Added DtlsCertificate, a ref counted object owning an SSLIdentity

webrtc/p2p/base/dtlstransportchannel_unittest.cc

 /*
  *  Copyright 2011 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 44 matching lines @@
       packet_size_(0),
       use_dtls_srtp_(false),
       ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_10),
       negotiated_dtls_(false),
       received_dtls_client_hello_(false),
       received_dtls_server_hello_(false) {
   }
   void SetIceProtocol(cricket::TransportProtocol proto) {
     protocol_ = proto;
   }
-  void CreateIdentity(rtc::KeyType key_type) {
-    identity_.reset(rtc::SSLIdentity::Generate(name_, key_type));
+  void CreateCertificate(rtc::KeyType key_type) {
+    certificate_ = webrtc::DtlsCertificate::Create(
+        rtc::scoped_ptr<rtc::SSLIdentity>(
+            rtc::SSLIdentity::Generate(name_, key_type)).Pass());
   }
-  rtc::SSLIdentity* identity() { return identity_.get(); }
+  const rtc::scoped_refptr<webrtc::DtlsCertificate>& certificate() {
+    return certificate_;
+  }
   void SetupSrtp() {
-    ASSERT(identity_.get() != NULL);
+    ASSERT(certificate_);
     use_dtls_srtp_ = true;
   }
   void SetupMaxProtocolVersion(rtc::SSLProtocolVersion version) {
     ASSERT(transport_.get() == NULL);
     ssl_max_version_ = version;
   }
   void SetupChannels(int count, cricket::IceRole role) {
     transport_.reset(new cricket::DtlsTransport<cricket::FakeTransport>(
         signaling_thread_, worker_thread_, "dtls content name", NULL,
-        identity_.get()));
+        certificate_));
     transport_->SetAsync(true);
     transport_->SetIceRole(role);
     transport_->SetIceTiebreaker(
         (role == cricket::ICEROLE_CONTROLLING) ? 1 : 2);
     transport_->SignalWritableState.connect(this,
         &DtlsTestClient::OnTransportWritableState);
 
     for (int i = 0; i < count; ++i) {
       cricket::DtlsTransportChannelWrapper* channel =
           static_cast<cricket::DtlsTransportChannelWrapper*>(
@@ skipping 20 matching lines @@
         static_cast<cricket::DtlsTransportChannelWrapper*>(ch);
     return (wrapper) ?
         static_cast<cricket::FakeTransportChannel*>(wrapper->channel()) : NULL;
   }
 
   // Offer DTLS if we have an identity; pass in a remote fingerprint only if
   // both sides support DTLS.
   void Negotiate(DtlsTestClient* peer, cricket::ContentAction action,
                  ConnectionRole local_role, ConnectionRole remote_role,
                  int flags) {
-    Negotiate(identity_.get(), (identity_) ? peer->identity_.get() : NULL,
-              action, local_role, remote_role, flags);
+    if (certificate_) {
+      Negotiate(certificate_->identity(),
+                peer->certificate_ ? peer->certificate_->identity() : nullptr,
+                action, local_role, remote_role, flags);
+    } else {
+      Negotiate(nullptr, nullptr,
+                action, local_role, remote_role, flags);
+    }
   }
 
   // Allow any DTLS configuration to be specified (including invalid ones).
   void Negotiate(rtc::SSLIdentity* local_identity,
                  rtc::SSLIdentity* remote_identity,
                  cricket::ContentAction action,
                  ConnectionRole local_role,
                  ConnectionRole remote_role,
                  int flags) {
     rtc::scoped_ptr<rtc::SSLFingerprint> local_fingerprint;
@@ skipping 118 matching lines @@
     size_t sent = 0;
     do {
       // Fill the packet with a known value and a sequence number to check
       // against, and make sure that it doesn't look like DTLS.
       memset(packet.get(), sent & 0xff, size);
       packet[0] = (srtp) ? 0x80 : 0x00;
       rtc::SetBE32(packet.get() + kPacketNumOffset,
                          static_cast<uint32>(sent));
 
