Cache certificate verification results in memory.

net/socket/ssl_client_socket_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "net/base/address_list.h"
+#include "net/base/cert_verifier.h"
 #include "net/base/host_resolver.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_log.h"
 #include "net/base/net_log_unittest.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_config_service.h"
 #include "net/base/test_completion_callback.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/socket_test_util.h"
 #include "net/socket/tcp_client_socket.h"
 #include "net/test/test_server.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
 //-----------------------------------------------------------------------------
 
 const net::SSLConfig kDefaultSSLConfig;
 
 class SSLClientSocketTest : public PlatformTest {
  public:
   SSLClientSocketTest()
-      : socket_factory_(net::ClientSocketFactory::GetDefaultFactory()) {
+      : socket_factory_(net::ClientSocketFactory::GetDefaultFactory()),
+        cert_verifier_(new net::CertVerifier) {
   }
 
  protected:
+  net::SSLClientSocket* CreateSSLClientSocket(
+      net::ClientSocket* transport_socket,
+      const net::HostPortPair& host_and_port,
+      const net::SSLConfig& ssl_config) {
+    return socket_factory_->CreateSSLClientSocket(transport_socket,
+                                                  host_and_port,
+                                                  ssl_config,
+                                                  NULL,
+                                                  cert_verifier_.get());
+  }
+
   net::ClientSocketFactory* socket_factory_;
+  scoped_ptr<net::CertVerifier> cert_verifier_;
 };
 
 //-----------------------------------------------------------------------------
 
 // LogContainsSSLConnectEndEvent returns true if the given index in the given
 // log is an SSL connect end event. The NSS sockets will cork in an attempt to
 // merge the first application data record with the Finished message when false
 // starting. However, in order to avoid the server timing out the handshake,
 // they'll give up waiting for application data and send the Finished after a
 // timeout. This means that an SSL connect end event may appear as a socket
@@ skipping 16 matching lines @@
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig,
+          NULL, cert_verifier_.get()));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
 
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       entries, 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
@@ skipping 19 matching lines @@
   TestCompletionCallback callback;
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
 
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       entries, 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
@@ skipping 21 matching lines @@
   TestCompletionCallback callback;
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
 
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       entries, 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
@@ skipping 24 matching lines @@
   TestCompletionCallback callback;
   net::CapturingNetLog log(net::CapturingNetLog::kUnbounded);
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, &log, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
 
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       entries, 5, net::NetLog::TYPE_SSL_CONNECT));
   if (rv == net::ERR_IO_PENDING)
@@ skipping 25 matching lines @@
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   net::SSLConfig ssl_config = kDefaultSSLConfig;
   ssl_config.send_client_cert = true;
   ssl_config.client_cert = NULL;
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), ssl_config, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            ssl_config));
 
   EXPECT_FALSE(sock->IsConnected());
 
   // Our test server accepts certificate-less connections.
   // TODO(davidben): Add a test which requires them and verify the error.
   rv = sock->Connect(&callback);
 
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
@@ skipping 24 matching lines @@
 
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
   EXPECT_TRUE(sock->IsConnected());
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
@@ skipping 34 matching lines @@
 
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
       socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+          transport, test_server.host_port_pair(), kDefaultSSLConfig,
+          NULL, cert_verifier_.get()));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
   EXPECT_TRUE(sock->IsConnected());
 
   // Issue a "hanging" Read first.
   scoped_refptr<net::IOBuffer> buf(new net::IOBuffer(4096));
   rv = sock->Read(buf, 4096, &callback);
@@ skipping 32 matching lines @@
 
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
   memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1);
@@ skipping 28 matching lines @@
 
   TestCompletionCallback callback;
   net::ClientSocket* transport = new net::TCPClientSocket(
       addr, NULL, net::NetLog::Source());
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   rv = sock->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   const char request_text[] = "GET / HTTP/1.0\r\n\r\n";
   scoped_refptr<net::IOBuffer> request_buffer(
       new net::IOBuffer(arraysize(request_text) - 1));
   memcpy(request_buffer->data(), request_text, arraysize(request_text) - 1);
@@ skipping 48 matching lines @@
                                      NULL, 0);
 
   net::ClientSocket* transport =
       new net::MockTCPClientSocket(addr, NULL, &data);
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), kDefaultSSLConfig, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            kDefaultSSLConfig));
 
   rv = sock->Connect(&callback);
   EXPECT_EQ(net::ERR_SSL_PROTOCOL_ERROR, rv);
 }
 
 // TODO(rsleevi): Not implemented for Schannel. As Schannel is only used when
 // performing client authentication, it will not be tested here.
 TEST_F(SSLClientSocketTest, CipherSuiteDisables) {
   // Rather than exhaustively disabling every RC4 ciphersuite defined at
   // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml,
@@ skipping 20 matching lines @@
   int rv = transport->Connect(&callback);
   if (rv == net::ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(net::OK, rv);
 
   net::SSLConfig ssl_config;
   for (size_t i = 0; i < arraysize(kCiphersToDisable); ++i)
     ssl_config.disabled_cipher_suites.push_back(kCiphersToDisable[i]);
 
   scoped_ptr<net::SSLClientSocket> sock(
-      socket_factory_->CreateSSLClientSocket(
-          transport, test_server.host_port_pair(), ssl_config, NULL));
+      CreateSSLClientSocket(transport, test_server.host_port_pair(),
+                            ssl_config));
 
   EXPECT_FALSE(sock->IsConnected());
 
   rv = sock->Connect(&callback);
   net::CapturingNetLog::EntryList entries;
   log.GetEntries(&entries);
   EXPECT_TRUE(net::LogContainsBeginEvent(
       entries, 5, net::NetLog::TYPE_SSL_CONNECT));
 
   // NSS has special handling that maps a handshake_failure alert received
@@ skipping 12 matching lines @@
   log.GetEntries(&entries);
   net::ExpectLogContainsSomewhere(entries, 0,
                                   net::NetLog::TYPE_SSL_HANDSHAKE_ERROR,
                                   net::NetLog::PHASE_NONE);
 
   // We cannot test sock->IsConnected(), as the NSS implementation disconnects
   // the socket when it encounters an error, whereas other implementations
   // leave it connected.
   EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1));
 }