Plumbing SSLPrivateKey

net/socket/ssl_client_socket_openssl_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <openssl/bio.h>
@@ skipping 15 matching lines @@
 #include "net/base/test_data_directory.h"
 #include "net/cert/mock_cert_verifier.h"
 #include "net/cert/test_root_certs.h"
 #include "net/dns/host_resolver.h"
 #include "net/http/transport_security_state.h"
 #include "net/log/net_log.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/socket_test_util.h"
 #include "net/socket/tcp_client_socket.h"
-#include "net/ssl/openssl_client_key_store.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_config_service.h"
+#include "net/ssl/ssl_platform_key.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
 namespace net {
 
 namespace {
 
 // These client auth tests are currently dependent on OpenSSL's struct X509.
@@ skipping 31 matching lines @@
 
 class SSLClientSocketOpenSSLClientAuthTest : public PlatformTest {
  public:
   SSLClientSocketOpenSSLClientAuthTest()
       : socket_factory_(ClientSocketFactory::GetDefaultFactory()),
         cert_verifier_(new MockCertVerifier),
         transport_security_state_(new TransportSecurityState) {
     cert_verifier_->set_default_result(OK);
     context_.cert_verifier = cert_verifier_.get();
     context_.transport_security_state = transport_security_state_.get();
-    key_store_ = OpenSSLClientKeyStore::GetInstance();
   }
 
-  ~SSLClientSocketOpenSSLClientAuthTest() override { key_store_->Flush(); }
+  ~SSLClientSocketOpenSSLClientAuthTest() override {}
 
  protected:
   scoped_ptr<SSLClientSocket> CreateSSLClientSocket(
       scoped_ptr<StreamSocket> transport_socket,
       const HostPortPair& host_and_port,
       const SSLConfig& ssl_config) {
     scoped_ptr<ClientSocketHandle> connection(new ClientSocketHandle);
     connection->SetSocket(transport_socket.Pass());
     return socket_factory_->CreateSSLClientSocket(connection.Pass(),
                                                   host_and_port,
@@ skipping 20 matching lines @@
         addr_, &log_, NetLog::Source()));
     int rv = callback_.GetResult(
         transport_->Connect(callback_.callback()));
     if (rv != OK) {
       LOG(ERROR) << "Could not connect to SpawnedTestServer";
       return false;
     }
     return true;
   }
 
-  // Record a certificate's private key to ensure it can be used
-  // by the OpenSSL-based SSLClientSocket implementation.
-  // |ssl_config| provides a client certificate.
-  // |private_key| must be an EVP_PKEY for the corresponding private key.
-  // Returns true on success, false on failure.
-  bool RecordPrivateKey(SSLConfig& ssl_config,
-                        EVP_PKEY* private_key) {
-    return key_store_->RecordClientCertPrivateKey(
-        ssl_config.client_cert.get(), private_key);
-  }
-
   // Create an SSLClientSocket object and use it to connect to a test
   // server, then wait for connection results. This must be called after
   // a succesful ConnectToTestServer() call.
   // |ssl_config| the SSL configuration to use.
   // |result| will retrieve the ::Connect() result value.
   // Returns true on succes, false otherwise. Success means that the socket
   // could be created and its Connect() was called, not that the connection
   // itself was a success.
   bool CreateAndConnectSSLClientSocket(const SSLConfig& ssl_config,
                                        int* result) {
@@ skipping 16 matching lines @@
   bool CheckSSLClientSocketSentCert() {
     SSLInfo ssl_info;
     sock_->GetSSLInfo(&ssl_info);
     return ssl_info.client_cert_sent;
   }
 
   ClientSocketFactory* socket_factory_;
   scoped_ptr<MockCertVerifier> cert_verifier_;
   scoped_ptr<TransportSecurityState> transport_security_state_;
   SSLClientSocketContext context_;
-  OpenSSLClientKeyStore* key_store_;
   scoped_ptr<SpawnedTestServer> test_server_;
   AddressList addr_;
   TestCompletionCallback callback_;
   NetLog log_;
   scoped_ptr<StreamSocket> transport_;
   scoped_ptr<SSLClientSocket> sock_;
 };
 
 // Connect to a server requesting client authentication, do not send
 // any client certificates. It should refuse the connection.
@@ skipping 19 matching lines @@
   ssl_options.request_client_certificate = true;
   ssl_options.client_authorities.push_back(
       GetTestClientCertsDirectory().AppendASCII("client_1_ca.pem"));
 
   ASSERT_TRUE(ConnectToTestServer(ssl_options));
 
   base::FilePath certs_dir = GetTestCertsDirectory();
   SSLConfig ssl_config;
   ssl_config.send_client_cert = true;
   ssl_config.client_cert = NULL;
+  ssl_config.client_private_key = NULL;
 
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
 
   EXPECT_EQ(OK, rv);
   EXPECT_TRUE(sock_->IsConnected());
 }
 
 // Connect to a server requesting client authentication. Send it a
 // matching certificate. It should allow the connection.
 TEST_F(SSLClientSocketOpenSSLClientAuthTest, SendGoodCert) {
   SpawnedTestServer::SSLOptions ssl_options;
   ssl_options.request_client_certificate = true;
   ssl_options.client_authorities.push_back(
       GetTestClientCertsDirectory().AppendASCII("client_1_ca.pem"));
 
   ASSERT_TRUE(ConnectToTestServer(ssl_options));
 
   base::FilePath certs_dir = GetTestCertsDirectory();
   SSLConfig ssl_config;
   ssl_config.send_client_cert = true;
   ssl_config.client_cert = ImportCertFromFile(certs_dir, "client_1.pem");
 
   // This is required to ensure that signing works with the client
   // certificate's private key.
   crypto::ScopedEVP_PKEY client_private_key;
   ASSERT_TRUE(LoadPrivateKeyOpenSSL(certs_dir.AppendASCII("client_1.key"),
                                     &client_private_key));
-  EXPECT_TRUE(RecordPrivateKey(ssl_config, client_private_key.get()));
-
+  ssl_config.client_private_key =
+      net::WrapOpenSSLPrivateKey(client_private_key.Pass());

[davidben, 2015/10/13 20:32:16]

Ooh. We could basically promote these tests to run on everything in a follow-up
CL having a EVP_PKEY -> SSLPrivateKey bridge available in test code everywhere.

[svaldez, 2015/10/14 15:06:18]

Acknowledged.

   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
 
   EXPECT_EQ(OK, rv);
   EXPECT_TRUE(sock_->IsConnected());
 
   EXPECT_TRUE(CheckSSLClientSocketSentCert());
 
   sock_->Disconnect();
   EXPECT_FALSE(sock_->IsConnected());
 }
 #endif  // defined(USE_OPENSSL_CERTS)
 
 }  // namespace
 }  // namespace net