Route OCSP stapling through CertVerifier.

net/cert/multi_threaded_cert_verifier_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_threaded_cert_verifier.h"
 
 #include "base/bind.h"
 #include "base/debug/leak_annotations.h"
 #include "base/files/file_path.h"
 #include "base/format_macros.h"
@@ skipping 23 matching lines @@
 
 class MockCertVerifyProc : public CertVerifyProc {
  public:
   MockCertVerifyProc() {}
 
  private:
   ~MockCertVerifyProc() override {}
 
   // CertVerifyProc implementation
   bool SupportsAdditionalTrustAnchors() const override { return false; }
+  bool SupportsOCSPStapling() const override { return false; }
 
   int VerifyInternal(X509Certificate* cert,
                      const std::string& hostname,
+                     const std::string& ocsp_response,
                      int flags,
                      CRLSet* crl_set,
                      const CertificateList& additional_trust_anchors,
                      CertVerifyResult* verify_result) override {
     verify_result->Reset();
     verify_result->verified_cert = cert;
     verify_result->cert_status = CERT_STATUS_COMMON_NAME_INVALID;
     return ERR_CERT_COMMON_NAME_INVALID;
   }
 };
@@ skipping 21 matching lines @@
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert.get());
 
   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   CertVerifier::RequestHandle request_handle;
 
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   error = callback.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(1u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(0u, verifier_.inflight_joins());
   ASSERT_EQ(1u, verifier_.GetCacheSize());
 
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   // Synchronous completion.
   ASSERT_NE(ERR_IO_PENDING, error);
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_TRUE(request_handle == NULL);
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(1u, verifier_.cache_hits());
   ASSERT_EQ(0u, verifier_.inflight_joins());
   ASSERT_EQ(1u, verifier_.GetCacheSize());
 }
 
@@ skipping 25 matching lines @@
   intermediates.push_back(intermediate_cert2->os_cert_handle());
   scoped_refptr<X509Certificate> cert_chain2 =
       X509Certificate::CreateFromHandle(server_cert->os_cert_handle(),
                                         intermediates);
 
   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   CertVerifier::RequestHandle request_handle;
 
-  error = verifier_.Verify(cert_chain1.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(cert_chain1.get(), "www.example.com", std::string(),
+                           0, NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   error = callback.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(1u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(0u, verifier_.inflight_joins());
   ASSERT_EQ(1u, verifier_.GetCacheSize());
 
-  error = verifier_.Verify(cert_chain2.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(cert_chain2.get(), "www.example.com", std::string(),
+                           0, NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   error = callback.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(0u, verifier_.inflight_joins());
   ASSERT_EQ(2u, verifier_.GetCacheSize());
 }
 
 // Tests an inflight join.
 TEST_F(MultiThreadedCertVerifierTest, InflightJoin) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert.get());
 
   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   CertVerifier::RequestHandle request_handle;
   CertVerifyResult verify_result2;
   TestCompletionCallback callback2;
   CertVerifier::RequestHandle request_handle2;
 
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result2,
-                           callback2.callback(),
-                           &request_handle2,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result2, callback2.callback(),
+                           &request_handle2, BoundNetLog());
   EXPECT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle2 != NULL);
   error = callback.WaitForResult();
   EXPECT_TRUE(IsCertificateError(error));
   error = callback2.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(1u, verifier_.inflight_joins());
 }
 
 // Tests that the callback of a canceled request is never made.
 TEST_F(MultiThreadedCertVerifierTest, CancelRequest) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert.get());
 
   int error;
   CertVerifyResult verify_result;
   CertVerifier::RequestHandle request_handle;
 
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           base::Bind(&FailTest),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, base::Bind(&FailTest),
+                           &request_handle, BoundNetLog());
   ASSERT_EQ(ERR_IO_PENDING, error);
   ASSERT_TRUE(request_handle != NULL);
   verifier_.CancelRequest(request_handle);
 
   // Issue a few more requests to the worker pool and wait for their
   // completion, so that the task of the canceled request (which runs on a
   // worker thread) is likely to complete by the end of this test.
   TestCompletionCallback callback;
   for (int i = 0; i < 5; ++i) {
-    error = verifier_.Verify(test_cert.get(),
-                             "www2.example.com",
-                             0,
-                             NULL,
-                             &verify_result,
-                             callback.callback(),
-                             &request_handle,
-                             BoundNetLog());
+    error = verifier_.Verify(test_cert.get(), "www2.example.com", std::string(),
+                             0, NULL, &verify_result, callback.callback(),
+                             &request_handle, BoundNetLog());
     ASSERT_EQ(ERR_IO_PENDING, error);
     EXPECT_TRUE(request_handle);
     error = callback.WaitForResult();
     verifier_.ClearCache();
   }
 }
 
 // Tests that a canceled request is not leaked.
 TEST_F(MultiThreadedCertVerifierTest, CancelRequestThenQuit) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert.get());
 
   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   CertVerifier::RequestHandle request_handle;
 
   {
     // Because shutdown intentionally doesn't join worker threads, a
     // CertVerifyWorker may be leaked if the main thread shuts down before the
     // worker thread.
     ANNOTATE_SCOPED_MEMORY_LEAK;
-    error = verifier_.Verify(test_cert.get(), "www.example.com", 0, NULL,
-                             &verify_result, callback.callback(),
+    error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(),
+                             0, NULL, &verify_result, callback.callback(),
                              &request_handle, BoundNetLog());
   }
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   verifier_.CancelRequest(request_handle);
   // Destroy |verifier| by going out of scope.
 }
 
