Add OCSPVerifyResult for tracking stapled OCSP responses cross-platform.

net/test/spawned_test_server/base_test_server.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/test/spawned_test_server/base_test_server.h"
 
 #include <stdint.h>
 #include <limits>
 #include <string>
 #include <utility>
@@ skipping 105 matching lines @@
 
 std::unique_ptr<base::ListValue> GetTokenBindingParams(
     std::vector<int> params) {
   std::unique_ptr<base::ListValue> values(new base::ListValue());
   for (int param : params) {
     values->AppendInteger(param);
   }
   return values;
 }
 
+std::string OCSPStatusToString(
+    const BaseTestServer::SSLOptions::OCSPStatus& ocsp_status) {
+  switch (ocsp_status) {
+    case BaseTestServer::SSLOptions::OCSP_OK:
+      return "ok";
+    case BaseTestServer::SSLOptions::OCSP_REVOKED:
+      return "revoked";
+    case BaseTestServer::SSLOptions::OCSP_INVALID_RESPONSE:
+      return "invalid";
+    case BaseTestServer::SSLOptions::OCSP_UNAUTHORIZED:
+      return "unauthorized";
+    case BaseTestServer::SSLOptions::OCSP_UNKNOWN:
+      return "unknown";
+    case BaseTestServer::SSLOptions::OCSP_TRY_LATER:
+      return "later";
+    case BaseTestServer::SSLOptions::OCSP_INVALID_RESPONSE_DATA:
+      return "invalid_data";
+    case BaseTestServer::SSLOptions::OCSP_MISMATCHED_SERIAL:
+      return "mismatched_serial";
+  }
+  NOTREACHED();
+  return "";

[Ryan Sleevi, 2016/07/18 20:08:08]

std::string, not ""

[dadrian, 2016/07/18 22:23:32]

Done.

+}
+
+std::string OCSPDateToString(
+    const BaseTestServer::SSLOptions::OCSPDate& ocsp_date) {
+  switch (ocsp_date) {
+    case BaseTestServer::SSLOptions::OCSP_DATE_VALID:
+      return "valid";
+    case BaseTestServer::SSLOptions::OCSP_DATE_OLD:
+      return "old";
+    case BaseTestServer::SSLOptions::OCSP_DATE_EARLY:
+      return "early";
+    case BaseTestServer::SSLOptions::OCSP_DATE_LONG:
+      return "long";
+  }
+  NOTREACHED();
+  return "";

[Ryan Sleevi, 2016/07/18 20:08:08]

std::string() not ""

[dadrian, 2016/07/18 22:23:32]

Done.

+}
+
 }  // namespace
 
 BaseTestServer::SSLOptions::SSLOptions()
     : server_certificate(CERT_OK),
       ocsp_status(OCSP_OK),
+      ocsp_date(OCSP_DATE_VALID),
+      ocsp_produced(OCSP_PRODUCED_VALID),
       cert_serial(0),
       request_client_certificate(false),
       key_exchanges(SSLOptions::KEY_EXCHANGE_ANY),
       bulk_ciphers(SSLOptions::BULK_CIPHER_ANY),
       record_resume(false),
       tls_intolerant(TLS_INTOLERANT_NONE),
       tls_intolerance_type(TLS_INTOLERANCE_ALERT),
       fallback_scsv_enabled(false),
       staple_ocsp_response(false),
       ocsp_server_unavailable(false),
       alert_after_handshake(false),
       disable_channel_id(false),
       disable_extended_master_secret(false) {}
 
 BaseTestServer::SSLOptions::SSLOptions(
     BaseTestServer::SSLOptions::ServerCertificate cert)
     : server_certificate(cert),
       ocsp_status(OCSP_OK),
+      ocsp_date(OCSP_DATE_VALID),
+      ocsp_produced(OCSP_PRODUCED_VALID),
       cert_serial(0),
       request_client_certificate(false),
       key_exchanges(SSLOptions::KEY_EXCHANGE_ANY),
       bulk_ciphers(SSLOptions::BULK_CIPHER_ANY),
       record_resume(false),
       tls_intolerant(TLS_INTOLERANT_NONE),
       tls_intolerance_type(TLS_INTOLERANCE_ALERT),
       fallback_scsv_enabled(false),
       staple_ocsp_response(false),
       ocsp_server_unavailable(false),
@@ skipping 25 matching lines @@
     default:
       NOTREACHED();
   }
   return base::FilePath();
 }
 
 std::string BaseTestServer::SSLOptions::GetOCSPArgument() const {
   if (server_certificate != CERT_AUTO)
     return std::string();
 
