blob: 47404eaee3964c4a0cde8e4235e2314777c8827e [file] [log] [blame]
[email protected]1bc6f5e2012-03-15 00:20:581// Copyright (c) 2012 The Chromium Authors. All rights reserved.
[email protected]f61c3972010-12-23 09:54:152// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5// This test suite uses SSLClientSocket to test the implementation of
6// SSLServerSocket. In order to establish connections between the sockets
7// we need two additional classes:
8// 1. FakeSocket
9// Connects SSL socket to FakeDataChannel. This class is just a stub.
10//
11// 2. FakeDataChannel
12// Implements the actual exchange of data between two FakeSockets.
13//
14// Implementations of these two classes are included in this file.
15
16#include "net/socket/ssl_server_socket.h"
17
tbansalf82cc8e2015-10-14 20:05:4918#include <stdint.h>
[email protected]55ee0e52011-07-21 18:29:4419#include <stdlib.h>
[email protected]f61c3972010-12-23 09:54:1520#include <queue>
dchengc7eeda422015-12-26 03:56:4821#include <utility>
[email protected]f61c3972010-12-23 09:54:1522
svaldez2135be52016-04-20 16:34:5323#include <openssl/evp.h>
24#include <openssl/ssl.h>
25#include <openssl/x509.h>
26
ryanchung987b2ff2016-02-19 00:17:1227#include "base/callback_helpers.h"
[email protected]55ee0e52011-07-21 18:29:4428#include "base/compiler_specific.h"
[email protected]57999812013-02-24 05:40:5229#include "base/files/file_path.h"
thestigd8df0332014-09-04 06:33:2930#include "base/files/file_util.h"
skyostil4891b25b2015-06-11 11:43:4531#include "base/location.h"
tbansalf82cc8e2015-10-14 20:05:4932#include "base/logging.h"
Avi Drissman13fc8932015-12-20 04:40:4633#include "base/macros.h"
[email protected]18b577412013-07-18 04:19:1534#include "base/message_loop/message_loop.h"
fdoray5eeb7642016-06-22 16:11:2835#include "base/run_loop.h"
skyostil4891b25b2015-06-11 11:43:4536#include "base/single_thread_task_runner.h"
gabf767595f2016-05-11 18:50:3537#include "base/threading/thread_task_runner_handle.h"
ryanchung987b2ff2016-02-19 00:17:1238#include "build/build_config.h"
[email protected]4b559b4d2011-04-14 17:37:1439#include "crypto/nss_util.h"
40#include "crypto/rsa_private_key.h"
ryanchung987b2ff2016-02-19 00:17:1241#include "crypto/scoped_openssl_types.h"
42#include "crypto/signature_creator.h"
[email protected]f61c3972010-12-23 09:54:1543#include "net/base/address_list.h"
[email protected]6ea7b152011-12-21 21:21:1344#include "net/base/completion_callback.h"
[email protected]f61c3972010-12-23 09:54:1545#include "net/base/host_port_pair.h"
46#include "net/base/io_buffer.h"
martijna2e83bd2016-03-18 13:10:4547#include "net/base/ip_address.h"
[email protected]e7f74da2011-04-19 23:49:3548#include "net/base/ip_endpoint.h"
[email protected]f61c3972010-12-23 09:54:1549#include "net/base/net_errors.h"
[email protected]6e7845ae2013-03-29 21:48:1150#include "net/cert/cert_status_flags.h"
rsleevid6de8302016-06-21 01:33:2051#include "net/cert/ct_policy_enforcer.h"
52#include "net/cert/ct_policy_status.h"
53#include "net/cert/ct_verifier.h"
[email protected]6e7845ae2013-03-29 21:48:1154#include "net/cert/mock_cert_verifier.h"
ryanchung987b2ff2016-02-19 00:17:1255#include "net/cert/mock_client_cert_verifier.h"
[email protected]6e7845ae2013-03-29 21:48:1156#include "net/cert/x509_certificate.h"
[email protected]b1c988b2013-06-13 06:48:1157#include "net/http/transport_security_state.h"
eroman87c53d62015-04-02 06:51:0758#include "net/log/net_log.h"
[email protected]f61c3972010-12-23 09:54:1559#include "net/socket/client_socket_factory.h"
60#include "net/socket/socket_test_util.h"
61#include "net/socket/ssl_client_socket.h"
[email protected]3268023f2011-05-05 00:08:1062#include "net/socket/stream_socket.h"
ryanchung987b2ff2016-02-19 00:17:1263#include "net/ssl/scoped_openssl_types.h"
64#include "net/ssl/ssl_cert_request_info.h"
davidben9dd84872015-05-02 00:22:5865#include "net/ssl/ssl_cipher_suite_names.h"
davidben9dd84872015-05-02 00:22:5866#include "net/ssl/ssl_connection_status_flags.h"
[email protected]536fd0b2013-03-14 17:41:5767#include "net/ssl/ssl_info.h"
ryanchung987b2ff2016-02-19 00:17:1268#include "net/ssl/ssl_private_key.h"
svaldez6e7e82a22015-10-28 19:39:5369#include "net/ssl/ssl_server_config.h"
ryanchung987b2ff2016-02-19 00:17:1270#include "net/ssl/test_ssl_private_key.h"
