Implement Token Binding negotiation TLS extension

net/socket/ssl_client_socket_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
@@ skipping 2566 matching lines @@
   ssl_options.key_exchanges = SpawnedTestServer::SSLOptions::KEY_EXCHANGE_RSA;
   ASSERT_TRUE(StartTestServer(ssl_options));
 
   SSLConfig config;
   config.require_ecdhe = true;
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(config, &rv));
   EXPECT_EQ(ERR_SSL_VERSION_OR_CIPHER_MISMATCH, rv);
 }
 
+TEST_F(SSLClientSocketChannelIDTest, TokenBindingEnabled) {
+  SpawnedTestServer::SSLOptions ssl_options;
+  ssl_options.supported_token_binding_params.push_back(TB_PARAM_ECDSAP256);
+  ssl_options.disable_channel_id = true;
+  ASSERT_TRUE(StartTestServer(ssl_options));
+
+  EnableChannelID();

[davidben, 2015/11/04 00:40:36]

Is there actually any need to EnableChannelID in these tests? The two systems
are pretty disconnected at this layer I think.

[nharper, 2015/11/04 02:28:04]

They were from when I needed a ChannelIDService (and the layers were not so
disconnected), but you are correct that it is no longer needed. (Likewise, it no
longer needs to be an SSLClientSocketChannelIDTest, just an
SSLClientSocketTest.)

+  SSLConfig ssl_config;
+  ssl_config.token_binding_enabled = true;
+
+  int rv;
+  ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
+  EXPECT_EQ(OK, rv);
+  SSLInfo info;
+  EXPECT_TRUE(sock_->GetSSLInfo(&info));
+  EXPECT_TRUE(info.token_binding_negotiated);
+  EXPECT_EQ(TB_PARAM_ECDSAP256, info.token_binding_key_param);
+}
+
+TEST_F(SSLClientSocketChannelIDTest, TokenBindingFailsWithEmsDisabled) {
+  SpawnedTestServer::SSLOptions ssl_options;
+  ssl_options.supported_token_binding_params.push_back(TB_PARAM_ECDSAP256);
+  ssl_options.disable_extended_master_secret = true;
+  ssl_options.disable_channel_id = true;
+  ASSERT_TRUE(StartTestServer(ssl_options));
+
+  EnableChannelID();
+  SSLConfig ssl_config;
+  ssl_config.token_binding_enabled = true;
+
+  int rv;
+  ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
+  EXPECT_EQ(ERR_SSL_PROTOCOL_ERROR, rv);
+}
+
+TEST_F(SSLClientSocketChannelIDTest, TokenBindingEnabledWithoutServerSupport) {
+  SpawnedTestServer::SSLOptions ssl_options;
+  ASSERT_TRUE(StartTestServer(ssl_options));
+
+  EnableChannelID();
+  SSLConfig ssl_config;
+  ssl_config.token_binding_enabled = true;
+
+  int rv;
+  ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
+  EXPECT_EQ(OK, rv);
+  SSLInfo info;
+  EXPECT_TRUE(sock_->GetSSLInfo(&info));
+  EXPECT_FALSE(info.token_binding_negotiated);
+}
+
 // In tests requiring NPN, client_config.alpn_protos and
 // client_config.npn_protos both need to be set when using NSS, otherwise NPN is
 // disabled due to quirks of the implementation.
 
 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabled) {
   // False Start requires NPN/ALPN, ECDHE, and an AEAD.
   SpawnedTestServer::SSLOptions server_options;
   server_options.key_exchanges =
       SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA;
   server_options.bulk_ciphers =
@@ skipping 418 matching lines @@
   int rv;
   ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv));
   EXPECT_EQ(OK, rv);
 
   std::string proto;
   EXPECT_EQ(SSLClientSocket::kNextProtoUnsupported,
             sock_->GetNextProto(&proto));
 }
 
 }  // namespace net