Make ssl_client_socket_unittest use a local server

net/base/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/ssl_client_socket_nss.h"
 
 #include <nspr.h>
 #include <nss.h>
 #include <secerr.h>
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
 // until NSS 3.12.2 comes out and we update to it.
 #define Lock FOO_NSS_Lock
 #include <ssl.h>
 #include <sslerr.h>
 #include <pk11pub.h>
 #undef Lock
 
 #include "base/logging.h"
 #include "base/nss_init.h"
 #include "base/string_util.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_info.h"
 
 static const int kRecvBufferSize = 4096;
 
-namespace {
-
-// NSS calls this if an incoming certificate is invalid.
-SECStatus OwnBadCertHandler(void* arg, PRFileDesc* socket) {
-  PRErrorCode err = PR_GetError();
-  LOG(INFO) << "server certificate is invalid; NSS error code " << err;
-  // Return SECSuccess to override the problem,
-  // or SECFailure to let the original function fail
-  // Chromium wants it to fail here, and may retry it later.
-  LOG(WARNING) << "TODO(dkegel): return SECFailure here";
-  return SECSuccess;
-}
-
-}  // anonymous namespace
-
 namespace net {
 
 // State machines are easier to debug if you log state transitions.
 // Enable these if you want to see what's going on.
 #if 1
 #define EnterFunction(x)
 #define LeaveFunction(x)
 #define GotoState(s) next_state_ = s
 #define LogData(s, len)
 #else
@@ skipping 21 matching lines @@
       return ERR_CERT_COMMON_NAME_INVALID;
     case SEC_ERROR_EXPIRED_CERTIFICATE:
       return ERR_CERT_DATE_INVALID;
     case SEC_ERROR_BAD_SIGNATURE:
       return ERR_CERT_INVALID;
     case SSL_ERROR_REVOKED_CERT_ALERT:
     case SEC_ERROR_REVOKED_CERTIFICATE:
     case SEC_ERROR_REVOKED_KEY:
       return ERR_CERT_REVOKED;
     case SEC_ERROR_UNKNOWN_ISSUER:
+    case SEC_ERROR_UNTRUSTED_CERT:
+    case SEC_ERROR_UNTRUSTED_ISSUER:
       return ERR_CERT_AUTHORITY_INVALID;
 
     default: {
       if (IS_SSL_ERROR(err)) {
         LOG(WARNING) << "Unknown SSL error " << err <<
             " mapped to net::ERR_SSL_PROTOCOL_ERROR";
         return ERR_SSL_PROTOCOL_ERROR;
       }
       if (IS_SEC_ERROR(err)) {
         // TODO(port): Probably not the best mapping
@@ skipping 20 matching lines @@
       buffer_recv_callback_(this, &SSLClientSocketNSS::BufferRecvComplete),
       transport_send_busy_(false),
       transport_recv_busy_(false),
       io_callback_(this, &SSLClientSocketNSS::OnIOComplete),
       transport_(transport_socket),
       hostname_(hostname),
       ssl_config_(ssl_config),
       user_callback_(NULL),
       user_buf_(NULL),
       user_buf_len_(0),
-      server_cert_status_(0),
+      server_cert_error_(0),
       completed_handshake_(false),
       next_state_(STATE_NONE),
       nss_fd_(NULL),
       nss_bufs_(NULL) {
   EnterFunction("");
 }
 
 SSLClientSocketNSS::~SSLClientSocketNSS() {
   EnterFunction("");
   Disconnect();
@@ skipping 102 matching lines @@
     ok = SSL_GetCipherSuiteInfo(channel_info.cipherSuite,
                                 &cipher_info, sizeof(cipher_info));
     if (ok == SECSuccess) {
       ssl_info->security_bits = cipher_info.effectiveKeyBits;
     } else {
       ssl_info->security_bits = -1;
       LOG(DFATAL) << "SSL_GetCipherSuiteInfo returned " << PR_GetError()
                   << " for cipherSuite " << channel_info.cipherSuite;
     }
   }
-  ssl_info->cert_status = server_cert_status_;
-  // TODO(port): implement X509Certificate so we can set the cert field!
-  // CERTCertificate *nssCert = SSL_PeerCertificate(nss_fd_);
+  if (server_cert_error_ != net::OK)
+    ssl_info->SetCertError(server_cert_error_);
+  X509Certificate::OSCertHandle nss_cert = SSL_PeerCertificate(nss_fd_);
+  if (nss_cert)
+    ssl_info->cert = X509Certificate::CreateFromHandle(nss_cert,
+                         X509Certificate::SOURCE_FROM_NETWORK);
   LeaveFunction("");
 }
 
 void SSLClientSocketNSS::DoCallback(int rv) {
   EnterFunction(rv);
   DCHECK(rv != ERR_IO_PENDING);
   DCHECK(user_callback_);
 