[email protected]6e7845ae2013-03-29 21:48:1171#include "net/test/cert_test_util.h"
robpercival214763f2016-07-01 23:27:0172#include "net/test/gtest_util.h"
rsleevia69c79a2016-06-22 03:28:4373#include "net/test/test_data_directory.h"
robpercival214763f2016-07-01 23:27:0174#include "testing/gmock/include/gmock/gmock.h"
[email protected]f61c3972010-12-23 09:54:1575#include "testing/gtest/include/gtest/gtest.h"
76#include "testing/platform_test.h"
77
robpercival214763f2016-07-01 23:27:0178using net::test::IsError;
79using net::test::IsOk;
80
[email protected]f61c3972010-12-23 09:54:1581namespace net {
82
83namespace {
84
ryanchung987b2ff2016-02-19 00:17:1285const char kClientCertFileName[] = "client_1.pem";
86const char kClientPrivateKeyFileName[] = "client_1.pk8";
87const char kWrongClientCertFileName[] = "client_2.pem";
88const char kWrongClientPrivateKeyFileName[] = "client_2.pk8";
89const char kClientCertCAFileName[] = "client_1_ca.pem";
90
rsleevid6de8302016-06-21 01:33:2091class MockCTVerifier : public CTVerifier {
92 public:
93 MockCTVerifier() = default;
94 ~MockCTVerifier() override = default;
95
96 int Verify(X509Certificate* cert,
97 const std::string& stapled_ocsp_response,
98 const std::string& sct_list_from_tls_extension,
99 ct::CTVerifyResult* result,
100 const BoundNetLog& net_log) override {
101 return net::OK;
102 }
103
104 void SetObserver(Observer* observer) override {}
105};
106
107class MockCTPolicyEnforcer : public CTPolicyEnforcer {
108 public:
109 MockCTPolicyEnforcer() = default;
110 ~MockCTPolicyEnforcer() override = default;
111 ct::CertPolicyCompliance DoesConformToCertPolicy(
112 X509Certificate* cert,
113 const SCTList& verified_scts,
114 const BoundNetLog& net_log) override {
115 return ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS;
116 }
117
118 ct::EVPolicyCompliance DoesConformToCTEVPolicy(
119 X509Certificate* cert,
120 const ct::EVCertsWhitelist* ev_whitelist,
121 const SCTList& verified_scts,
122 const BoundNetLog& net_log) override {
123 return ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_SCTS;
124 }
125};
126
[email protected]f61c3972010-12-23 09:54:15127class FakeDataChannel {
128 public:
[email protected]55ee0e52011-07-21 18:29:44129 FakeDataChannel()
[email protected]83039bb2011-12-09 18:43:55130 : read_buf_len_(0),
[email protected]c0e4dd12012-05-16 19:36:31131 closed_(false),
[email protected]d5492c52013-11-10 20:44:39132 write_called_after_close_(false),
133 weak_factory_(this) {
[email protected]f61c3972010-12-23 09:54:15134 }
135
[email protected]47a12862012-04-10 01:00:49136 int Read(IOBuffer* buf, int buf_len, const CompletionCallback& callback) {
[email protected]4da82282014-07-16 18:40:43137 DCHECK(read_callback_.is_null());
dcheng08ea2af02014-08-25 23:38:09138 DCHECK(!read_buf_.get());
[email protected]c0e4dd12012-05-16 19:36:31139 if (closed_)
140 return 0;
[email protected]3f55aa12011-12-07 02:03:33141 if (data_.empty()) {
[email protected]f61c3972010-12-23 09:54:15142 read_callback_ = callback;
143 read_buf_ = buf;
144 read_buf_len_ = buf_len;
[email protected]fa6ce922014-07-17 04:27:04145 return ERR_IO_PENDING;
[email protected]f61c3972010-12-23 09:54:15146 }
tfarina9b6381442015-10-05 22:38:11147 return PropagateData(buf, buf_len);
[email protected]f61c3972010-12-23 09:54:15148 }
149
[email protected]47a12862012-04-10 01:00:49150 int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback) {
[email protected]4da82282014-07-16 18:40:43151 DCHECK(write_callback_.is_null());
[email protected]c0e4dd12012-05-16 19:36:31152 if (closed_) {
153 if (write_called_after_close_)
[email protected]fa6ce922014-07-17 04:27:04154 return ERR_CONNECTION_RESET;
[email protected]c0e4dd12012-05-16 19:36:31155 write_called_after_close_ = true;
156 write_callback_ = callback;
skyostil4891b25b2015-06-11 11:43:45157 base::ThreadTaskRunnerHandle::Get()->PostTask(
[email protected]c0e4dd12012-05-16 19:36:31158 FROM_HERE, base::Bind(&FakeDataChannel::DoWriteCallback,
159 weak_factory_.GetWeakPtr()));
[email protected]fa6ce922014-07-17 04:27:04160 return ERR_IO_PENDING;
[email protected]c0e4dd12012-05-16 19:36:31161 }
[email protected]4da82282014-07-16 18:40:43162 // This function returns synchronously, so make a copy of the buffer.
