SSL client authentication support for secure proxy in WebSocket

SSL client authentication support for secure proxy in WebSocket

BUG=83950
TEST=net_unittests


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=105769

[Takashi Toyoshima, 2011-10-14 13:41:27]

Could you review this change for M16 branch?

[Takashi Toyoshima, 2011-10-16 23:59:04]

+rch

Coud you verify that this change works for your use case?

[ukai, 2011-10-17 01:48:56]

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream.cc
File net/socket_stream/socket_stream.cc (right):

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1100: if (ssl_config_.send_client_cert)
we might need to have 2 SSLConfig?
 server_ssl_config_ and proxy_ssl_config_

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1107:
reinterpret_cast<SSLClientSocket*>(socket_.get());
static_cast ?

[Takashi Toyoshima, 2011-10-17 02:50:05]

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream.cc
File net/socket_stream/socket_stream.cc (right):

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1100: if (ssl_config_.send_client_cert)
When we support client authentication for secure server via secure proxy, it is
true.
Now, I just support authentication only for secure proxy because of two reasons.

One is that this change is temporal one, and will be replaced by refactoring
which integrate socket_stream to http_network_transaction.

Another reason is that we don't have a chance to cache server's
cert_request_info because WebSockets always go on background, and we could not
pop up certification choosing dialog for user decision.

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1107:
reinterpret_cast<SSLClientSocket*>(socket_.get());
Right.
I fixed it and a same wrong cast in DidEstablishSSL.

[ukai, 2011-10-17 04:18:08]

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream.cc
File net/socket_stream/socket_stream.cc (right):

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1100: if (ssl_config_.send_client_cert)
On 2011/10/17 02:50:05, toyoshim wrote:
> When we support client authentication for secure server via secure proxy, it
is
> true.
> Now, I just support authentication only for secure proxy because of two
reasons.
> 
> One is that this change is temporal one, and will be replaced by refactoring
> which integrate socket_stream to http_network_transaction.
> 
> Another reason is that we don't have a chance to cache server's
> cert_request_info because WebSockets always go on background, and we could not
> pop up certification choosing dialog for user decision.

even without client authentication, can we use the same SSLConfig for wss over
secure proxy?

[Takashi Toyoshima, 2011-10-17 04:42:30]

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream.cc
File net/socket_stream/socket_stream.cc (right):

http://codereview.chromium.org/8276031/diff/1/net/socket_stream/socket_stream...
net/socket_stream/socket_stream.cc:1100: if (ssl_config_.send_client_cert)
Oops!
Sorry, now I see what was wrong
I fix it.

[ukai, 2011-10-17 04:44:18]

lgtm

[commit-bot: I haz the power, 2011-10-17 04:46:23]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/toyoshim@chromium.org/8276031/8002

[commit-bot: I haz the power, 2011-10-17 05:57:37]

Change committed as 105769