 TEST_F(MultiThreadedCertVerifierTest, RequestParamsComparators) {
   SHA1HashValue a_key;
@@ skipping 11 matching lines @@
     // Keys to test
     MultiThreadedCertVerifier::RequestParams key1;
     MultiThreadedCertVerifier::RequestParams key2;
 
     // Expectation:
     // -1 means key1 is less than key2
     //  0 means key1 equals key2
     //  1 means key1 is greater than key2
     int expected_result;
   } tests[] = {
-    {  // Test for basic equivalence.
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      0,
-    },
-    {  // Test that different certificates but with the same CA and for
+      {
+       // Test for basic equivalence.
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       0,
+      },
+      {
+       // Test that different certificates but with the same CA and for
        // the same host are different validation keys.
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      MultiThreadedCertVerifier::RequestParams(z_key, a_key, "www.example.test",
-                                               0, test_list),
-      -1,
-    },
-    {  // Test that the same EE certificate for the same host, but with
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           z_key, a_key, "www.example.test", std::string(), 0, test_list),
+       -1,
+      },
+      {
+       // Test that the same EE certificate for the same host, but with
        // different chains are different validation keys.
-      MultiThreadedCertVerifier::RequestParams(a_key, z_key, "www.example.test",
-                                               0, test_list),
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      1,
-    },
-    {  // The same certificate, with the same chain, but for different
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, z_key, "www.example.test", std::string(), 0, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       1,
+      },
+      {
+       // The same certificate, with the same chain, but for different
        // hosts are different validation keys.
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key,
-                                               "www1.example.test", 0,
-                                               test_list),
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key,
-                                               "www2.example.test", 0,
-                                               test_list),
-      -1,
-    },
-    {  // The same certificate, chain, and host, but with different flags
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www1.example.test", std::string(), 0, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www2.example.test", std::string(), 0, test_list),
+       -1,
+      },
+      {
+       // The same certificate, chain, and host, but with different flags
        // are different validation keys.
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               CertVerifier::VERIFY_EV_CERT,
-                                               test_list),
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      1,
-    },
-    {  // Different additional_trust_anchors.
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, empty_list),
-      MultiThreadedCertVerifier::RequestParams(a_key, a_key, "www.example.test",
-                                               0, test_list),
-      -1,
-    },
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(),
+           CertVerifier::VERIFY_EV_CERT, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       1,
+      },
+      {
+       // Different additional_trust_anchors.
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, empty_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       -1,
+      },
+      {
+       // Different OCSP responses.
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", "ocsp response", 0, test_list),
+       MultiThreadedCertVerifier::RequestParams(
+           a_key, a_key, "www.example.test", std::string(), 0, test_list),
+       -1,
+      },
   };
   for (size_t i = 0; i < arraysize(tests); ++i) {
     SCOPED_TRACE(base::StringPrintf("Test[%" PRIuS "]", i));
 
     const MultiThreadedCertVerifier::RequestParams& key1 = tests[i].key1;
     const MultiThreadedCertVerifier::RequestParams& key2 = tests[i].key2;
 
     switch (tests[i].expected_result) {
       case -1:
         EXPECT_TRUE(key1 < key2);
@@ skipping 26 matching lines @@
   cert_list.push_back(test_cert);
 
   // Check that Verify() asks the |trust_provider| for the current list of
   // additional trust anchors.
   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   CertVerifier::RequestHandle request_handle;
   EXPECT_CALL(trust_provider, GetAdditionalTrustAnchors())
       .WillOnce(ReturnRef(empty_cert_list));
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   Mock::VerifyAndClearExpectations(&trust_provider);
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   error = callback.WaitForResult();
   EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error);
   ASSERT_EQ(1u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
 
   // The next Verify() uses the cached result.
   EXPECT_CALL(trust_provider, GetAdditionalTrustAnchors())
       .WillOnce(ReturnRef(empty_cert_list));
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   Mock::VerifyAndClearExpectations(&trust_provider);
   EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error);
   EXPECT_FALSE(request_handle);
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(1u, verifier_.cache_hits());
 
   // Another Verify() for the same certificate but with a different list of
   // trust anchors will not reuse the cache.
   EXPECT_CALL(trust_provider, GetAdditionalTrustAnchors())
       .WillOnce(ReturnRef(cert_list));
-  error = verifier_.Verify(test_cert.get(),
-                           "www.example.com",
-                           0,
-                           NULL,
-                           &verify_result,
-                           callback.callback(),
-                           &request_handle,
-                           BoundNetLog());
+  error = verifier_.Verify(test_cert.get(), "www.example.com", std::string(), 0,
+                           NULL, &verify_result, callback.callback(),
+                           &request_handle, BoundNetLog());
   Mock::VerifyAndClearExpectations(&trust_provider);
   ASSERT_EQ(ERR_IO_PENDING, error);
   EXPECT_TRUE(request_handle);
   error = callback.WaitForResult();
   EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error);
   ASSERT_EQ(3u, verifier_.requests());
   ASSERT_EQ(1u, verifier_.cache_hits());
 }
 
 }  // namespace net