-  switch (ocsp_status) {
-    case OCSP_OK:
-      return "ok";
-    case OCSP_REVOKED:
-      return "revoked";
-    case OCSP_INVALID:
-      return "invalid";
-    case OCSP_UNAUTHORIZED:
-      return "unauthorized";
-    case OCSP_UNKNOWN:
-      return "unknown";
+  // |ocsp_responses| overrides when it is non-empty.
+  if (!ocsp_responses.empty()) {
+    std::string arg;
+    for (size_t i = 0; i < ocsp_responses.size(); i++) {
+      if (i != 0)
+        arg += ":";
+      arg += OCSPStatusToString(ocsp_responses[i].status);
+    }
+    return arg;
+  }
+
+  return OCSPStatusToString(ocsp_status);
+}
+
+std::string BaseTestServer::SSLOptions::GetOCSPDateArgument() const {
+  if (server_certificate != CERT_AUTO)
+    return std::string();
+
+  if (!ocsp_responses.empty()) {
+    std::string arg;
+    for (size_t i = 0; i < ocsp_responses.size(); i++) {
+      if (i != 0)
+        arg += ":";
+      arg += OCSPDateToString(ocsp_responses[i].date);
+    }
+    return arg;
+  }
+
+  return OCSPDateToString(ocsp_date);
+}
+
+std::string BaseTestServer::SSLOptions::GetOCSPProducedArgument() const {
+  if (server_certificate != CERT_AUTO)
+    return std::string();
+
+  switch (ocsp_produced) {
+    case OCSP_PRODUCED_VALID:
+      return "valid";
+    case OCSP_PRODUCED_BEFORE_CERT:
+      return "before";
+    case OCSP_PRODUCED_AFTER_CERT:
+      return "after";
     default:
       NOTREACHED();
       return std::string();
   }
 }
 
 const char BaseTestServer::kLocalhost[] = "127.0.0.1";
 
 BaseTestServer::BaseTestServer(Type type, const std::string& host)
     : type_(type),
@@ skipping 302 matching lines @@
       arguments->Set("ssl-client-cert-type", client_cert_types.release());
   }
 
   if (type_ == TYPE_HTTPS) {
     arguments->Set("https", base::Value::CreateNullValue());
 
     std::string ocsp_arg = ssl_options_.GetOCSPArgument();
     if (!ocsp_arg.empty())
       arguments->SetString("ocsp", ocsp_arg);
 
+    std::string ocsp_date_arg = ssl_options_.GetOCSPDateArgument();
+    if (!ocsp_date_arg.empty())
+      arguments->SetString("ocsp-date", ocsp_date_arg);
+
+    std::string ocsp_produced_arg = ssl_options_.GetOCSPProducedArgument();
+    if (!ocsp_produced_arg.empty())
+      arguments->SetString("ocsp-produced", ocsp_produced_arg);
+
     if (ssl_options_.cert_serial != 0) {
       arguments->SetInteger("cert-serial", ssl_options_.cert_serial);
     }
 
     // Check key exchange argument.
     std::unique_ptr<base::ListValue> key_exchange_values(new base::ListValue());
     GetKeyExchangesList(ssl_options_.key_exchanges, key_exchange_values.get());
     if (key_exchange_values->GetSize())
       arguments->Set("ssl-key-exchange", key_exchange_values.release());
     // Check bulk cipher argument.
@@ skipping 49 matching lines @@
 
   return GenerateAdditionalArguments(arguments);
 }
 
 bool BaseTestServer::GenerateAdditionalArguments(
     base::DictionaryValue* arguments) const {
   return true;
 }
 
 }  // namespace net