Refactor client cert private key handling.

net/ssl/openssl_client_key_store_unittest.cc

-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/ssl/openssl_client_key_store.h"
-
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-#include "net/ssl/ssl_private_key.h"
-#include "net/test/cert_test_util.h"
-#include "net/test/test_data_directory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace net {
-
-namespace {
-
-// A common test class to ensure that the store is flushed after
-// each test.
-class OpenSSLClientKeyStoreTest : public ::testing::Test {
- public:
-  OpenSSLClientKeyStoreTest()
-    : store_(OpenSSLClientKeyStore::GetInstance()) {
-  }
-
-  ~OpenSSLClientKeyStoreTest() override {
-    if (store_)
-      store_->Flush();
-  }
-
- protected:
-  OpenSSLClientKeyStore* store_;
-};
-
-class MockSSLPrivateKey : public SSLPrivateKey {
- public:
-  MockSSLPrivateKey() : on_destroyed_(nullptr) {}
-
-  void set_on_destroyed(bool* on_destroyed) { on_destroyed_ = on_destroyed; }
-
-  std::vector<Hash> GetDigestPreferences() override {
-    NOTREACHED();
-    return {};
-  }
-
-  void SignDigest(Hash hash,
-                  const base::StringPiece& input,
-                  const SignCallback& callback) override {
-    NOTREACHED();
-  }
-
- private:
-  ~MockSSLPrivateKey() override {
-    if (on_destroyed_)
-      *on_destroyed_ = true;
-  }
-
-  bool* on_destroyed_;
-};
-
-// Check that GetInstance() returns non-null
-TEST_F(OpenSSLClientKeyStoreTest, GetInstance) {
-  ASSERT_TRUE(store_);
-}
-
-// Check that Flush() works correctly.
-TEST_F(OpenSSLClientKeyStoreTest, Flush) {
-  ASSERT_TRUE(store_);
-
-  scoped_refptr<X509Certificate> cert_1(
-      ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
-  ASSERT_TRUE(cert_1);
-
-  EXPECT_TRUE(store_->RecordClientCertPrivateKey(
-      cert_1.get(), make_scoped_refptr(new MockSSLPrivateKey)));
-
-  store_->Flush();
-
-  // Retrieve the private key. This should fail because the store
-  // was flushed.
-  EXPECT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get()));
-}
-
-// Check that trying to retrieve the private key of an unknown certificate
-// simply fails by returning null.
-TEST_F(OpenSSLClientKeyStoreTest, FetchEmptyPrivateKey) {
-  ASSERT_TRUE(store_);
-
-  scoped_refptr<X509Certificate> cert_1(
-      ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
-  ASSERT_TRUE(cert_1);
-
-  // Retrieve the private key now. This should fail because it was
-  // never recorded in the store.
-  EXPECT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get()));
-}
-
-// Check that any private key recorded through RecordClientCertPrivateKey
-// can be retrieved with FetchClientCertPrivateKey.
-TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchPrivateKey) {
-  ASSERT_TRUE(store_);
-
-  // Any certificate / key pair will do, the store is not supposed to
-  // check that the private and certificate public keys match. This is
-  // by design since the private EVP_PKEY could be a wrapper around a
-  // JNI reference, with no way to access the real private key bits.
-  scoped_refptr<X509Certificate> cert_1(
-      ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
-  ASSERT_TRUE(cert_1);
-
-  bool on_destroyed = false;
-  scoped_refptr<MockSSLPrivateKey> priv_key(new MockSSLPrivateKey);
-  priv_key->set_on_destroyed(&on_destroyed);
-
-  // Add a key twice.
-  EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), priv_key));
-  EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), priv_key));
-
-  // Retrieve the private key.
-  scoped_refptr<SSLPrivateKey> pkey2 =
-      store_->FetchClientCertPrivateKey(cert_1.get());
-  EXPECT_EQ(pkey2.get(), priv_key.get());
-
-  // Flush the key store and release all references. At this point, the private
-  // key should be cleanly destroyed.
-  store_->Flush();
-  priv_key = nullptr;
-  pkey2 = nullptr;
-  EXPECT_TRUE(on_destroyed);
-}
-
-// Same test, but with two certificates / private keys.
-TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchTwoPrivateKeys) {
-  scoped_refptr<X509Certificate> cert_1(
-      ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
-  ASSERT_TRUE(cert_1);
-
-  scoped_refptr<X509Certificate> cert_2(
-      ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem"));
-  ASSERT_TRUE(cert_2);
-
-  scoped_refptr<SSLPrivateKey> priv_key1(new MockSSLPrivateKey);
-  scoped_refptr<SSLPrivateKey> priv_key2(new MockSSLPrivateKey);
-
-  EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), priv_key1));
-  EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_2.get(), priv_key2));
-
-  scoped_refptr<SSLPrivateKey> fetch_key1 =
-      store_->FetchClientCertPrivateKey(cert_1.get());
-  scoped_refptr<SSLPrivateKey> fetch_key2 =
-      store_->FetchClientCertPrivateKey(cert_2.get());
-
-  EXPECT_TRUE(fetch_key1);
-  EXPECT_TRUE(fetch_key2);
-
-  EXPECT_EQ(fetch_key1.get(), priv_key1.get());
-  EXPECT_EQ(fetch_key2.get(), priv_key2.get());
-}
-
-}  // namespace
-}  // namespace net