log.GetEntries(&entries); |
| 152 EXPECT_TRUE(net::LogContainsBeginEvent( | 162 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 153 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 163 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 154 if (rv == net::ERR_IO_PENDING) | 164 if (rv == net::ERR_IO_PENDING) |
| 155 rv = callback.WaitForResult(); | 165 rv = callback.WaitForResult(); |
| 156 | 166 |
| 157 EXPECT_EQ(net::ERR_CERT_COMMON_NAME_INVALID, rv); | 167 EXPECT_EQ(net::ERR_CERT_COMMON_NAME_INVALID, rv); |
| 158 | 168 |
| 159 // Rather than testing whether or not the underlying socket is connected, | 169 // Rather than testing whether or not the underlying socket is connected, |
| 160 // test that the handshake has finished. This is because it may be | 170 // test that the handshake has finished. This is because it may be |
| 161 // desirable to disconnect the socket before showing a user prompt, since | 171 // desirable to disconnect the socket before showing a user prompt, since |
| 162 // the user may take indefinitely long to respond. | 172 // the user may take indefinitely long to respond. |
| 163 EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1)); | 173 log.GetEntries(&entries); |
| 174 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 164 } | 175 } |
| 165 | 176 |
| 166 // Attempt to connect to a page which requests a client certificate. It should | 177 // Attempt to connect to a page which requests a client certificate. It should |
| 167 // return an error code on connect. | 178 // return an error code on connect. |
| 168 // Flaky: http://crbug.com/54445 | 179 // Flaky: http://crbug.com/54445 |
| 169 TEST_F(SSLClientSocketTest, FLAKY_ConnectClientAuthCertRequested) { | 180 TEST_F(SSLClientSocketTest, FLAKY_ConnectClientAuthCertRequested) { |
| 170 net::TestServer::HTTPSOptions https_options; | 181 net::TestServer::HTTPSOptions https_options; |
| 171 https_options.request_client_certificate = true; | 182 https_options.request_client_certificate = true; |
| 172 net::TestServer test_server(https_options, FilePath()); | 183 net::TestServer test_server(https_options, FilePath()); |
| 173 ASSERT_TRUE(test_server.Start()); | 184 ASSERT_TRUE(test_server.Start()); |
| (...skipping 10 matching lines...) Expand all Loading... |
| 184 rv = callback.WaitForResult(); | 195 rv = callback.WaitForResult(); |
| 185 EXPECT_EQ(net::OK, rv); | 196 EXPECT_EQ(net::OK, rv); |
| 186 | 197 |
| 187 scoped_ptr<net::SSLClientSocket> sock( | 198 scoped_ptr<net::SSLClientSocket> sock( |
| 188 socket_factory_->CreateSSLClientSocket( | 199 socket_factory_->CreateSSLClientSocket( |
| 189 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); | 200 transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL)); |
| 190 | 201 |
| 191 EXPECT_FALSE(sock->IsConnected()); | 202 EXPECT_FALSE(sock->IsConnected()); |
| 192 | 203 |
| 193 rv = sock->Connect(&callback); | 204 rv = sock->Connect(&callback); |
| 205 |
| 206 net::CapturingNetLog::EntryList entries; |
| 207 log.GetEntries(&entries); |
| 194 EXPECT_TRUE(net::LogContainsBeginEvent( | 208 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 195 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 209 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 196 if (rv == net::ERR_IO_PENDING) | 210 if (rv == net::ERR_IO_PENDING) |
| 197 rv = callback.WaitForResult(); | 211 rv = callback.WaitForResult(); |
| 198 | 212 |
| 213 log.GetEntries(&entries); |
| 214 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 199 EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv); | 215 EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv); |
| 200 EXPECT_FALSE(sock->IsConnected()); | 216 EXPECT_FALSE(sock->IsConnected()); |
| 201 } | 217 } |
| 202 | 218 |
| 203 // Connect to a server requesting optional client authentication. Send it a | 219 // Connect to a server requesting optional client authentication. Send it a |
| 204 // null certificate. It should allow the connection. | 220 // null certificate. It should allow the connection. |
| 205 // | 221 // |
| 206 // TODO(davidben): Also test providing an actual certificate. | 222 // TODO(davidben): Also test providing an actual certificate. |
| 207 TEST_F(SSLClientSocketTest, ConnectClientAuthSendNullCert) { | 223 TEST_F(SSLClientSocketTest, ConnectClientAuthSendNullCert) { |
| 208 net::TestServer::HTTPSOptions https_options; | 224 net::TestServer::HTTPSOptions https_options; |
| (...skipping 19 matching lines...) Expand all Loading... |
| 228 | 244 |
| 229 scoped_ptr<net::SSLClientSocket> sock( | 245 scoped_ptr<net::SSLClientSocket> sock( |
| 230 socket_factory_->CreateSSLClientSocket( | 246 socket_factory_->CreateSSLClientSocket( |
| 231 transport, test_server.host_port_pair(), ssl_config, NULL)); | 247 transport, test_server.host_port_pair(), ssl_config, NULL)); |
| 232 | 248 |
| 233 EXPECT_FALSE(sock->IsConnected()); | 249 EXPECT_FALSE(sock->IsConnected()); |
| 234 | 250 |
| 235 // Our test server accepts certificate-less connections. | 251 // Our test server accepts certificate-less connections. |
| 236 // TODO(davidben): Add a test which requires them and verify the error. | 252 // TODO(davidben): Add a test which requires them and verify the error. |
| 237 rv = sock->Connect(&callback); | 253 rv = sock->Connect(&callback); |
