OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
6 | 6 |
7 #include "base/callback_helpers.h" | 7 #include "base/callback_helpers.h" |
8 #include "base/memory/ref_counted.h" | 8 #include "base/memory/ref_counted.h" |
9 #include "base/run_loop.h" | 9 #include "base/run_loop.h" |
10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
11 #include "net/base/address_list.h" | 11 #include "net/base/address_list.h" |
12 #include "net/base/io_buffer.h" | 12 #include "net/base/io_buffer.h" |
13 #include "net/base/net_errors.h" | 13 #include "net/base/net_errors.h" |
14 #include "net/base/test_completion_callback.h" | 14 #include "net/base/test_completion_callback.h" |
15 #include "net/base/test_data_directory.h" | 15 #include "net/base/test_data_directory.h" |
16 #include "net/cert/asn1_util.h" | 16 #include "net/cert/asn1_util.h" |
17 #include "net/cert/ct_verifier.h" | 17 #include "net/cert/ct_verifier.h" |
18 #include "net/cert/mock_cert_verifier.h" | 18 #include "net/cert/mock_cert_verifier.h" |
19 #include "net/cert/test_root_certs.h" | 19 #include "net/cert/test_root_certs.h" |
20 #include "net/dns/host_resolver.h" | 20 #include "net/dns/host_resolver.h" |
21 #include "net/http/transport_security_state.h" | 21 #include "net/http/transport_security_state.h" |
| 22 #include "net/log/captured_net_log_entry.h" |
22 #include "net/log/net_log.h" | 23 #include "net/log/net_log.h" |
23 #include "net/log/net_log_unittest.h" | 24 #include "net/log/net_log_unittest.h" |
| 25 #include "net/log/test_net_log.h" |
24 #include "net/socket/client_socket_factory.h" | 26 #include "net/socket/client_socket_factory.h" |
25 #include "net/socket/client_socket_handle.h" | 27 #include "net/socket/client_socket_handle.h" |
26 #include "net/socket/socket_test_util.h" | 28 #include "net/socket/socket_test_util.h" |
27 #include "net/socket/tcp_client_socket.h" | 29 #include "net/socket/tcp_client_socket.h" |
28 #include "net/ssl/channel_id_service.h" | 30 #include "net/ssl/channel_id_service.h" |
29 #include "net/ssl/default_channel_id_store.h" | 31 #include "net/ssl/default_channel_id_store.h" |
30 #include "net/ssl/ssl_cert_request_info.h" | 32 #include "net/ssl/ssl_cert_request_info.h" |
31 #include "net/ssl/ssl_config_service.h" | 33 #include "net/ssl/ssl_config_service.h" |
32 #include "net/ssl/ssl_connection_status_flags.h" | 34 #include "net/ssl/ssl_connection_status_flags.h" |
33 #include "net/ssl/ssl_info.h" | 35 #include "net/ssl/ssl_info.h" |
(...skipping 928 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
962 | 964 |
963 //----------------------------------------------------------------------------- | 965 //----------------------------------------------------------------------------- |
964 | 966 |
965 // LogContainsSSLConnectEndEvent returns true if the given index in the given | 967 // LogContainsSSLConnectEndEvent returns true if the given index in the given |
966 // log is an SSL connect end event. The NSS sockets will cork in an attempt to | 968 // log is an SSL connect end event. The NSS sockets will cork in an attempt to |
967 // merge the first application data record with the Finished message when false | 969 // merge the first application data record with the Finished message when false |
968 // starting. However, in order to avoid the server timing out the handshake, | 970 // starting. However, in order to avoid the server timing out the handshake, |
969 // they'll give up waiting for application data and send the Finished after a | 971 // they'll give up waiting for application data and send the Finished after a |
970 // timeout. This means that an SSL connect end event may appear as a socket | 972 // timeout. This means that an SSL connect end event may appear as a socket |
