Refactor client cert private key handling.

content/browser/loader/resource_loader_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/loader/resource_loader.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <deque>
@@ skipping 24 matching lines @@
 #include "content/test/test_web_contents.h"
 #include "ipc/ipc_message.h"
 #include "net/base/chunked_upload_data_stream.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/cert/x509_certificate.h"
 #include "net/nqe/effective_connection_type.h"
 #include "net/nqe/network_quality_estimator_test_util.h"
+#include "net/ssl/client_cert_identity_test_util.h"
 #include "net/ssl/client_cert_store.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/test_data_directory.h"
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_filter.h"
@@ skipping 17 matching lines @@
   // in |requested_authorities| and |request_count|, respectively. The caller is
   // responsible for ensuring those pointers outlive the ClientCertStoreStub.
   //
   // TODO(ppi): Make the stub independent from the internal representation of
   // SSLCertRequestInfo. For now it seems that we can neither save the
   // scoped_refptr<> (since it is never passed to us) nor copy the entire
   // CertificateRequestInfo (since there is no copy constructor).
   ClientCertStoreStub(const net::CertificateList& response,
                       int* request_count,
                       std::vector<std::string>* requested_authorities)
-      : response_(response),
+      : response_(std::move(response)),
         requested_authorities_(requested_authorities),
         request_count_(request_count) {
     requested_authorities_->clear();
     *request_count_ = 0;
   }
 
   ~ClientCertStoreStub() override {}
 
   // net::ClientCertStore:
   void GetClientCerts(const net::SSLCertRequestInfo& cert_request_info,
                       const ClientCertListCallback& callback) override {
     *requested_authorities_ = cert_request_info.cert_authorities;
     ++(*request_count_);
 
-    callback.Run(response_);
+    callback.Run(net::FakeClientCertIdentityListFromCertificateList(response_));
   }
 
  private:
   const net::CertificateList response_;
   std::vector<std::string>* requested_authorities_;
   int* request_count_;
 };
 
 // Client certificate store which destroys its resource loader before the
 // asynchronous GetClientCerts callback is called.
@@ skipping 19 matching lines @@
   }
 
  private:
   // This needs to be static because |loader| owns the
   // LoaderDestroyingCertStore (ClientCertStores are actually handles, and not
   // global cert stores).
   static void DoCallback(std::unique_ptr<ResourceLoader>* loader,
                          const ClientCertListCallback& cert_selected_callback,
                          const base::Closure& on_loader_deleted_callback) {
     loader->reset();
-    cert_selected_callback.Run(net::CertificateList());
+    cert_selected_callback.Run(net::ClientCertIdentityList());
     on_loader_deleted_callback.Run();
   }
 
   std::unique_ptr<ResourceLoader>* loader_;
   base::Closure on_loader_deleted_callback_;
 
   DISALLOW_COPY_AND_ASSIGN(LoaderDestroyingCertStore);
 };
 
 // A mock URLRequestJob which simulates an SSL client auth request.
@@ skipping 13 matching lines @@
     scoped_refptr<net::SSLCertRequestInfo> cert_request_info(
         new net::SSLCertRequestInfo);
     cert_request_info->cert_authorities = test_authorities();
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(&MockClientCertURLRequestJob::NotifyCertificateRequested,
                    weak_factory_.GetWeakPtr(),
                    base::RetainedRef(cert_request_info)));
   }
 
-  void ContinueWithCertificate(net::X509Certificate* cert,
-                               net::SSLPrivateKey* private_key) override {
+  void ContinueWithCertificate(
+      scoped_refptr<net::X509Certificate> cert,
+      scoped_refptr<net::SSLPrivateKey> private_key) override {
     net::URLRequestTestJob::Start();
   }
 
  private:
   ~MockClientCertURLRequestJob() override {}
 
   base::WeakPtrFactory<MockClientCertURLRequestJob> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(MockClientCertURLRequestJob);
 };
@@ skipping 83 matching lines @@
   void WaitForSelectCertificate() {
     select_certificate_run_loop_.Run();
     // Process any pending messages - just so tests can check if
     // SelectClientCertificate was called more than once.
     base::RunLoop().RunUntilIdle();
   }
 
   void SelectClientCertificate(
       WebContents* web_contents,
       net::SSLCertRequestInfo* cert_request_info,
-      net::CertificateList client_certs,
+      net::ClientCertIdentityList client_certs,
       std::unique_ptr<ClientCertificateDelegate> delegate) override {
     EXPECT_FALSE(delegate_.get());
 
     ++call_count_;
-    passed_certs_ = std::move(client_certs);
+    passed_identities_ = std::move(client_certs);
     delegate_ = std::move(delegate);
     select_certificate_run_loop_.Quit();
   }
 
   int call_count() { return call_count_; }
-  net::CertificateList passed_certs() { return passed_certs_; }
+  const net::ClientCertIdentityList& passed_identities() {
+    return passed_identities_;
+  }
 
-  void ContinueWithCertificate(net::X509Certificate* cert) {
-    delegate_->ContinueWithCertificate(cert);
+  void ContinueWithCertificate(scoped_refptr<net::X509Certificate> cert,
+                               scoped_refptr<net::SSLPrivateKey> private_key) {
+    delegate_->ContinueWithCertificate(std::move(cert), std::move(private_key));
     delegate_.reset();
   }
 
   void CancelCertificateSelection() { delegate_.reset(); }
 
  private:
-  net::CertificateList passed_certs_;
+  net::ClientCertIdentityList passed_identities_;
   int call_count_;
   std::unique_ptr<ClientCertificateDelegate> delegate_;
 
   base::RunLoop select_certificate_run_loop_;
 
