Add support for client certificates to Secure[Server]Socket

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 415 matching lines @@
     ThrowIfError(Dart_StringToCString(filename_object, &filename));
   }
   Dart_Handle directory_object = ThrowIfError(Dart_GetNativeArgument(args, 2));
   const char* directory = NULL;
   if (Dart_IsString(directory_object)) {
     ThrowIfError(Dart_StringToCString(directory_object, &directory));
   } else if (Dart_IsNull(directory_object)) {
     directory = NULL;
   } else {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
-        "Directory argument to SecurityContext.usePrivateKey is not "
+        "Directory argument to SecurityContext.setTrustedCertificates is not "
         "a String or null"));
   }
 
   int status = SSL_CTX_load_verify_locations(context, filename, directory);
   CheckStatus(
       status, "TlsException", "SSL_CTX_load_verify_locations");
 }
 
 
 void FUNCTION_NAME(SecurityContext_TrustBuiltinRoots)(
@@ skipping 456 matching lines @@
   status = BIO_new_bio_pair(&ssl_side, 10000, &socket_side_, 10000);
   CheckStatus(status, "TlsException", "BIO_new_bio_pair");
 
   assert(context != NULL);
   ssl_ = SSL_new(context);
   SSL_set_bio(ssl_, ssl_side, ssl_side);
   SSL_set_mode(ssl_, SSL_MODE_AUTO_RETRY);  // TODO(whesse): Is this right?
   SSL_set_ex_data(ssl_, filter_ssl_index, this);
 
   if (is_server_) {
-    // Do not request a client certificate.
-    // TODO(24069): Allow server to request a client certificate, when desired.
-    SSL_set_verify(ssl_, SSL_VERIFY_NONE, NULL);
+    int certificate_mode =
+      request_client_certificate ? SSL_VERIFY_PEER : SSL_VERIFY_NONE;
+    if (require_client_certificate) {
+      certificate_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
+    }
+    SSL_set_verify(ssl_, certificate_mode, NULL);
   } else {
     SetAlpnProtocolList(protocols_handle, ssl_, NULL, false);
     status = SSL_set_tlsext_host_name(ssl_, hostname);
     CheckStatus(status, "TlsException", "Set SNI host name");
     // Sets the hostname in the certificate-checking object, so it is checked
     // against the certificate presented by the server.
     X509_VERIFY_PARAM* certificate_checking_parameters = SSL_get0_param(ssl_);
     hostname_ = strdup(hostname);
     X509_VERIFY_PARAM_set_flags(certificate_checking_parameters,
                                 X509_V_FLAG_PARTIAL_CHAIN |
@@ skipping 15 matching lines @@
     }
   } else {
     status = SSL_connect(ssl_);
     if (SSL_LOG_STATUS) Log::Print("SSL_connect status: %d\n", status);
     if (status != 1) {
       // TODO(whesse): expect a needs-data error here.  Handle other errors.
       error = SSL_get_error(ssl_, status);
       if (SSL_LOG_STATUS) Log::Print("SSL_connect error: %d\n", error);
     }
   }
-  if (is_server_) {
-    if (request_client_certificate) {
-      // TODO(24069): Handle client certificates on server side.
-      Dart_ThrowException(DartUtils::NewDartArgumentError(
-          "requestClientCertificate not implemented."));
-    }
-  } else {  // Client.
-    if (send_client_certificate) {
-      // TODO(24070): Handle client certificates on client side.
-      Dart_ThrowException(DartUtils::NewDartArgumentError(
-          "sendClientCertificate not implemented."));
-    }
-  }
   Handshake();
 }
 
 
 int printErrorCallback(const char *str, size_t len, void *ctx) {
   Log::PrintErr("%.*s\n", static_cast<int>(len), str);
   return 1;
 }
 
 void SSLFilter::Handshake() {
@@ skipping 156 matching lines @@
     } else {
       if (SSL_LOG_DATA) Log::Print(
           "WriteEncrypted  BIO_read wrote %d bytes\n", bytes_processed);
     }
   }
   return bytes_processed;
 }
 
 }  // namespace bin
 }  // namespace dart