OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <string.h> | 8 #include <string.h> |
9 | 9 |
10 #include <utility> | 10 #include <utility> |
(...skipping 3272 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
3283 EXPECT_TRUE(sock_->IsConnected()); | 3283 EXPECT_TRUE(sock_->IsConnected()); |
3284 | 3284 |
3285 SSLInfo ssl_info; | 3285 SSLInfo ssl_info; |
3286 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); | 3286 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); |
3287 EXPECT_TRUE(ssl_info.client_cert_sent); | 3287 EXPECT_TRUE(ssl_info.client_cert_sent); |
3288 | 3288 |
3289 sock_->Disconnect(); | 3289 sock_->Disconnect(); |
3290 EXPECT_FALSE(sock_->IsConnected()); | 3290 EXPECT_FALSE(sock_->IsConnected()); |
3291 } | 3291 } |
3292 | 3292 |
3293 const char kExpectedPin[] = "00000000000000000000000000000000"; | |
3294 const char kBadPin[] = "11111111111111111111111111111111"; | |
3295 | |
3296 HashValueVector MakeHashValueVector(const std::string& pin) { | |
3297 HashValueVector out; | |
3298 SHA256HashValue hash; | |
3299 memcpy(hash.data, pin.data(), 32); | |
3300 out.push_back(HashValue(hash)); | |
3301 return out; | |
3302 } | |
3303 | |
3304 // Test that ssl_info.pkp_bypassed is set when a local trust anchor causes | |
3305 // pinning to be bypassed. | |
3306 TEST_F(SSLClientSocketTest, CertStatusPKPBypassed) { | |
svaldez
2016/06/07 14:12:48
Update name.
dadrian
2016/06/07 17:48:23
Done.
| |
3307 SpawnedTestServer::SSLOptions ssl_options; | |
3308 ASSERT_TRUE(StartTestServer(ssl_options)); | |
3309 scoped_refptr<X509Certificate> server_cert = | |
3310 spawned_test_server()->GetCertificate(); | |
3311 | |
3312 // The certificate needs to be trusted, but chain to a local root with | |
3313 // different public key hashes than specified in the pin. | |
3314 CertVerifyResult verify_result; | |
3315 verify_result.is_issued_by_known_root = false; | |
3316 verify_result.verified_cert = server_cert; | |
3317 verify_result.public_key_hashes = MakeHashValueVector(kBadPin); | |
3318 cert_verifier_->AddResultForCert(server_cert.get(), verify_result, OK); | |
3319 | |
3320 // Set up HPKP | |
3321 HashValueVector expected_hashes = MakeHashValueVector(kExpectedPin); | |
3322 context_.transport_security_state->AddHPKP( | |
3323 spawned_test_server()->host_port_pair().host(), | |
3324 base::Time::Now() + base::TimeDelta::FromSeconds(10000), true, | |
3325 expected_hashes, GURL()); | |
3326 | |
3327 SSLConfig ssl_config; | |
3328 int rv; | |
3329 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | |
3330 SSLInfo ssl_info; | |
3331 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); | |
3332 | |
3333 EXPECT_EQ(OK, rv); | |
3334 EXPECT_TRUE(sock_->IsConnected()); | |
3335 | |
3336 EXPECT_TRUE(ssl_info.pkp_bypassed); | |
3337 } | |
3338 | |
3339 TEST_F(SSLClientSocketTest, PKPEnforced) { | |
3340 SpawnedTestServer::SSLOptions ssl_options; | |
3341 ASSERT_TRUE(StartTestServer(ssl_options)); | |
3342 scoped_refptr<X509Certificate> server_cert = | |
3343 spawned_test_server()->GetCertificate(); | |
3344 | |
3345 // Certificate is trusted, but chains to a public root that doesn't match the | |
3346 // pin hashes. | |
3347 CertVerifyResult verify_result; | |
3348 verify_result.is_issued_by_known_root = true; | |
3349 verify_result.verified_cert = server_cert; | |
3350 verify_result.public_key_hashes = MakeHashValueVector(kBadPin); | |
3351 cert_verifier_->AddResultForCert(server_cert.get(), verify_result, OK); | |
3352 | |
3353 // Set up HPKP | |
3354 HashValueVector expected_hashes = MakeHashValueVector(kExpectedPin); | |
3355 context_.transport_security_state->AddHPKP( | |
3356 spawned_test_server()->host_port_pair().host(), | |
3357 base::Time::Now() + base::TimeDelta::FromSeconds(10000), true, | |
3358 expected_hashes, GURL()); | |
3359 | |
3360 SSLConfig ssl_config; | |
3361 int rv; | |
3362 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | |
3363 SSLInfo ssl_info; | |
3364 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); | |
3365 | |
3366 EXPECT_EQ(ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN, rv); | |
3367 EXPECT_TRUE(sock_->IsConnected()); | |
3368 | |
3369 EXPECT_FALSE(ssl_info.pkp_bypassed); | |
3370 } | |
3371 | |
3293 } // namespace net | 3372 } // namespace net |
OLD | NEW |