Plumbing SSLPrivateKey

net/http/http_network_transaction_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include <math.h>  // ceil
 #include <stdarg.h>
 #include <stdint.h>
 
@@ skipping 60 matching lines @@
 #include "net/socket/socket_test_util.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/spdy/spdy_framer.h"
 #include "net/spdy/spdy_session.h"
 #include "net/spdy/spdy_session_pool.h"
 #include "net/spdy/spdy_test_util_common.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/ssl/ssl_config_service_defaults.h"
 #include "net/ssl/ssl_info.h"
+#include "net/ssl/ssl_private_key.h"
 #include "net/test/cert_test_util.h"
 #include "net/websockets/websocket_handshake_stream_base.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 #include "url/gurl.h"
 
 using base::ASCIIToUTF16;
 
 //-----------------------------------------------------------------------------
 
@@ skipping 11411 matching lines @@
 
   // Complete the SSL handshake, which should abort due to requiring a
   // client certificate.
   rv = callback.WaitForResult();
   ASSERT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv);
 
   // Indicate that no certificate should be supplied. From the perspective
   // of SSLClientCertCache, NULL is just as meaningful as a real
   // certificate, so this is the same as supply a
   // legitimate-but-unacceptable certificate.
-  rv = trans->RestartWithCertificate(NULL, callback.callback());
+  rv = trans->RestartWithCertificate(NULL, NULL, callback.callback());
   ASSERT_EQ(ERR_IO_PENDING, rv);
 
   // Ensure the certificate was added to the client auth cache before
   // allowing the connection to continue restarting.
   scoped_refptr<X509Certificate> client_cert;
+  scoped_refptr<SSLPrivateKey> client_pkey;
   ASSERT_TRUE(session->ssl_client_auth_cache()->Lookup(
-      HostPortPair("www.example.com", 443), &client_cert));
+      HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
   ASSERT_EQ(NULL, client_cert.get());
 
   // Restart the handshake. This will consume ssl_data2, which fails, and
   // then consume ssl_data3 and ssl_data4, both of which should also fail.
   // The result code is checked against what ssl_data4 should return.
   rv = callback.WaitForResult();
   ASSERT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
 
   // Ensure that the client certificate is removed from the cache on a
   // handshake failure.
   ASSERT_FALSE(session->ssl_client_auth_cache()->Lookup(
-      HostPortPair("www.example.com", 443), &client_cert));
+      HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
 }
 
 // Ensure that a client certificate is removed from the SSL client auth
 // cache when:
 //  1) No proxy is involved.
 //  2) TLS False Start is enabled.
 //  3) The initial TLS handshake requests a client certificate.
 //  4) The client supplies an invalid/unacceptable certificate.
 TEST_P(HttpNetworkTransactionTest,
        ClientAuthCertCache_Direct_FalseStart) {
@@ skipping 77 matching lines @@
 
   // Complete the SSL handshake, which should abort due to requiring a
   // client certificate.
   rv = callback.WaitForResult();
   ASSERT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv);
 
   // Indicate that no certificate should be supplied. From the perspective
   // of SSLClientCertCache, NULL is just as meaningful as a real
   // certificate, so this is the same as supply a
   // legitimate-but-unacceptable certificate.
-  rv = trans->RestartWithCertificate(NULL, callback.callback());
+  rv = trans->RestartWithCertificate(NULL, NULL, callback.callback());
   ASSERT_EQ(ERR_IO_PENDING, rv);
 
   // Ensure the certificate was added to the client auth cache before
   // allowing the connection to continue restarting.
   scoped_refptr<X509Certificate> client_cert;
+  scoped_refptr<SSLPrivateKey> client_pkey;
   ASSERT_TRUE(session->ssl_client_auth_cache()->Lookup(
-      HostPortPair("www.example.com", 443), &client_cert));
+      HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
   ASSERT_EQ(NULL, client_cert.get());
 