       // Only set the bypass flag if we've activated DTLS.
-      int flags = (identity_.get() && srtp) ? cricket::PF_SRTP_BYPASS : 0;
+      int flags = (certificate_ && srtp) ? cricket::PF_SRTP_BYPASS : 0;
       rtc::PacketOptions packet_options;
       int rv = channels_[channel]->SendPacket(
           packet.get(), size, packet_options, flags);
       ASSERT_GT(rv, 0);
       ASSERT_EQ(size, static_cast<size_t>(rv));
       ++sent;
     } while (sent < count);
   }
 
   int SendInvalidSrtpPacket(size_t channel, size_t size) {
@@ skipping 60 matching lines @@
   }
 
   void OnTransportChannelReadPacket(cricket::TransportChannel* channel,
                                     const char* data, size_t size,
                                     const rtc::PacketTime& packet_time,
                                     int flags) {
     uint32 packet_num = 0;
     ASSERT_TRUE(VerifyPacket(data, size, &packet_num));
     received_.insert(packet_num);
     // Only DTLS-SRTP packets should have the bypass flag set.
-    int expected_flags = (identity_.get() && IsRtpLeadByte(data[0])) ?
+    int expected_flags = (certificate_ && IsRtpLeadByte(data[0])) ?
         cricket::PF_SRTP_BYPASS : 0;
     ASSERT_EQ(expected_flags, flags);
   }
 
   // Hook into the raw packet stream to make sure DTLS packets are encrypted.
   void OnFakeTransportChannelReadPacket(cricket::TransportChannel* channel,
                                         const char* data, size_t size,
                                         const rtc::PacketTime& time,
                                         int flags) {
     // Flags shouldn't be set on the underlying TransportChannel packets.
@@ skipping 17 matching lines @@
         }
       }
     }
   }
 
  private:
   std::string name_;
   rtc::Thread* signaling_thread_;
   rtc::Thread* worker_thread_;
   cricket::TransportProtocol protocol_;
-  rtc::scoped_ptr<rtc::SSLIdentity> identity_;
+  rtc::scoped_refptr<webrtc::DtlsCertificate> certificate_;
   rtc::scoped_ptr<cricket::FakeTransport> transport_;
   std::vector<cricket::DtlsTransportChannelWrapper*> channels_;
   size_t packet_size_;
   std::set<int> received_;
   bool use_dtls_srtp_;
   rtc::SSLProtocolVersion ssl_max_version_;
   bool negotiated_dtls_;
   bool received_dtls_client_hello_;
   bool received_dtls_server_hello_;
 };
@@ skipping 16 matching lines @@
     channel_ct_ = static_cast<int>(channel_ct);
   }
   void SetMaxProtocolVersions(rtc::SSLProtocolVersion c1,
                               rtc::SSLProtocolVersion c2) {
     client1_.SetupMaxProtocolVersion(c1);
     client2_.SetupMaxProtocolVersion(c2);
     ssl_expected_version_ = std::min(c1, c2);
   }
   void PrepareDtls(bool c1, bool c2, rtc::KeyType key_type) {
     if (c1) {
-      client1_.CreateIdentity(key_type);
+      client1_.CreateCertificate(key_type);
     }
     if (c2) {
-      client2_.CreateIdentity(key_type);
+      client2_.CreateCertificate(key_type);
     }
     if (c1 && c2)
       use_dtls_ = true;
   }
   void PrepareDtlsSrtp(bool c1, bool c2) {
     if (!use_dtls_)
       return;
 
     if (c1)
       client1_.SetupSrtp();
@@ skipping 418 matching lines @@
   TestTransfer(0, 1000, 100, true);
   TestTransfer(1, 1000, 100, true);
 }
 