| 254 |
| 255 net::CapturingNetLog::EntryList entries; |
| 256 log.GetEntries(&entries); |
| 238 EXPECT_TRUE(net::LogContainsBeginEvent( | 257 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 239 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 258 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 240 if (rv == net::ERR_IO_PENDING) | 259 if (rv == net::ERR_IO_PENDING) |
| 241 rv = callback.WaitForResult(); | 260 rv = callback.WaitForResult(); |
| 242 | 261 |
| 243 EXPECT_EQ(net::OK, rv); | 262 EXPECT_EQ(net::OK, rv); |
| 244 EXPECT_TRUE(sock->IsConnected()); | 263 EXPECT_TRUE(sock->IsConnected()); |
| 245 EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1)); | 264 log.GetEntries(&entries); |
| 265 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 246 | 266 |
| 247 sock->Disconnect(); | 267 sock->Disconnect(); |
| 248 EXPECT_FALSE(sock->IsConnected()); | 268 EXPECT_FALSE(sock->IsConnected()); |
| 249 } | 269 } |
| 250 | 270 |
| 251 // TODO(wtc): Add unit tests for IsConnectedAndIdle: | 271 // TODO(wtc): Add unit tests for IsConnectedAndIdle: |
| 252 // - Server closes an SSL connection (with a close_notify alert message). | 272 // - Server closes an SSL connection (with a close_notify alert message). |
| 253 // - Server closes the underlying TCP connection directly. | 273 // - Server closes the underlying TCP connection directly. |
| 254 // - Server sends data unexpectedly. | 274 // - Server sends data unexpectedly. |
| 255 | 275 |
| (...skipping 290 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 546 for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i) | 566 for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i) |
| 547 ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]); | 567 ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]); |
| 548 | 568 |
| 549 scoped_ptr<net::SSLClientSocket> sock( | 569 scoped_ptr<net::SSLClientSocket> sock( |
| 550 socket_factory_->CreateSSLClientSocket( | 570 socket_factory_->CreateSSLClientSocket( |
| 551 transport, test_server.host_port_pair(), ssl_config, NULL)); | 571 transport, test_server.host_port_pair(), ssl_config, NULL)); |
| 552 | 572 |
| 553 EXPECT_FALSE(sock->IsConnected()); | 573 EXPECT_FALSE(sock->IsConnected()); |
| 554 | 574 |
| 555 rv = sock->Connect(&callback); | 575 rv = sock->Connect(&callback); |
| 576 net::CapturingNetLog::EntryList entries; |
| 577 log.GetEntries(&entries); |
| 556 EXPECT_TRUE(net::LogContainsBeginEvent( | 578 EXPECT_TRUE(net::LogContainsBeginEvent( |
| 557 log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT)); | 579 entries, 5, net::NetLog::TYPE_SSL_CONNECT)); |
| 558 | 580 |
| 559 // NSS has special handling that maps a handshake_failure alert received | 581 // NSS has special handling that maps a handshake_failure alert received |
| 560 // immediately after a client_hello to be a mismatched cipher suite error, | 582 // immediately after a client_hello to be a mismatched cipher suite error, |
| 561 // leading to ERR_SSL_VERSION_OR_CIPHER_MISMATCH. When using OpenSSL or | 583 // leading to ERR_SSL_VERSION_OR_CIPHER_MISMATCH. When using OpenSSL or |
| 562 // Secure Transport (OS X), the handshake_failure is bubbled up without any | 584 // Secure Transport (OS X), the handshake_failure is bubbled up without any |
| 563 // interpretation, leading to ERR_SSL_PROTOCOL_ERROR. Either way, a failure | 585 // interpretation, leading to ERR_SSL_PROTOCOL_ERROR. Either way, a failure |
| 564 // indicates that no cipher suite was negotiated with the test server. | 586 // indicates that no cipher suite was negotiated with the test server. |
| 565 if (rv == net::ERR_IO_PENDING) | 587 if (rv == net::ERR_IO_PENDING) |
| 566 rv = callback.WaitForResult(); | 588 rv = callback.WaitForResult(); |
| 567 EXPECT_TRUE(rv == net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH || | 589 EXPECT_TRUE(rv == net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH || |
| 568 rv == net::ERR_SSL_PROTOCOL_ERROR); | 590 rv == net::ERR_SSL_PROTOCOL_ERROR); |
| 569 // The exact ordering differs between SSLClientSocketNSS (which issues an | 591 // The exact ordering differs between SSLClientSocketNSS (which issues an |
| 570 // extra read) and SSLClientSocketMac (which does not). Just make sure the | 592 // extra read) and SSLClientSocketMac (which does not). Just make sure the |
| 571 // error appears somewhere in the log. | 593 // error appears somewhere in the log. |
| 572 net::ExpectLogContainsSomewhere(log.entries(), 0, | 594 log.GetEntries(&entries); |
| 595 net::ExpectLogContainsSomewhere(entries, 0, |
| 573 net::NetLog::TYPE_SSL_HANDSHAKE_ERROR, | 596 net::NetLog::TYPE_SSL_HANDSHAKE_ERROR, |
| 574 net::NetLog::PHASE_NONE); | 597 net::NetLog::PHASE_NONE); |
| 575 | 598 |
| 576 // We cannot test sock->IsConnected(), as the NSS implementation disconnects | 599 // We cannot test sock->IsConnected(), as the NSS implementation disconnects |
| 577 // the socket when it encounters an error, whereas other implementations | 600 // the socket when it encounters an error, whereas other implementations |
| 578 // leave it connected. | 601 // leave it connected. |
| 579 EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1)); | 602 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
| 580 } | 603 } |
| OLD | NEW |