Support for client certs in ssl_server_socket.

net/url_request/url_request_unittest.cc

Index: net/url_request/url_request_unittest.cc
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 78e44c91c0a2e802250647daa29bee960a495899..ddd3a6292d13a38905726c19d1f4c1fd7ffe7138 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -8285,9 +8285,10 @@ TEST_F(HTTPSRequestTest, ClientAuthTest) {
 
     base::RunLoop().Run();
 
+    // Client certs is required but none is sent
     EXPECT_EQ(1, d.response_started_count());
     EXPECT_FALSE(d.received_data_before_response());
-    EXPECT_NE(0, d.bytes_received());
+    EXPECT_EQ(0, d.bytes_received());

[davidben, 2016/01/25 20:56:12]

You change the test from successfully connecting to failing to connect, so
you're stressing a bit less of the state machine now. I think we should still
have a test which authenticates with no certificate. This is a terrible idea for
servers to do, but people do do optional client auth for better or worse.

(Also if the test were intended to fail, it needs to assert on the error code
and not just check bytes_received.)

[ryanchung, 2016/01/29 23:22:14]

If we want to support optional client certificates, we need to add another flag
to SSLServerConfig... something like optional_client_cert which will do the same
thing as require_client_cert but doesn't set SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Is
this what you have in mind?

[davidben, 2016/02/04 00:40:11]

Oh hrmf, did I ask you do remove that from a previous version? Sorry! :-( Hard
to remember global requirements.

We probably do want to be able to test that we don't screw this up.
ERR_SSL_PROTOCOL_ERROR could also mean "you spoke the protocol wrong and messed
something up". Maybe an enum? That's what Go's TLS library does:
https://golang.org/pkg/crypto/tls/#ClientAuthType

enum ClientCertType {
  NO_CLIENT_CERT,
  OPTIONAL_CLIENT_CERT,
  REQUIRE_CLIENT_CERT,
};

ClientCertType client_cert;

Or a pair of booleans works too. I don't have hugely strong opinions. svaldez,
do you care? I think my default would be to go with an enum, but if anyone else
cares, go with that.

[ryanchung, 2016/02/05 01:56:13]

Ok, using a enum. I changed the test back to what it was originally.

   }
 }