 // Test Certificates state after negotiation but before connection.
 TEST_F(DtlsTransportChannelTest, TestCertificatesBeforeConnect) {
   MAYBE_SKIP_TEST(HaveDtls);
   PrepareDtls(true, true, rtc::KT_DEFAULT);
   Negotiate();
 
-  rtc::scoped_ptr<rtc::SSLIdentity> identity1;
-  rtc::scoped_ptr<rtc::SSLIdentity> identity2;
+  rtc::scoped_refptr<webrtc::DtlsCertificate> dtlscert1;
+  rtc::scoped_refptr<webrtc::DtlsCertificate> dtlscert2;
   rtc::scoped_ptr<rtc::SSLCertificate> remote_cert1;
   rtc::scoped_ptr<rtc::SSLCertificate> remote_cert2;
 
   // After negotiation, each side has a distinct local certificate, but still no
   // remote certificate, because connection has not yet occurred.
-  ASSERT_TRUE(client1_.transport()->GetIdentity(identity1.accept()));
-  ASSERT_TRUE(client2_.transport()->GetIdentity(identity2.accept()));
-  ASSERT_NE(identity1->certificate().ToPEMString(),
-            identity2->certificate().ToPEMString());
+  ASSERT_TRUE(client1_.transport()->GetCertificate(&dtlscert1));
+  ASSERT_TRUE(client2_.transport()->GetCertificate(&dtlscert2));
+  ASSERT_NE(dtlscert1->identity()->certificate().ToPEMString(),
+            dtlscert2->identity()->certificate().ToPEMString());
   ASSERT_FALSE(
       client1_.transport()->GetRemoteCertificate(remote_cert1.accept()));
   ASSERT_FALSE(remote_cert1 != NULL);
   ASSERT_FALSE(
       client2_.transport()->GetRemoteCertificate(remote_cert2.accept()));
   ASSERT_FALSE(remote_cert2 != NULL);
 }
 
 // Test Certificates state after connection.
 TEST_F(DtlsTransportChannelTest, TestCertificatesAfterConnect) {
   MAYBE_SKIP_TEST(HaveDtls);
   PrepareDtls(true, true, rtc::KT_DEFAULT);
   ASSERT_TRUE(Connect());
 
-  rtc::scoped_ptr<rtc::SSLIdentity> identity1;
-  rtc::scoped_ptr<rtc::SSLIdentity> identity2;
+  rtc::scoped_refptr<webrtc::DtlsCertificate> dtlscert1;
+  rtc::scoped_refptr<webrtc::DtlsCertificate> dtlscert2;
   rtc::scoped_ptr<rtc::SSLCertificate> remote_cert1;
   rtc::scoped_ptr<rtc::SSLCertificate> remote_cert2;
 
   // After connection, each side has a distinct local certificate.
-  ASSERT_TRUE(client1_.transport()->GetIdentity(identity1.accept()));
-  ASSERT_TRUE(client2_.transport()->GetIdentity(identity2.accept()));
-  ASSERT_NE(identity1->certificate().ToPEMString(),
-            identity2->certificate().ToPEMString());
+  ASSERT_TRUE(client1_.transport()->GetCertificate(&dtlscert1));
+  ASSERT_TRUE(client2_.transport()->GetCertificate(&dtlscert2));
+  ASSERT_NE(dtlscert1->identity()->certificate().ToPEMString(),
+            dtlscert2->identity()->certificate().ToPEMString());
 
   // Each side's remote certificate is the other side's local certificate.
   ASSERT_TRUE(
       client1_.transport()->GetRemoteCertificate(remote_cert1.accept()));
   ASSERT_EQ(remote_cert1->ToPEMString(),
-            identity2->certificate().ToPEMString());
+            dtlscert2->identity()->certificate().ToPEMString());
   ASSERT_TRUE(
       client2_.transport()->GetRemoteCertificate(remote_cert2.accept()));
   ASSERT_EQ(remote_cert2->ToPEMString(),
-            identity1->certificate().ToPEMString());
+            dtlscert1->identity()->certificate().ToPEMString());
 }