OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <string.h> | 8 #include <string.h> |
9 | 9 |
10 #include <utility> | 10 #include <utility> |
(...skipping 2802 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2813 ssl_config.token_binding_params.push_back(TB_PARAM_ECDSAP256); | 2813 ssl_config.token_binding_params.push_back(TB_PARAM_ECDSAP256); |
2814 | 2814 |
2815 int rv; | 2815 int rv; |
2816 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | 2816 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
2817 EXPECT_THAT(rv, IsOk()); | 2817 EXPECT_THAT(rv, IsOk()); |
2818 SSLInfo info; | 2818 SSLInfo info; |
2819 EXPECT_TRUE(sock_->GetSSLInfo(&info)); | 2819 EXPECT_TRUE(sock_->GetSSLInfo(&info)); |
2820 EXPECT_FALSE(info.token_binding_negotiated); | 2820 EXPECT_FALSE(info.token_binding_negotiated); |
2821 } | 2821 } |
2822 | 2822 |
2823 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabledWithNPN) { | 2823 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabled) { |
2824 // False Start requires ALPN or NPN, and ECDHE, and an AEAD. | 2824 // False Start requires ALPN, ECDHE, and an AEAD. |
2825 SpawnedTestServer::SSLOptions server_options; | 2825 SpawnedTestServer::SSLOptions server_options; |
2826 server_options.key_exchanges = | 2826 server_options.key_exchanges = |
2827 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA; | 2827 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA; |
2828 server_options.bulk_ciphers = | |
2829 SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM; | |
2830 server_options.npn_protocols.push_back("http/1.1"); | |
2831 SSLConfig client_config; | |
2832 client_config.npn_protos.push_back(kProtoHTTP11); | |
2833 ASSERT_NO_FATAL_FAILURE( | |
2834 TestFalseStart(server_options, client_config, true)); | |
2835 } | |
2836 | |
2837 TEST_F(SSLClientSocketFalseStartTest, FalseStartEnabledWithALPN) { | |
2838 // False Start requires ALPN or NPN, and ECDHE, and an AEAD. | |
2839 SpawnedTestServer::SSLOptions server_options; | |
2840 server_options.key_exchanges = | |
2841 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA; | |
2842 server_options.bulk_ciphers = | 2828 server_options.bulk_ciphers = |
2843 SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM; | 2829 SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM; |
2844 server_options.alpn_protocols.push_back("http/1.1"); | 2830 server_options.alpn_protocols.push_back("http/1.1"); |
2845 SSLConfig client_config; | 2831 SSLConfig client_config; |
2846 client_config.alpn_protos.push_back(kProtoHTTP11); | 2832 client_config.alpn_protos.push_back(kProtoHTTP11); |
2847 ASSERT_NO_FATAL_FAILURE(TestFalseStart(server_options, client_config, true)); | 2833 ASSERT_NO_FATAL_FAILURE(TestFalseStart(server_options, client_config, true)); |
2848 } | 2834 } |
2849 | 2835 |
2850 // Test that False Start is disabled without either ALPN or NPN. | 2836 // Test that False Start is disabled without ALPN. |
2851 TEST_F(SSLClientSocketFalseStartTest, NoAlpnAndNoNpn) { | 2837 TEST_F(SSLClientSocketFalseStartTest, NoAlpn) { |
2852 SpawnedTestServer::SSLOptions server_options; | 2838 SpawnedTestServer::SSLOptions server_options; |
2853 server_options.key_exchanges = | 2839 server_options.key_exchanges = |
2854 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA; | 2840 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_ECDHE_RSA; |
2855 server_options.bulk_ciphers = | 2841 server_options.bulk_ciphers = |
2856 SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM; | 2842 SpawnedTestServer::SSLOptions::BULK_CIPHER_AES128GCM; |
2857 SSLConfig client_config; | 2843 SSLConfig client_config; |
2858 client_config.alpn_protos.clear(); | 2844 client_config.alpn_protos.clear(); |
2859 client_config.npn_protos.clear(); | |
2860 ASSERT_NO_FATAL_FAILURE( | 2845 ASSERT_NO_FATAL_FAILURE( |
2861 TestFalseStart(server_options, client_config, false)); | 2846 TestFalseStart(server_options, client_config, false)); |
2862 } | 2847 } |
2863 | 2848 |
2864 // Test that False Start is disabled with plain RSA ciphers. | 2849 // Test that False Start is disabled with plain RSA ciphers. |
2865 TEST_F(SSLClientSocketFalseStartTest, RSA) { | 2850 TEST_F(SSLClientSocketFalseStartTest, RSA) { |
2866 SpawnedTestServer::SSLOptions server_options; | 2851 SpawnedTestServer::SSLOptions server_options; |
2867 server_options.key_exchanges = | 2852 server_options.key_exchanges = |
2868 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_RSA; | 2853 SpawnedTestServer::SSLOptions::KEY_EXCHANGE_RSA; |
2869 server_options.bulk_ciphers = | 2854 server_options.bulk_ciphers = |
(...skipping 259 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3129 | 3114 |
3130 // Enable Channel ID and connect again. This needs a full handshake to assert | 3115 // Enable Channel ID and connect again. This needs a full handshake to assert |
3131 // Channel ID. | 3116 // Channel ID. |
3132 ssl_config.channel_id_enabled = true; | 3117 ssl_config.channel_id_enabled = true; |