971 // write. | 973 // write. |
972 static bool LogContainsSSLConnectEndEvent( | 974 static bool LogContainsSSLConnectEndEvent(const CapturedNetLogEntry::List& log, |
973 const TestNetLog::CapturedEntryList& log, | 975 int i) { |
974 int i) { | |
975 return LogContainsEndEvent(log, i, NetLog::TYPE_SSL_CONNECT) || | 976 return LogContainsEndEvent(log, i, NetLog::TYPE_SSL_CONNECT) || |
976 LogContainsEvent( | 977 LogContainsEvent( |
977 log, i, NetLog::TYPE_SOCKET_BYTES_SENT, NetLog::PHASE_NONE); | 978 log, i, NetLog::TYPE_SOCKET_BYTES_SENT, NetLog::PHASE_NONE); |
978 } | 979 } |
979 | 980 |
980 bool SupportsAESGCM() { | 981 bool SupportsAESGCM() { |
981 #if defined(USE_OPENSSL) | 982 #if defined(USE_OPENSSL) |
982 return true; | 983 return true; |
983 #else | 984 #else |
984 crypto::EnsureNSSInit(); | 985 crypto::EnsureNSSInit(); |
(...skipping 22 matching lines...) Expand all Loading... |
1007 rv = callback.WaitForResult(); | 1008 rv = callback.WaitForResult(); |
1008 EXPECT_EQ(OK, rv); | 1009 EXPECT_EQ(OK, rv); |
1009 | 1010 |
1010 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 1011 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
1011 transport.Pass(), test_server.host_port_pair(), SSLConfig())); | 1012 transport.Pass(), test_server.host_port_pair(), SSLConfig())); |
1012 | 1013 |
1013 EXPECT_FALSE(sock->IsConnected()); | 1014 EXPECT_FALSE(sock->IsConnected()); |
1014 | 1015 |
1015 rv = sock->Connect(callback.callback()); | 1016 rv = sock->Connect(callback.callback()); |
1016 | 1017 |
1017 TestNetLog::CapturedEntryList entries; | 1018 CapturedNetLogEntry::List entries; |
1018 log.GetEntries(&entries); | 1019 log.GetEntries(&entries); |
1019 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 1020 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
1020 if (rv == ERR_IO_PENDING) | 1021 if (rv == ERR_IO_PENDING) |
1021 rv = callback.WaitForResult(); | 1022 rv = callback.WaitForResult(); |
1022 EXPECT_EQ(OK, rv); | 1023 EXPECT_EQ(OK, rv); |
1023 EXPECT_TRUE(sock->IsConnected()); | 1024 EXPECT_TRUE(sock->IsConnected()); |
1024 log.GetEntries(&entries); | 1025 log.GetEntries(&entries); |
1025 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 1026 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
1026 | 1027 |
1027 sock->Disconnect(); | 1028 sock->Disconnect(); |
(...skipping 21 matching lines...) Expand all Loading... |
1049 rv = callback.WaitForResult(); | 1050 rv = callback.WaitForResult(); |
1050 EXPECT_EQ(OK, rv); | 1051 EXPECT_EQ(OK, rv); |
1051 | 1052 |
1052 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 1053 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
1053 transport.Pass(), test_server.host_port_pair(), SSLConfig())); | 1054 transport.Pass(), test_server.host_port_pair(), SSLConfig())); |
1054 | 1055 |
1055 EXPECT_FALSE(sock->IsConnected()); | 1056 EXPECT_FALSE(sock->IsConnected()); |
1056 | 1057 |
1057 rv = sock->Connect(callback.callback()); | 1058 rv = sock->Connect(callback.callback()); |
1058 | 1059 |
1059 TestNetLog::CapturedEntryList entries; | 1060 CapturedNetLogEntry::List entries; |
1060 log.GetEntries(&entries); | 1061 log.GetEntries(&entries); |
1061 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 1062 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
1062 if (rv == ERR_IO_PENDING) | 1063 if (rv == ERR_IO_PENDING) |
1063 rv = callback.WaitForResult(); | 1064 rv = callback.WaitForResult(); |
1064 | 1065 |
1065 EXPECT_EQ(ERR_CERT_DATE_INVALID, rv); | 1066 EXPECT_EQ(ERR_CERT_DATE_INVALID, rv); |
1066 | 1067 |
1067 // Rather than testing whether or not the underlying socket is connected, | 1068 // Rather than testing whether or not the underlying socket is connected, |
