OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
6 | 6 |
7 #include "base/callback_helpers.h" | 7 #include "base/callback_helpers.h" |
8 #include "base/memory/ref_counted.h" | 8 #include "base/memory/ref_counted.h" |
9 #include "net/base/address_list.h" | 9 #include "net/base/address_list.h" |
10 #include "net/base/io_buffer.h" | 10 #include "net/base/io_buffer.h" |
(...skipping 1775 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1786 scoped_refptr<SSLCertRequestInfo> request_info = GetCertRequest(ssl_options); | 1786 scoped_refptr<SSLCertRequestInfo> request_info = GetCertRequest(ssl_options); |
1787 ASSERT_TRUE(request_info.get()); | 1787 ASSERT_TRUE(request_info.get()); |
1788 ASSERT_EQ(2u, request_info->cert_authorities.size()); | 1788 ASSERT_EQ(2u, request_info->cert_authorities.size()); |
1789 EXPECT_EQ(std::string(reinterpret_cast<const char*>(kThawteDN), kThawteLen), | 1789 EXPECT_EQ(std::string(reinterpret_cast<const char*>(kThawteDN), kThawteLen), |
1790 request_info->cert_authorities[0]); | 1790 request_info->cert_authorities[0]); |
1791 EXPECT_EQ( | 1791 EXPECT_EQ( |
1792 std::string(reinterpret_cast<const char*>(kDiginotarDN), kDiginotarLen), | 1792 std::string(reinterpret_cast<const char*>(kDiginotarDN), kDiginotarLen), |
1793 request_info->cert_authorities[1]); | 1793 request_info->cert_authorities[1]); |
1794 } | 1794 } |
1795 | 1795 |
1796 TEST_F(SSLClientSocketTest, ConnectSignedCertTimestampsEnabled) { | 1796 TEST_F(SSLClientSocketTest, ConnectSignedCertTimestampsEnabledTLSExtension) { |
1797 SpawnedTestServer::SSLOptions ssl_options; | 1797 SpawnedTestServer::SSLOptions ssl_options; |
1798 ssl_options.signed_cert_timestamps = "test"; | 1798 ssl_options.signed_cert_timestamps_tls_ext = "test"; |
1799 | 1799 |
1800 SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, | 1800 SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, |
1801 ssl_options, | 1801 ssl_options, |
1802 base::FilePath()); | 1802 base::FilePath()); |
1803 ASSERT_TRUE(test_server.Start()); | 1803 ASSERT_TRUE(test_server.Start()); |
1804 | 1804 |
1805 AddressList addr; | 1805 AddressList addr; |
1806 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 1806 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
1807 | 1807 |
1808 TestCompletionCallback callback; | 1808 TestCompletionCallback callback; |
(...skipping 29 matching lines...) Expand all Loading... | |
1838 EXPECT_TRUE(sock->WereSignedCertTimestampsReceived()); | 1838 EXPECT_TRUE(sock->WereSignedCertTimestampsReceived()); |
1839 #else | 1839 #else |
1840 // Enabling CT for OpenSSL is currently a noop. | 1840 // Enabling CT for OpenSSL is currently a noop. |
1841 EXPECT_FALSE(sock->WereSignedCertTimestampsReceived()); | 1841 EXPECT_FALSE(sock->WereSignedCertTimestampsReceived()); |
1842 #endif | 1842 #endif |
1843 | 1843 |
1844 sock->Disconnect(); | 1844 sock->Disconnect(); |
1845 EXPECT_FALSE(sock->IsConnected()); | 1845 EXPECT_FALSE(sock->IsConnected()); |
1846 } | 1846 } |
1847 | 1847 |
1848 // Test that enabling Signed Certificate Timestamps enables OCSP stapling. | |
1849 TEST_F(SSLClientSocketTest, ConnectSignedCertTimestampsEnabledOCSP) { | |
1850 SpawnedTestServer::SSLOptions ssl_options; | |
1851 ssl_options.staple_ocsp_response = true; | |
1852 // The test server currently only knows how to generate OCSP responses | |
1853 // for a freshly minted certificate. | |
1854 ssl_options.server_certificate = SpawnedTestServer::SSLOptions::CERT_AUTO; | |
1855 | |
1856 SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, | |
1857 ssl_options, | |
1858 base::FilePath()); | |
1859 ASSERT_TRUE(test_server.Start()); | |
1860 | |
1861 AddressList addr; | |
1862 ASSERT_TRUE(test_server.GetAddressList(&addr)); | |
1863 | |
1864 TestCompletionCallback callback; | |
1865 CapturingNetLog log; | |
1866 scoped_ptr<StreamSocket> transport( | |
1867 new TCPClientSocket(addr, &log, NetLog::Source())); | |
1868 int rv = transport->Connect(callback.callback()); | |
1869 if (rv == ERR_IO_PENDING) | |
1870 rv = callback.WaitForResult(); | |
1871 EXPECT_EQ(OK, rv); | |
1872 | |
1873 SSLConfig ssl_config; | |
1874 // Enabling Signed Cert Timestamps ensures we request stapled OCSP for | |
wtc
2013/12/10 04:23:17
Nit: stapled OCSP => OCSP stapling
ekasper
2013/12/10 14:45:20
Done.