   // since Run may result in Read being called, clear user_callback_ up front.
   CompletionCallback* c = user_callback_;
@@ skipping 136 matching lines @@
   LeaveFunction("");
   return rv;
 }
 
 int SSLClientSocketNSS::DoConnect() {
   EnterFunction("");
   GotoState(STATE_CONNECT_COMPLETE);
   return transport_->Connect(&io_callback_);
 }
 
+// static
+// NSS calls this if an incoming certificate is invalid.
+SECStatus SSLClientSocketNSS::OwnBadCertHandler(void* arg, PRFileDesc* socket) {
+  SSLClientSocketNSS* that = reinterpret_cast<SSLClientSocketNSS*>(arg);
+  PRErrorCode prerr = PR_GetError();
+  that->server_cert_error_ = NetErrorFromNSPRError(prerr);
+  LOG(INFO) << "server certificate is invalid; NSS error code " << prerr
+            << ", net error " << that->server_cert_error_;
+  // Return SECSuccess to override the problem.
+  // Chromium wants it to succeed here, and may abort the connection later.
+  return SECSuccess;
+}
+
 int SSLClientSocketNSS::DoConnectComplete(int result) {
   EnterFunction(result);
   if (result < 0)
     return result;
 
   if (Init() != OK) {
     NOTREACHED() << "Couldn't initialize nss";
   }
 
   // Transport connected, now hook it up to nss
@@ skipping 58 matching lines @@
   if (rv != SECSuccess)
      LOG(INFO) << "SSL_ENABLE_SESSION_TICKETS failed.  Old system nss?";
 #else
   #error "You need to install NSS-3.12 or later to build chromium"
 #endif
 
   rv = SSL_OptionSet(nss_fd_, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE);
   if (rv != SECSuccess)
      return ERR_UNEXPECTED;
 
-  rv = SSL_BadCertHook(nss_fd_, OwnBadCertHandler, NULL);
+  rv = SSL_BadCertHook(nss_fd_, OwnBadCertHandler, this);
   if (rv != SECSuccess)
      return ERR_UNEXPECTED;
 
   // Tell SSL the hostname we're trying to connect to.
   SSL_SetURL(nss_fd_, hostname_.c_str());
 
   // Tell SSL we're a client; needed if not letting NSPR do socket I/O
   SSL_ResetHandshake(nss_fd_, 0);
   GotoState(STATE_HANDSHAKE_READ);
   // Return OK so DoLoop tries handshaking
   LeaveFunction("");
   return OK;
 }
 
 int SSLClientSocketNSS::DoHandshakeRead() {
   EnterFunction("");
   int net_error;
   int rv = SSL_ForceHandshake(nss_fd_);
 
   if (rv == SECSuccess) {
-    net_error = OK;
+    net_error = server_cert_error_;
     // there's a callback for this, too
     completed_handshake_ = true;
-    // Indicate we're ready to handle I/O.  Badly named?
-    GotoState(STATE_NONE);
+    // Done!
   } else {
     PRErrorCode prerr = PR_GetError();
     net_error = NetErrorFromNSPRError(prerr);
 
     // If not done, stay in this state
     if (net_error == ERR_IO_PENDING) {
       GotoState(STATE_HANDSHAKE_READ);
     } else {
-      server_cert_status_ = MapNetErrorToCertStatus(net_error);
+      server_cert_error_ = net_error;
       LOG(ERROR) << "handshake failed; NSS error code " << prerr
-                 << ", net_error " << net_error << ", server_cert_status "
-                 << server_cert_status_;
+                 << ", net_error " << net_error;
     }
   }
 
   LeaveFunction("");
   return net_error;
 }
 
 int SSLClientSocketNSS::DoPayloadRead() {
   EnterFunction(user_buf_len_);
   int rv = PR_Read(nss_fd_, user_buf_, user_buf_len_);
@@ skipping 28 matching lines @@
     GotoState(STATE_PAYLOAD_WRITE);
     return ERR_IO_PENDING;
   }
   user_buf_ = NULL;
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net