1068 // test that the handshake has finished. This is because it may be | 1069 // test that the handshake has finished. This is because it may be |
1069 // desirable to disconnect the socket before showing a user prompt, since | 1070 // desirable to disconnect the socket before showing a user prompt, since |
(...skipping 23 matching lines...) Expand all Loading... |
1093 rv = callback.WaitForResult(); | 1094 rv = callback.WaitForResult(); |
1094 EXPECT_EQ(OK, rv); | 1095 EXPECT_EQ(OK, rv); |
1095 | 1096 |
1096 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 1097 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
1097 transport.Pass(), test_server.host_port_pair(), SSLConfig())); | 1098 transport.Pass(), test_server.host_port_pair(), SSLConfig())); |
1098 | 1099 |
1099 EXPECT_FALSE(sock->IsConnected()); | 1100 EXPECT_FALSE(sock->IsConnected()); |
1100 | 1101 |
1101 rv = sock->Connect(callback.callback()); | 1102 rv = sock->Connect(callback.callback()); |
1102 | 1103 |
1103 TestNetLog::CapturedEntryList entries; | 1104 CapturedNetLogEntry::List entries; |
1104 log.GetEntries(&entries); | 1105 log.GetEntries(&entries); |
1105 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 1106 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
1106 if (rv == ERR_IO_PENDING) | 1107 if (rv == ERR_IO_PENDING) |
1107 rv = callback.WaitForResult(); | 1108 rv = callback.WaitForResult(); |
1108 | 1109 |
1109 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, rv); | 1110 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, rv); |
1110 | 1111 |
1111 // Rather than testing whether or not the underlying socket is connected, | 1112 // Rather than testing whether or not the underlying socket is connected, |
1112 // test that the handshake has finished. This is because it may be | 1113 // test that the handshake has finished. This is because it may be |
1113 // desirable to disconnect the socket before showing a user prompt, since | 1114 // desirable to disconnect the socket before showing a user prompt, since |
(...skipping 23 matching lines...) Expand all Loading... |
1137 rv = callback.WaitForResult(); | 1138 rv = callback.WaitForResult(); |
1138 EXPECT_EQ(OK, rv); | 1139 EXPECT_EQ(OK, rv); |
1139 | 1140 |
1140 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 1141 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
1141 transport.Pass(), test_server.host_port_pair(), SSLConfig())); | 1142 transport.Pass(), test_server.host_port_pair(), SSLConfig())); |
1142 | 1143 |
1143 EXPECT_FALSE(sock->IsConnected()); | 1144 EXPECT_FALSE(sock->IsConnected()); |
1144 | 1145 |
1145 rv = sock->Connect(callback.callback()); | 1146 rv = sock->Connect(callback.callback()); |
1146 | 1147 |
1147 TestNetLog::CapturedEntryList entries; | 1148 CapturedNetLogEntry::List entries; |
1148 log.GetEntries(&entries); | 1149 log.GetEntries(&entries); |
1149 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 1150 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
1150 if (rv == ERR_IO_PENDING) | 1151 if (rv == ERR_IO_PENDING) |
1151 rv = callback.WaitForResult(); | 1152 rv = callback.WaitForResult(); |
1152 | 1153 |
1153 log.GetEntries(&entries); | 1154 log.GetEntries(&entries); |
1154 // Because we prematurely kill the handshake at CertificateRequest, | 1155 // Because we prematurely kill the handshake at CertificateRequest, |
1155 // the server may still send data (notably the ServerHelloDone) | 1156 // the server may still send data (notably the ServerHelloDone) |
1156 // after the error is returned. As a result, the SSL_CONNECT may not | 1157 // after the error is returned. As a result, the SSL_CONNECT may not |