| |
1875 // Certificate Transparency verification regardless of whether the platform | |
1876 // is able to process the OCSP status itself. | |
wtc
2013/12/10 04:23:17
Nit: OCSP status => OCSP response.
ekasper
2013/12/10 14:45:20
Hm, no, I meant "OCSP status" as in revocation sta
wtc
2013/12/12 02:31:45
I see. I found "OCSP status" a little ambiguous be
| |
1877 ssl_config.signed_cert_timestamps_enabled = true; | |
1878 | |
1879 scoped_ptr<SSLClientSocket> sock(CreateSSLClientSocket( | |
1880 transport.Pass(), test_server.host_port_pair(), ssl_config)); | |
1881 | |
1882 EXPECT_FALSE(sock->IsConnected()); | |
1883 | |
1884 rv = sock->Connect(callback.callback()); | |
1885 | |
1886 CapturingNetLog::CapturedEntryList entries; | |
1887 log.GetEntries(&entries); | |
1888 EXPECT_TRUE(LogContainsBeginEvent(entries, 5, NetLog::TYPE_SSL_CONNECT)); | |
1889 if (rv == ERR_IO_PENDING) | |
1890 rv = callback.WaitForResult(); | |
1891 EXPECT_EQ(OK, rv); | |
1892 EXPECT_TRUE(sock->IsConnected()); | |
1893 log.GetEntries(&entries); | |
1894 EXPECT_TRUE(LogContainsSSLConnectEndEvent(entries, -1)); | |
1895 | |
1896 #if !defined(USE_OPENSSL) | |
1897 EXPECT_TRUE(sock->WasStapledOCSPResponseReceived()); | |
1898 #else | |
1899 // OCSP stapling isn't currently supported in the OpenSSL socket. | |
1900 EXPECT_FALSE(sock->WasStapledOCSPResponseReceived()); | |
1901 #endif | |
1902 | |
1903 sock->Disconnect(); | |
1904 EXPECT_FALSE(sock->IsConnected()); | |
1905 } | |
1906 | |
1848 TEST_F(SSLClientSocketTest, ConnectSignedCertTimestampsDisabled) { | 1907 TEST_F(SSLClientSocketTest, ConnectSignedCertTimestampsDisabled) { |
1849 SpawnedTestServer::SSLOptions ssl_options; | 1908 SpawnedTestServer::SSLOptions ssl_options; |
1850 ssl_options.signed_cert_timestamps = "test"; | 1909 ssl_options.signed_cert_timestamps_tls_ext = "test"; |
1851 | 1910 |
1852 SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, | 1911 SpawnedTestServer test_server(SpawnedTestServer::TYPE_HTTPS, |
1853 ssl_options, | 1912 ssl_options, |
1854 base::FilePath()); | 1913 base::FilePath()); |
1855 ASSERT_TRUE(test_server.Start()); | 1914 ASSERT_TRUE(test_server.Start()); |
1856 | 1915 |
1857 AddressList addr; | 1916 AddressList addr; |
1858 ASSERT_TRUE(test_server.GetAddressList(&addr)); | 1917 ASSERT_TRUE(test_server.GetAddressList(&addr)); |
1859 | 1918 |
1860 TestCompletionCallback callback; | 1919 TestCompletionCallback callback; |
(...skipping 27 matching lines...) Expand all Loading... | |
1888 | 1947 |
1889 EXPECT_FALSE(sock->WereSignedCertTimestampsReceived()); | 1948 EXPECT_FALSE(sock->WereSignedCertTimestampsReceived()); |
1890 | 1949 |
1891 sock->Disconnect(); | 1950 sock->Disconnect(); |
1892 EXPECT_FALSE(sock->IsConnected()); | 1951 EXPECT_FALSE(sock->IsConnected()); |
1893 } | 1952 } |
1894 | 1953 |
1895 } // namespace | 1954 } // namespace |
1896 | 1955 |
1897 } // namespace net | 1956 } // namespace net |
OLD | NEW |