Add unittests of HTTPS loading that requires AIA fetching.

net/tools/testserver/testserver.py

 #!/usr/bin/env python
 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """This is a simple HTTP/FTP/TCP/UDP/BASIC_AUTH_PROXY/WEBSOCKET server used for
 testing Chrome.
 
 It supports several test URLs, as specified by the handlers in TestPageHandler.
 By default, it listens on an ephemeral port and sends the port number back to
@@ skipping 1665 matching lines @@
   # called by chunked handling function
   def sendChunkHelp(self, chunk):
     # Each chunk consists of: chunk size (hex), CRLF, chunk body, CRLF
     self.wfile.write('%X\r\n' % len(chunk))
     self.wfile.write(chunk)
     self.wfile.write('\r\n')
 
 
 class OCSPHandler(testserver_base.BasePageHandler):
   def __init__(self, request, client_address, socket_server):
-    handlers = [self.OCSPResponse]
+    handlers = [self.OCSPResponse, self.CaIssuersResponse]
     self.ocsp_response = socket_server.ocsp_response
+    self.ca_issuers_response = socket_server.ca_issuers_response
     testserver_base.BasePageHandler.__init__(self, request, client_address,
                                              socket_server, [], handlers, [],
                                              handlers, [])
 
   def OCSPResponse(self):
+    if not self._ShouldHandleRequest("/ocsp"):
+      return False
+    print 'handling ocsp request'
     self.send_response(200)
     self.send_header('Content-Type', 'application/ocsp-response')
     self.send_header('Content-Length', str(len(self.ocsp_response)))
     self.end_headers()
 
     self.wfile.write(self.ocsp_response)
 
+  def CaIssuersResponse(self):
+    if not self._ShouldHandleRequest("/ca_issuers"):
+      return False
+    print 'handling ca_issuers request'
+    self.send_response(200)
+    self.send_header('Content-Type', 'application/pkix-cert')
+    self.send_header('Content-Length', str(len(self.ca_issuers_response)))
+    self.end_headers()
+
+    self.wfile.write(self.ca_issuers_response)
+
 
 class TCPEchoHandler(SocketServer.BaseRequestHandler):
   """The RequestHandler class for TCP echo server.
 
   It is instantiated once per connection to the server, and overrides the
   handle() method to implement communication to the client.
   """
 
   def handle(self):
     """Handles the request from the client and constructs a response."""
@@ skipping 181 matching lines @@
     if self.options.server_type == SERVER_HTTP:
       if self.options.https:
         pem_cert_and_key = None
         ocsp_der = None
         if self.options.cert_and_key_file:
           if not os.path.isfile(self.options.cert_and_key_file):
             raise testserver_base.OptionError(
                 'specified server cert file not found: ' +
                 self.options.cert_and_key_file + ' exiting...')
           pem_cert_and_key = file(self.options.cert_and_key_file, 'r').read()
+        elif self.options.aia_intermediate:
+          self.__ocsp_server = OCSPServer((host, 0), OCSPHandler)
+          print ('AIA server started on %s:%d...' %
+              (host, self.__ocsp_server.server_port))
+
+          (pem_cert_and_key, intermediate_cert_der) = \
+              minica.GenerateCertKeyAndIntermediate(
+                  subject = "127.0.0.1",
+                  ca_issuers_url = ("http://%s:%d/ca_issuers" %
+                                    (host, self.__ocsp_server.server_port)),
+                  serial = self.options.cert_serial)
+
+          self.__ocsp_server.ocsp_response = None
+          self.__ocsp_server.ca_issuers_response = intermediate_cert_der
         else:
           # generate a new certificate and run an OCSP server for it.
           self.__ocsp_server = OCSPServer((host, 0), OCSPHandler)
           print ('OCSP server started on %s:%d...' %
               (host, self.__ocsp_server.server_port))
 
           ocsp_states = list()
           for ocsp_state_arg in self.options.ocsp.split(':'):
             if ocsp_state_arg == 'ok':
               ocsp_state = minica.OCSP_STATE_GOOD
@@ skipping 58 matching lines @@
               ocsp_states = ocsp_states,
               ocsp_dates = ocsp_dates,
               ocsp_produced = ocsp_produced,
               serial = self.options.cert_serial)
 
           if self.options.ocsp_server_unavailable:
             # SEQUENCE containing ENUMERATED with value 3 (tryLater).
             self.__ocsp_server.ocsp_response = '30030a0103'.decode('hex')
           else:
             self.__ocsp_server.ocsp_response = ocsp_der
+          self.__ocsp_server.ca_issuers_response = None
 
         for ca_cert in self.options.ssl_client_ca:
           if not os.path.isfile(ca_cert):
             raise testserver_base.OptionError(
                 'specified trusted client CA file not found: ' + ca_cert +
                 ' exiting...')
 
         stapled_ocsp_response = None
         if self.options.staple_ocsp_response:
           stapled_ocsp_response = ocsp_der
@@ skipping 141 matching lines @@
                                   dest='server_type',
                                   help='start up a WebSocket server.')
     self.option_parser.add_option('--https', action='store_true',
                                   dest='https', help='Specify that https '
                                   'should be used.')
     self.option_parser.add_option('--cert-and-key-file',
                                   dest='cert_and_key_file', help='specify the '
                                   'path to the file containing the certificate '
                                   'and private key for the server in PEM '
                                   'format')
+    self.option_parser.add_option('--aia-intermediate', action='store_true',
+                                  dest='aia_intermediate',
+                                  help='generate a certificate chain that '
+                                  'requires AIA cert fetching, and run a '
+                                  'server to respond to the AIA request.')
     self.option_parser.add_option('--ocsp', dest='ocsp', default='ok',
                                   help='The type of OCSP response generated '
                                   'for the automatically generated '
                                   'certificate. One of [ok,revoked,invalid]')
     self.option_parser.add_option('--ocsp-date', dest='ocsp_date',
                                   default='valid', help='The validity of the '
                                   'range between thisUpdate and nextUpdate')
     self.option_parser.add_option('--ocsp-produced', dest='ocsp_produced',
                                   default='valid', help='producedAt relative '
                                   'to certificate expiry')
@@ skipping 111 matching lines @@
                                   'an anonymous user.')
     self.option_parser.add_option('--disable-channel-id', action='store_true')
     self.option_parser.add_option('--disable-extended-master-secret',
                                   action='store_true')
     self.option_parser.add_option('--token-binding-params', action='append',
                                   default=[], type='int')
 
 
 if __name__ == '__main__':
   sys.exit(ServerRunner().main())