3133 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | 3118 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
3134 EXPECT_TRUE(sock_->GetSSLInfo(&ssl_info)); | 3119 EXPECT_TRUE(sock_->GetSSLInfo(&ssl_info)); |
3135 EXPECT_EQ(SSLInfo::HANDSHAKE_FULL, ssl_info.handshake_type); | 3120 EXPECT_EQ(SSLInfo::HANDSHAKE_FULL, ssl_info.handshake_type); |
3136 EXPECT_TRUE(ssl_info.channel_id_sent); | 3121 EXPECT_TRUE(ssl_info.channel_id_sent); |
3137 } | 3122 } |
3138 | 3123 |
3139 TEST_F(SSLClientSocketTest, NPN) { | |
3140 SpawnedTestServer::SSLOptions server_options; | |
3141 server_options.npn_protocols.push_back("spdy/3.1"); | |
3142 server_options.npn_protocols.push_back("h2"); | |
3143 ASSERT_TRUE(StartTestServer(server_options)); | |
3144 | |
3145 SSLConfig client_config; | |
3146 client_config.npn_protos.push_back(kProtoHTTP2); | |
3147 client_config.npn_protos.push_back(kProtoHTTP11); | |
3148 | |
3149 int rv; | |
3150 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); | |
3151 EXPECT_THAT(rv, IsOk()); | |
3152 | |
3153 EXPECT_EQ(kProtoHTTP2, sock_->GetNegotiatedProtocol()); | |
3154 } | |
3155 | |
3156 // Server preference should win in ALPN. | 3124 // Server preference should win in ALPN. |
3157 TEST_F(SSLClientSocketTest, Alpn) { | 3125 TEST_F(SSLClientSocketTest, Alpn) { |
3158 SpawnedTestServer::SSLOptions server_options; | 3126 SpawnedTestServer::SSLOptions server_options; |
3159 server_options.alpn_protocols.push_back("h2"); | 3127 server_options.alpn_protocols.push_back("h2"); |
3160 server_options.alpn_protocols.push_back("http/1.1"); | 3128 server_options.alpn_protocols.push_back("http/1.1"); |
3161 ASSERT_TRUE(StartTestServer(server_options)); | 3129 ASSERT_TRUE(StartTestServer(server_options)); |
3162 | 3130 |
3163 SSLConfig client_config; | 3131 SSLConfig client_config; |
3164 client_config.alpn_protos.push_back(kProtoHTTP11); | 3132 client_config.alpn_protos.push_back(kProtoHTTP11); |
3165 client_config.alpn_protos.push_back(kProtoHTTP2); | 3133 client_config.alpn_protos.push_back(kProtoHTTP2); |
(...skipping 13 matching lines...) Expand all Loading... |
3179 | 3147 |
3180 SSLConfig client_config; | 3148 SSLConfig client_config; |
3181 | 3149 |
3182 int rv; | 3150 int rv; |
3183 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); | 3151 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); |
3184 EXPECT_THAT(rv, IsOk()); | 3152 EXPECT_THAT(rv, IsOk()); |
3185 | 3153 |
3186 EXPECT_EQ(kProtoUnknown, sock_->GetNegotiatedProtocol()); | 3154 EXPECT_EQ(kProtoUnknown, sock_->GetNegotiatedProtocol()); |
3187 } | 3155 } |
3188 | 3156 |
3189 TEST_F(SSLClientSocketTest, NPNServerDisabled) { | |
3190 SpawnedTestServer::SSLOptions server_options; | |
3191 ASSERT_TRUE(StartTestServer(server_options)); | |
3192 | |
3193 SSLConfig client_config; | |
3194 client_config.npn_protos.push_back(kProtoHTTP11); | |
3195 | |
3196 int rv; | |
3197 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); | |
3198 EXPECT_THAT(rv, IsOk()); | |
3199 | |
3200 EXPECT_EQ(kProtoUnknown, sock_->GetNegotiatedProtocol()); | |
3201 } | |
3202 | |
3203 namespace { | 3157 namespace { |
3204 | 3158 |
3205 // Loads a PEM-encoded private key file into a SSLPrivateKey object. | 3159 // Loads a PEM-encoded private key file into a SSLPrivateKey object. |
3206 // |filepath| is the private key file path. | 3160 // |filepath| is the private key file path. |
3207 // Returns the new SSLPrivateKey. | 3161 // Returns the new SSLPrivateKey. |
3208 scoped_refptr<SSLPrivateKey> LoadPrivateKeyOpenSSL( | 3162 scoped_refptr<SSLPrivateKey> LoadPrivateKeyOpenSSL( |
3209 const base::FilePath& filepath) { | 3163 const base::FilePath& filepath) { |
3210 std::string data; | 3164 std::string data; |
3211 if (!base::ReadFileToString(filepath, &data)) { | 3165 if (!base::ReadFileToString(filepath, &data)) { |
3212 LOG(ERROR) << "Could not read private key file: " << filepath.value(); | 3166 LOG(ERROR) << "Could not read private key file: " << filepath.value(); |
(...skipping 257 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3470 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); | 3424 ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info)); |
3471 | 3425 |
3472 EXPECT_THAT(rv, IsError(ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN)); | 3426 EXPECT_THAT(rv, IsError(ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN)); |
3473 EXPECT_TRUE(ssl_info.cert_status & CERT_STATUS_PINNED_KEY_MISSING); | 3427 EXPECT_TRUE(ssl_info.cert_status & CERT_STATUS_PINNED_KEY_MISSING); |
3474 EXPECT_TRUE(ssl_info.cert_status & | 3428 EXPECT_TRUE(ssl_info.cert_status & |
3475 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED); | 3429 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED); |
3476 EXPECT_TRUE(sock_->IsConnected()); | 3430 EXPECT_TRUE(sock_->IsConnected()); |
3477 } | 3431 } |
3478 | 3432 |
3479 } // namespace net | 3433 } // namespace net |
OLD | NEW |