   DISALLOW_COPY_AND_ASSIGN(SelectCertificateBrowserClient);
 };
 
 // Wraps a ChunkedUploadDataStream to behave as non-chunked to enable upload
 // progress reporting.
@@ skipping 280 matching lines @@
  private:
   const GURL test_https_url_;
   const GURL test_https_redirect_url_;
 };
 
 // Tests that client certificates are requested with ClientCertStore lookup.
 TEST_F(ClientCertResourceLoaderTest, WithStoreLookup) {
   // Set up the test client cert store.
   int store_request_count;
   std::vector<std::string> store_requested_authorities;
-  net::CertificateList dummy_certs(
-      1, net::ImportCertFromFile(net::GetTestCertsDirectory(), "ok_cert.pem"));
+  scoped_refptr<net::X509Certificate> test_cert =
+      net::ImportCertFromFile(net::GetTestCertsDirectory(), "ok_cert.pem");
+  ASSERT_TRUE(test_cert);
+  net::CertificateList dummy_certs(1, test_cert);
   std::unique_ptr<ClientCertStoreStub> test_store(new ClientCertStoreStub(
       dummy_certs, &store_request_count, &store_requested_authorities));
   SetClientCertStore(std::move(test_store));
 
   // Plug in test content browser client.
   SelectCertificateBrowserClient test_client;
   ContentBrowserClient* old_client = SetBrowserClientForTesting(&test_client);
 
   // Start the request and wait for it to pause.
   loader_->StartRequest();
   test_client.WaitForSelectCertificate();
 
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
 
   // Check if the test store was queried against correct |cert_authorities|.
   EXPECT_EQ(1, store_request_count);
   EXPECT_EQ(MockClientCertURLRequestJob::test_authorities(),
             store_requested_authorities);
 
   // Check if the retrieved certificates were passed to the content browser
   // client.
   EXPECT_EQ(1, test_client.call_count());
-  EXPECT_EQ(dummy_certs, test_client.passed_certs());
+  EXPECT_EQ(1U, test_client.passed_identities().size());
+  EXPECT_EQ(test_cert.get(), test_client.passed_identities()[0]->certificate());
 
   // Continue the request.
-  test_client.ContinueWithCertificate(nullptr);
+  test_client.ContinueWithCertificate(nullptr, nullptr);
   raw_ptr_resource_handler_->WaitUntilResponseComplete();
   EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
 
   // Restore the original content browser client.
   SetBrowserClientForTesting(old_client);
 }
 
 // Tests that client certificates are requested on a platform with NULL
 // ClientCertStore.
 TEST_F(ClientCertResourceLoaderTest, WithNullStore) {
   // Plug in test content browser client.
   SelectCertificateBrowserClient test_client;
   ContentBrowserClient* old_client = SetBrowserClientForTesting(&test_client);
 
   // Start the request and wait for it to pause.
   loader_->StartRequest();
   test_client.WaitForSelectCertificate();
 
   // Check if the SelectClientCertificate was called on the content browser
   // client.
   EXPECT_EQ(1, test_client.call_count());
-  EXPECT_EQ(net::CertificateList(), test_client.passed_certs());
+  EXPECT_EQ(net::ClientCertIdentityList(), test_client.passed_identities());
 
   // Continue the request.
-  test_client.ContinueWithCertificate(nullptr);
+  test_client.ContinueWithCertificate(nullptr, nullptr);
   raw_ptr_resource_handler_->WaitUntilResponseComplete();
   EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
 
   // Restore the original content browser client.
   SetBrowserClientForTesting(old_client);
 }
 
 // Tests that the ContentBrowserClient may cancel a certificate request.
 TEST_F(ClientCertResourceLoaderTest, CancelSelection) {
   // Plug in test content browser client.
   SelectCertificateBrowserClient test_client;
   ContentBrowserClient* old_client = SetBrowserClientForTesting(&test_client);
 
   // Start the request and wait for it to pause.
   loader_->StartRequest();
   test_client.WaitForSelectCertificate();
 
   // Check if the SelectClientCertificate was called on the content browser
   // client.
   EXPECT_EQ(1, test_client.call_count());
-  EXPECT_EQ(net::CertificateList(), test_client.passed_certs());
+  EXPECT_EQ(net::ClientCertIdentityList(), test_client.passed_identities());
 
   // Cancel the request.
   test_client.CancelCertificateSelection();
   raw_ptr_resource_handler_->WaitUntilResponseComplete();
   EXPECT_EQ(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED,
             raw_ptr_resource_handler_->final_status().error());
 
   // Restore the original content browser client.
   SetBrowserClientForTesting(old_client);
 }
@@ skipping 872 matching lines @@
 
 // Tests that the effective connection type is not set on non-main frame
 // requests.
 TEST_F(EffectiveConnectionTypeResourceLoaderTest, DoesNotBelongToMainFrame) {
   VerifyEffectiveConnectionType(RESOURCE_TYPE_OBJECT, false,
                                 net::EFFECTIVE_CONNECTION_TYPE_3G,
                                 net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN);
 }
 
 }  // namespace content