Correctly handle SSL Client Authentication requests when connecting...

net/socket/ssl_client_socket_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "net/base/address_list.h"
 #include "net/base/host_resolver.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_log.h"
@@ skipping 49 matching lines @@
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
   EXPECT_TRUE(sock->IsConnected());
@@ skipping 16 matching lines @@
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
 
   EXPECT_EQ(net::ERR_CERT_DATE_INVALID, rv);
@@ skipping 18 matching lines @@
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
 
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
 
@@ skipping 22 matching lines @@
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
 
   EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv);
@@ skipping 21 matching lines @@
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   net::SSLConfig ssl_config = kDefaultSSLConfig;
   ssl_config.send_client_cert = true;
   ssl_config.client_cert = NULL;
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), ssl_config,
-          NULL));
+          transport, test_server.host_port_pair(), ssl_config, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   // Our test server accepts certificate-less connections.
   // TODO(davidben): Add a test which requires them and verify the error.
   rv = sock->Connect(&callback);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
@@ skipping 21 matching lines @@
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
   EXPECT_TRUE(sock->IsConnected());
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
@@ skipping 34 matching lines @@
 
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
   EXPECT_TRUE(sock->IsConnected());
 
   // Issue a "hanging" Read first.
   scoped_refptr<net::IOBuffer> buf(new net::IOBuffer(4096));
   rv = sock->Read(buf, 4096, &callback);
@@ skipping 33 matching lines @@
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
   memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1);
@@ skipping 29 matching lines @@
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
   memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1);
@@ skipping 49 matching lines @@
 
   net::ClientSocket* transport =
       new net::MockTCPClientSocket(addr, NULL, &data);
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(), kDefaultSSLConfig,
-          NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
 
   rv = sock->Connect(&callback);
   EXPECT_EQ(net::ERR_SSL_PROTOCOL_ERROR, rv);
 }
 
 #if defined(USE_OPENSSL)
 // TODO(rsleevi): Not implemented for Schannel or OpenSSL. Schannel is
 // controlled by the SSL client socket factory, rather than a define, so it
 // cannot be conditionally disabled here. As Schannel is only used when
 // performing client authentication, it will not be tested here.
@@ skipping 28 matching lines @@
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   net::SSLConfig ssl_config;
   for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i)
     ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair().host(),
-          ssl_config, NULL));
+          transport, test_server.host_port_pair(), ssl_config, NULL));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       log.entries(), 5, net::NetLog::TYPE_SSL_CONNECT));
 
   // NSS has special handling that maps a handshake_failure alert received
   // immediately after a client_hello to be a mismatched cipher suite error,
   // leading to ERR_SSL_VERSION_OR_CIPHER_MISMATCH. When using OpenSSL or
   // Secure Transport (OS X), the handshake_failure is bubbled up without any
   // interpretation, leading to ERR_SSL_PROTOCOL_ERROR. Either way, a failure
   // indicates that no cipher suite was negotiated with the test server.
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_TRUE(rv == net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH ||
               rv == net::ERR_SSL_PROTOCOL_ERROR);
   // The exact ordering differs between SSLClientSocketNSS (which issues an
   // extra read) and SSLClientSocketMac (which does not). Just make sure the
   // error appears somewhere in the log.
   net::ExpectLogContainsSomewhere(log.entries(), 0,
                                   net::NetLog::TYPE_SSL_HANDSHAKE_ERROR,
                                   net::NetLog::PHASE_NONE);
 
   // We cannot test sock->IsConnected(), as the NSS implementation disconnects
   // the socket when it encounters an error, whereas other implementations
   // leave it connected.
   EXPECT_TRUE(LogContainsSSLConnectEndEvent(log.entries(), -1));
 }