1157 // be the last entry. See http://crbug.com/54445. We use | 1158 // be the last entry. See http://crbug.com/54445. We use |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1202 | 1203 |
1203 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 1204 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
1204 transport.Pass(), test_server.host_port_pair(), ssl_config)); | 1205 transport.Pass(), test_server.host_port_pair(), ssl_config)); |
1205 | 1206 |
1206 EXPECT_FALSE(sock->IsConnected()); | 1207 EXPECT_FALSE(sock->IsConnected()); |
1207 | 1208 |
1208 // Our test server accepts certificate-less connections. | 1209 // Our test server accepts certificate-less connections. |
1209 // TODO(davidben): Add a test which requires them and verify the error. | 1210 // TODO(davidben): Add a test which requires them and verify the error. |
1210 rv = sock->Connect(callback.callback()); | 1211 rv = sock->Connect(callback.callback()); |
1211 | 1212 |
1212 TestNetLog::CapturedEntryList entries; | 1213 CapturedNetLogEntry::List entries; |
1213 log.GetEntries(&entries); | 1214 log.GetEntries(&entries); |
1214 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 1215 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
1215 if (rv == ERR_IO_PENDING) | 1216 if (rv == ERR_IO_PENDING) |
1216 rv = callback.WaitForResult(); | 1217 rv = callback.WaitForResult(); |
1217 | 1218 |
1218 EXPECT_EQ(OK, rv); | 1219 EXPECT_EQ(OK, rv); |
1219 EXPECT_TRUE(sock->IsConnected()); | 1220 EXPECT_TRUE(sock->IsConnected()); |
1220 log.GetEntries(&entries); | 1221 log.GetEntries(&entries); |
1221 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 1222 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
1222 | 1223 |
(...skipping 906 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2129 memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1); | 2130 memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1); |
2130 | 2131 |
2131 rv = sock->Write( | 2132 rv = sock->Write( |
2132 request_buffer.get(), arraysize(request_text) - 1, callback.callback()); | 2133 request_buffer.get(), arraysize(request_text) - 1, callback.callback()); |
2133 EXPECT_TRUE(rv >= 0 || rv == ERR_IO_PENDING); | 2134 EXPECT_TRUE(rv >= 0 || rv == ERR_IO_PENDING); |
2134 | 2135 |
2135 if (rv == ERR_IO_PENDING) | 2136 if (rv == ERR_IO_PENDING) |
2136 rv = callback.WaitForResult(); | 2137 rv = callback.WaitForResult(); |
2137 EXPECT_EQ(static_cast<int>(arraysize(request_text) - 1), rv); | 2138 EXPECT_EQ(static_cast<int>(arraysize(request_text) - 1), rv); |
2138 | 2139 |
2139 TestNetLog::CapturedEntryList entries; | 2140 CapturedNetLogEntry::List entries; |
2140 log.GetEntries(&entries); | 2141 log.GetEntries(&entries); |
2141 size_t last_index = ExpectLogContainsSomewhereAfter( | 2142 size_t last_index = ExpectLogContainsSomewhereAfter( |
2142 entries, 5, NetLog::TYPE_SSL_SOCKET_BYTES_SENT, NetLog::PHASE_NONE); | 2143 entries, 5, NetLog::TYPE_SSL_SOCKET_BYTES_SENT, NetLog::PHASE_NONE); |
2143 | 2144 |
2144 scoped_refptr<IOBuffer> buf(new IOBuffer(4096)); | 2145 scoped_refptr<IOBuffer> buf(new IOBuffer(4096)); |
2145 for (;;) { | 2146 for (;;) { |
2146 rv = sock->Read(buf.get(), 4096, callback.callback()); | 2147 rv = sock->Read(buf.get(), 4096, callback.callback()); |
2147 EXPECT_TRUE(rv >= 0 || rv == ERR_IO_PENDING); | 2148 EXPECT_TRUE(rv >= 0 || rv == ERR_IO_PENDING); |
2148 | 2149 |
2149 if (rv == ERR_IO_PENDING) | 2150 if (rv == ERR_IO_PENDING) |
(...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2241 SSLConfig ssl_config; | 2242 SSLConfig ssl_config; |
2242 for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i) | 2243 for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i) |