   // Restart the handshake. This will consume ssl_data2, which fails, and
   // then consume ssl_data3 and ssl_data4, both of which should also fail.
   // The result code is checked against what ssl_data4 should return.
   rv = callback.WaitForResult();
   ASSERT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
 
   // Ensure that the client certificate is removed from the cache on a
   // handshake failure.
   ASSERT_FALSE(session->ssl_client_auth_cache()->Lookup(
-      HostPortPair("www.example.com", 443), &client_cert));
+      HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
 }
 
 // Ensure that a client certificate is removed from the SSL client auth
 // cache when:
 //  1) An HTTPS proxy is involved.
 //  3) The HTTPS proxy requests a client certificate.
 //  4) The client supplies an invalid/unacceptable certificate for the
 //     proxy.
 // The test is repeated twice, first for connecting to an HTTPS endpoint,
 // then for connecting to an HTTP endpoint.
@@ skipping 52 matching lines @@
 
     // Complete the SSL handshake, which should abort due to requiring a
     // client certificate.
     rv = callback.WaitForResult();
     ASSERT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED, rv);
 
     // Indicate that no certificate should be supplied. From the perspective
     // of SSLClientCertCache, NULL is just as meaningful as a real
     // certificate, so this is the same as supply a
     // legitimate-but-unacceptable certificate.
-    rv = trans->RestartWithCertificate(NULL, callback.callback());
+    rv = trans->RestartWithCertificate(NULL, NULL, callback.callback());
     ASSERT_EQ(ERR_IO_PENDING, rv);
 
     // Ensure the certificate was added to the client auth cache before
     // allowing the connection to continue restarting.
     scoped_refptr<X509Certificate> client_cert;
+    scoped_refptr<SSLPrivateKey> client_pkey;
     ASSERT_TRUE(session->ssl_client_auth_cache()->Lookup(
-        HostPortPair("proxy", 70), &client_cert));
+        HostPortPair("proxy", 70), &client_cert, &client_pkey));
     ASSERT_EQ(NULL, client_cert.get());
     // Ensure the certificate was NOT cached for the endpoint. This only
     // applies to HTTPS requests, but is fine to check for HTTP requests.
     ASSERT_FALSE(session->ssl_client_auth_cache()->Lookup(
-        HostPortPair("www.example.com", 443), &client_cert));
+        HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
 
     // Restart the handshake. This will consume ssl_data2, which fails, and
     // then consume ssl_data3, which should also fail. The result code is
     // checked against what ssl_data3 should return.
     rv = callback.WaitForResult();
     ASSERT_EQ(ERR_PROXY_CONNECTION_FAILED, rv);
 
     // Now that the new handshake has failed, ensure that the client
     // certificate was removed from the client auth cache.
     ASSERT_FALSE(session->ssl_client_auth_cache()->Lookup(
-        HostPortPair("proxy", 70), &client_cert));
+        HostPortPair("proxy", 70), &client_cert, &client_pkey));
     ASSERT_FALSE(session->ssl_client_auth_cache()->Lookup(
-        HostPortPair("www.example.com", 443), &client_cert));
+        HostPortPair("www.example.com", 443), &client_cert, &client_pkey));
   }
 }
 
 TEST_P(HttpNetworkTransactionTest, UseIPConnectionPooling) {
   session_deps_.use_alternative_services = true;
   session_deps_.next_protos = SpdyNextProtos();
 
   // Set up a special HttpNetworkSession with a MockCachingHostResolver.
   session_deps_.host_resolver.reset(new MockCachingHostResolver());
   scoped_refptr<HttpNetworkSession> session(CreateSession(&session_deps_));
@@ skipping 2964 matching lines @@
   std::string response_data;
   EXPECT_EQ(OK, ReadTransaction(trans.get(), &response_data));
 
   EXPECT_EQ(CountWriteBytes(data_writes, arraysize(data_writes)),
             trans->GetTotalSentBytes());
   EXPECT_EQ(CountReadBytes(data_reads, arraysize(data_reads)),
             trans->GetTotalReceivedBytes());
 }
 
 }  // namespace net