Support for client certs in ssl_server_socket.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <errno.h>
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <string.h>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/environment.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_local.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/openssl_util.h"
+#include "crypto/rsa_private_key.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_policy_enforcer.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/single_request_cert_verifier.h"
 #include "net/cert/x509_certificate_net_log_param.h"
 #include "net/cert/x509_util_openssl.h"
 #include "net/http/transport_security_state.h"
 #include "net/socket/ssl_session_cache_openssl.h"
+#include "net/ssl/openssl_ssl_util.h"
 #include "net/ssl/scoped_openssl_types.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
 #endif
 
 #if defined(USE_OPENSSL_CERTS)
@@ skipping 1759 matching lines @@
     }
 
     ScopedX509Stack chain = OSCertHandlesToOpenSSL(
         ssl_config_.client_cert->GetIntermediateCertificates());
     if (!chain) {
       LOG(WARNING) << "Failed to import intermediate certificates";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
       return -1;
     }
 
-    // TODO(davidben): With Linux client auth support, this should be
-    // conditioned on OS_ANDROID and then, with https://crbug.com/394131,
-    // removed altogether. OpenSSLClientKeyStore is mostly an artifact of the
-    // net/ client auth API lacking a private key handle.
+    crypto::ScopedEVP_PKEY privkey;

[davidben, 2015/03/25 00:05:33]

This entire mess should be EVP_PKEY_dup (which bumps the reference count).

+    if (client_private_key_.get()) {

[Ryan Sleevi, 2015/03/19 04:38:24]

STYLE: Don't use .get() for scoped_ptr bool testing. 

if (client_private_key_) {

+      privkey.reset(EVP_PKEY_new());
+      crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(client_private_key_->key()));
+      if (!EVP_PKEY_set1_RSA(privkey.get(), rsa.get())) {
+        privkey.reset(NULL);
+      }

[Ryan Sleevi, 2015/03/19 04:38:24]

STYLE: no braces for single-line if
STYLE: nullptr ?

+    } else {
+// TODO(davidben): With Linux client auth support, this should be
+// conditioned on OS_ANDROID and then, with https://crbug.com/394131,
+// removed altogether. OpenSSLClientKeyStore is mostly an artifact of the
+// net/ client auth API lacking a private key handle.

[Ryan Sleevi, 2015/03/19 04:38:24]

STYLE: This comment style is ugly.

If nececessary, force a newline between 1830 and 1831 to stop clang-format from
doing that ugliness.

 #if defined(USE_OPENSSL_CERTS)
-    crypto::ScopedEVP_PKEY privkey =
-        OpenSSLClientKeyStore::GetInstance()->FetchClientCertPrivateKey(
-            ssl_config_.client_cert.get());
+      privkey = OpenSSLClientKeyStore::GetInstance()
+                    ->FetchClientCertPrivateKey(ssl_config_.client_cert.get())
+                    .Pass();
 #else  // !defined(USE_OPENSSL_CERTS)
-    crypto::ScopedEVP_PKEY privkey =
-        FetchClientCertPrivateKey(ssl_config_.client_cert.get());
+      privkey = FetchClientCertPrivateKey(ssl_config_.client_cert.get()).Pass();
 #endif  // defined(USE_OPENSSL_CERTS)
+    }
     if (!privkey) {
       // Could not find the private key. Fail the handshake and surface an
       // appropriate error to the caller.
       LOG(WARNING) << "Client cert found without private key";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY);
       return -1;
     }
 
     if (!SSL_use_certificate(ssl_, leaf_x509.get()) ||
         !SSL_use_PrivateKey(ssl_, privkey.get()) ||
@@ skipping 203 matching lines @@
         SignedCertificateTimestampAndStatus(*iter,
                                             ct::SCT_STATUS_LOG_UNKNOWN));
   }
 }
 
 scoped_refptr<X509Certificate>
 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
   return server_cert_;
 }
 
+void SSLClientSocketOpenSSL::ForceClientCertificateAndKeyForTest(
+    scoped_refptr<X509Certificate> client_cert,
+    scoped_ptr<crypto::RSAPrivateKey> client_private_key) {
+  ssl_config_.send_client_cert = true;
+  ssl_config_.client_cert = client_cert;
+  client_private_key_ = client_private_key.Pass();
+}
+
 }  // namespace net