SSL in EmbeddedTestServer

net/socket/ssl_server_socket_openssl.cc

Index: net/socket/ssl_server_socket_openssl.cc
diff --git a/net/socket/ssl_server_socket_openssl.cc b/net/socket/ssl_server_socket_openssl.cc
index e8cbf5bddf4ee2a84442c781f9c937422d10fdd3..e3398a905c16f9022b45dd1ff19c4c4d332b58d3 100644
--- a/net/socket/ssl_server_socket_openssl.cc
+++ b/net/socket/ssl_server_socket_openssl.cc
@@ -29,7 +29,7 @@ scoped_ptr<SSLServerSocket> CreateSSLServerSocket(
     scoped_ptr<StreamSocket> socket,
     X509Certificate* certificate,
     crypto::RSAPrivateKey* key,
-    const SSLConfig& ssl_config) {
+    const SSLServerConfig& ssl_config) {
   crypto::EnsureOpenSSLInit();
   return scoped_ptr<SSLServerSocket>(
       new SSLServerSocketOpenSSL(socket.Pass(), certificate, key, ssl_config));
@@ -39,7 +39,7 @@ SSLServerSocketOpenSSL::SSLServerSocketOpenSSL(
     scoped_ptr<StreamSocket> transport_socket,
     scoped_refptr<X509Certificate> certificate,
     crypto::RSAPrivateKey* key,
-    const SSLConfig& ssl_config)
+    const SSLServerConfig& ssl_config)
     : transport_send_busy_(false),
       transport_recv_busy_(false),
       transport_recv_eof_(false),
@@ -614,6 +614,10 @@ int SSLServerSocketOpenSSL::Init() {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
   ScopedSSL_CTX ssl_ctx(SSL_CTX_new(SSLv23_server_method()));
+
+  if (ssl_config_.require_client_cert)
+    SSL_CTX_set_verify(ssl_ctx.get(), SSL_VERIFY_PEER, NULL);

[davidben, 2015/10/13 19:43:47]

So, I don't see any tests that currently use this. Are you sure this does what
you want? I believe SSL_VERIFY_PEER, without also using
SSL_CTX_set_cert_verify_callback will make verification failures fatal. It also
still allows no certificates without SSL_VERIFY_FAIL_IF_NO_PEER_CERT.

See
https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#C...
Although that documentation is just from me reading the source.

Cast will also eventually want to actually verify the certificate, so we'll
probably need to route in some ClientCertVerifier interface eventually. But for
now it can just blindly accept all certs.

[svaldez, 2015/10/13 20:54:43]

This is for the tests that check to see if the server requests a client cert.
The mass ETS migration hasn't migrated the tests that actually complete the
Client Cert procedures, since that deals with enough SSL internals that I
decided to put it off until the main migration has been completed.

+
   ssl_ = SSL_new(ssl_ctx.get());
   if (!ssl_)
     return ERR_UNEXPECTED;
@@ -681,7 +685,7 @@ int SSLServerSocketOpenSSL::Init() {
   SSL_set_mode(ssl_, mode.set_mask);
   SSL_clear_mode(ssl_, mode.clear_mask);
 
-  // See SSLConfig::disabled_cipher_suites for description of the suites
+  // See SSLServerConfig::disabled_cipher_suites for description of the suites
   // disabled by default. Note that !SHA256 and !SHA384 only remove HMAC-SHA256
   // and HMAC-SHA384 cipher suites, not GCM cipher suites with SHA256 or SHA384
   // as the handshake hash.