2243 ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]); | 2244 ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]); |
2244 | 2245 |
2245 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 2246 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
2246 transport.Pass(), test_server.host_port_pair(), ssl_config)); | 2247 transport.Pass(), test_server.host_port_pair(), ssl_config)); |
2247 | 2248 |
2248 EXPECT_FALSE(sock->IsConnected()); | 2249 EXPECT_FALSE(sock->IsConnected()); |
2249 | 2250 |
2250 rv = sock->Connect(callback.callback()); | 2251 rv = sock->Connect(callback.callback()); |
2251 TestNetLog::CapturedEntryList entries; | 2252 CapturedNetLogEntry::List entries; |
2252 log.GetEntries(&entries); | 2253 log.GetEntries(&entries); |
2253 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 2254 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
2254 | 2255 |
2255 if (rv == ERR_IO_PENDING) | 2256 if (rv == ERR_IO_PENDING) |
2256 rv = callback.WaitForResult(); | 2257 rv = callback.WaitForResult(); |
2257 EXPECT_EQ(ERR_SSL_VERSION_OR_CIPHER_MISMATCH, rv); | 2258 EXPECT_EQ(ERR_SSL_VERSION_OR_CIPHER_MISMATCH, rv); |
2258 // The exact ordering depends no whether an extra read is issued. Just check | 2259 // The exact ordering depends no whether an extra read is issued. Just check |
2259 // the error is somewhere in the log. | 2260 // the error is somewhere in the log. |
2260 log.GetEntries(&entries); | 2261 log.GetEntries(&entries); |
2261 ExpectLogContainsSomewhere( | 2262 ExpectLogContainsSomewhere( |
(...skipping 273 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2535 int rv = transport->Connect(callback.callback()); | 2536 int rv = transport->Connect(callback.callback()); |
2536 if (rv == ERR_IO_PENDING) | 2537 if (rv == ERR_IO_PENDING) |
2537 rv = callback.WaitForResult(); | 2538 rv = callback.WaitForResult(); |
2538 EXPECT_EQ(OK, rv); | 2539 EXPECT_EQ(OK, rv); |
2539 | 2540 |
2540 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | 2541 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( |
2541 transport.Pass(), test_server.host_port_pair(), SSLConfig())); | 2542 transport.Pass(), test_server.host_port_pair(), SSLConfig())); |
2542 EXPECT_FALSE(sock->IsConnected()); | 2543 EXPECT_FALSE(sock->IsConnected()); |
2543 rv = sock->Connect(callback.callback()); | 2544 rv = sock->Connect(callback.callback()); |
2544 | 2545 |
2545 TestNetLog::CapturedEntryList entries; | 2546 CapturedNetLogEntry::List entries; |
2546 log.GetEntries(&entries); | 2547 log.GetEntries(&entries); |
2547 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | 2548 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); |
2548 if (rv == ERR_IO_PENDING) | 2549 if (rv == ERR_IO_PENDING) |
2549 rv = callback.WaitForResult(); | 2550 rv = callback.WaitForResult(); |
2550 | 2551 |
2551 EXPECT_EQ(OK, rv); | 2552 EXPECT_EQ(OK, rv); |
2552 EXPECT_TRUE(sock->IsConnected()); | 2553 EXPECT_TRUE(sock->IsConnected()); |
2553 log.GetEntries(&entries); | 2554 log.GetEntries(&entries); |
2554 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | 2555 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); |
2555 | 2556 |
(...skipping 875 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3431 ssl_config.channel_id_enabled = true; | 3432 ssl_config.channel_id_enabled = true; |
3432 | 3433 |
3433 int rv; | 3434 int rv; |
3434 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | 3435 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
3435 | 3436 |
3436 EXPECT_EQ(ERR_UNEXPECTED, rv); | 3437 EXPECT_EQ(ERR_UNEXPECTED, rv); |
3437 EXPECT_FALSE(sock_->IsConnected()); | 3438 EXPECT_FALSE(sock_->IsConnected()); |
3438 } | 3439 } |
3439 | 3440 |
3440 } // namespace net | 3441 } // namespace net |
OLD | NEW |