Use correct slot id for client certs in network config.

chromeos/network/network_connection_handler_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/network_connection_handler.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/file_util.h"
 #include "base/json/json_reader.h"
@@ skipping 187 matching lines @@
     CertLoader::Get()->StartWithNSSDB(test_nssdb_.get());
     base::RunLoop().RunUntilIdle();
   }
 
   void LoginToRegularUser() {
     LoginState::Get()->SetLoggedInState(LoginState::LOGGED_IN_ACTIVE,
                                         LoginState::LOGGED_IN_USER_REGULAR);
     base::RunLoop().RunUntilIdle();
   }
 
-  void ImportClientCertAndKey(const std::string& pkcs12_file,
-                              net::NSSCertDatabase* nssdb,
-                              net::CertificateList* loaded_certs) {
+  scoped_refptr<net::X509Certificate> ImportTestClientCert() {
+    net::CertificateList ca_cert_list =
+        net::CreateCertificateListFromFile(net::GetTestCertsDirectory(),
+                                           "websocket_cacert.pem",
+                                           net::X509Certificate::FORMAT_AUTO);
+    if (ca_cert_list.empty()) {
+      LOG(ERROR) << "No CA cert loaded.";
+      return NULL;
+    }
+    net::NSSCertDatabase::ImportCertFailureList failures;
+    EXPECT_TRUE(test_nssdb_->ImportCACerts(
+        ca_cert_list, net::NSSCertDatabase::TRUST_DEFAULT, &failures));
+    if (!failures.empty()) {
+      LOG(ERROR) << net::ErrorToString(failures[0].net_error);
+      return NULL;
+    }
+
     std::string pkcs12_data;
     base::FilePath pkcs12_path =
-        net::GetTestCertsDirectory().Append(pkcs12_file);
-    ASSERT_TRUE(base::ReadFileToString(pkcs12_path, &pkcs12_data));
+        net::GetTestCertsDirectory().Append("websocket_client_cert.p12");
+    if (!base::ReadFileToString(pkcs12_path, &pkcs12_data))
+      return NULL;
 
-    scoped_refptr<net::CryptoModule> module(
-        net::CryptoModule::CreateFromHandle(nssdb->GetPrivateSlot().get()));
-    ASSERT_EQ(
-        net::OK,
-        nssdb->ImportFromPKCS12(module, pkcs12_data, base::string16(), false,
-                                loaded_certs));
-    ASSERT_EQ(1U, loaded_certs->size());
+    net::CertificateList loaded_certs;
+    scoped_refptr<net::CryptoModule> module(net::CryptoModule::CreateFromHandle(
+        test_nssdb_->GetPrivateSlot().get()));
+    if (net::OK !=
+        test_nssdb_->ImportFromPKCS12(
+            module, pkcs12_data, base::string16(), false, &loaded_certs)) {

[stevenjb, 2014/07/29 18:31:10]

nit: ... != net::OK

+      LOG(ERROR) << "Error while importing to NSSDB.";
+      return NULL;
+    }
+
+    // File contains two certs, the client cert first and the CA cert second.
+    if (loaded_certs.size() != 2U) {
+      LOG(ERROR) << "Expected two certs in file, found " << loaded_certs.size();
+      return NULL;
+    }
+    return loaded_certs[0];
   }
 
   void SetupPolicy(const std::string& network_configs_json,
                    const base::DictionaryValue& global_config,
                    bool user_policy) {
     std::string error;
     scoped_ptr<base::Value> network_configs_value(
         base::JSONReader::ReadAndReturnError(network_configs_json,
                                              base::JSON_ALLOW_TRAILING_COMMAS,
                                              NULL,
@@ skipping 115 matching lines @@
               base::DictionaryValue(),  // no global config
               true);                    // load as user policy
 
   Connect("wifi4");
   EXPECT_EQ(NetworkConnectionHandler::kErrorCertificateRequired,
             GetResultAndReset());
 }
 
 TEST_F(NetworkConnectionHandlerTest, ConnectWithCertificateSuccess) {
   StartCertLoader();
-
-  net::CertificateList certs;
-  ImportClientCertAndKey("websocket_client_cert.p12",
-                         test_nssdb_.get(),
-                         &certs);
+  scoped_refptr<net::X509Certificate> cert = ImportTestClientCert();
+  ASSERT_TRUE(cert);
 
   SetupPolicy(base::StringPrintf(kPolicyWithCertPatternTemplate,
-                                 certs[0]->subject().common_name.c_str()),
+                                 cert->subject().common_name.c_str()),
               base::DictionaryValue(),  // no global config
               true);                    // load as user policy
 
   Connect("wifi4");
   EXPECT_EQ(kSuccessResult, GetResultAndReset());
 }
 
 // Disabled, see http://crbug.com/396729.
 TEST_F(NetworkConnectionHandlerTest,
        DISABLED_ConnectWithCertificateRequestedBeforeCertsAreLoaded) {
-  net::CertificateList certs;
-  ImportClientCertAndKey("websocket_client_cert.p12",
-                         test_nssdb_.get(),
-                         &certs);
+  scoped_refptr<net::X509Certificate> cert = ImportTestClientCert();
+  ASSERT_TRUE(cert);
 
   SetupPolicy(base::StringPrintf(kPolicyWithCertPatternTemplate,
-                                 certs[0]->subject().common_name.c_str()),
+                                 cert->subject().common_name.c_str()),
               base::DictionaryValue(),  // no global config
               true);                    // load as user policy
 
   Connect("wifi4");
 
   // Connect request came before the cert loader loaded certificates, so the
   // connect request should have been throttled until the certificates are
   // loaded.
   EXPECT_EQ("", GetResultAndReset());
 
@@ skipping 99 matching lines @@
       true);
 
   SetupPolicy(kPolicy, global_config, false /* load as device policy */);
   EXPECT_EQ(shill::kStateIdle,
             GetServiceStringProperty("wifi0", shill::kStateProperty));
   EXPECT_EQ(shill::kStateOnline,
             GetServiceStringProperty("wifi1", shill::kStateProperty));
 }
 
 }  // namespace chromeos