[email protected]fa6ce922014-07-17 04:27:04163 data_.push(new DrainableIOBuffer(
164 new StringIOBuffer(std::string(buf->data(), buf_len)),
[email protected]4da82282014-07-16 18:40:43165 buf_len));
skyostil4891b25b2015-06-11 11:43:45166 base::ThreadTaskRunnerHandle::Get()->PostTask(
[email protected]83039bb2011-12-09 18:43:55167 FROM_HERE, base::Bind(&FakeDataChannel::DoReadCallback,
168 weak_factory_.GetWeakPtr()));
[email protected]f61c3972010-12-23 09:54:15169 return buf_len;
170 }
171
[email protected]c0e4dd12012-05-16 19:36:31172 // Closes the FakeDataChannel. After Close() is called, Read() returns 0,
173 // indicating EOF, and Write() fails with ERR_CONNECTION_RESET. Note that
174 // after the FakeDataChannel is closed, the first Write() call completes
175 // asynchronously, which is necessary to reproduce bug 127822.
176 void Close() {
177 closed_ = true;
ryanchung987b2ff2016-02-19 00:17:12178 if (!read_callback_.is_null()) {
179 base::ThreadTaskRunnerHandle::Get()->PostTask(
180 FROM_HERE, base::Bind(&FakeDataChannel::DoReadCallback,
181 weak_factory_.GetWeakPtr()));
182 }
[email protected]c0e4dd12012-05-16 19:36:31183 }
184
[email protected]f61c3972010-12-23 09:54:15185 private:
186 void DoReadCallback() {
ryanchung987b2ff2016-02-19 00:17:12187 if (read_callback_.is_null())
188 return;
189
190 if (closed_) {
191 base::ResetAndReturn(&read_callback_).Run(ERR_CONNECTION_CLOSED);
192 return;
193 }
194
195 if (data_.empty())
[email protected]f61c3972010-12-23 09:54:15196 return;
197
tfarina9b6381442015-10-05 22:38:11198 int copied = PropagateData(read_buf_, read_buf_len_);
[email protected]83039bb2011-12-09 18:43:55199 CompletionCallback callback = read_callback_;
200 read_callback_.Reset();
201 read_buf_ = NULL;
202 read_buf_len_ = 0;
203 callback.Run(copied);
[email protected]f61c3972010-12-23 09:54:15204 }
205
[email protected]c0e4dd12012-05-16 19:36:31206 void DoWriteCallback() {
207 if (write_callback_.is_null())
208 return;
209
210 CompletionCallback callback = write_callback_;
211 write_callback_.Reset();
[email protected]fa6ce922014-07-17 04:27:04212 callback.Run(ERR_CONNECTION_RESET);
[email protected]c0e4dd12012-05-16 19:36:31213 }
214
tfarina9b6381442015-10-05 22:38:11215 int PropagateData(scoped_refptr<IOBuffer> read_buf, int read_buf_len) {
[email protected]fa6ce922014-07-17 04:27:04216 scoped_refptr<DrainableIOBuffer> buf = data_.front();
[email protected]f61c3972010-12-23 09:54:15217 int copied = std::min(buf->BytesRemaining(), read_buf_len);
218 memcpy(read_buf->data(), buf->data(), copied);
219 buf->DidConsume(copied);
220
221 if (!buf->BytesRemaining())
222 data_.pop();
223 return copied;
224 }
225
[email protected]83039bb2011-12-09 18:43:55226 CompletionCallback read_callback_;
[email protected]fa6ce922014-07-17 04:27:04227 scoped_refptr<IOBuffer> read_buf_;
[email protected]f61c3972010-12-23 09:54:15228 int read_buf_len_;
229
[email protected]c0e4dd12012-05-16 19:36:31230 CompletionCallback write_callback_;
231
[email protected]fa6ce922014-07-17 04:27:04232 std::queue<scoped_refptr<DrainableIOBuffer> > data_;
[email protected]f61c3972010-12-23 09:54:15233
[email protected]c0e4dd12012-05-16 19:36:31234 // True if Close() has been called.
235 bool closed_;
236
237 // Controls the completion of Write() after the FakeDataChannel is closed.
238 // After the FakeDataChannel is closed, the first Write() call completes
239 // asynchronously.
240 bool write_called_after_close_;
241
[email protected]d5492c52013-11-10 20:44:39242 base::WeakPtrFactory<FakeDataChannel> weak_factory_;
243
[email protected]f61c3972010-12-23 09:54:15244 DISALLOW_COPY_AND_ASSIGN(FakeDataChannel);
245};
246
[email protected]3268023f2011-05-05 00:08:10247class FakeSocket : public StreamSocket {
[email protected]f61c3972010-12-23 09:54:15248 public:
249 FakeSocket(FakeDataChannel* incoming_channel,
250 FakeDataChannel* outgoing_channel)
ryanchungeb9e3bc2016-03-08 05:08:10251 : incoming_(incoming_channel), outgoing_(outgoing_channel) {}
[email protected]f61c3972010-12-23 09:54:15252
dchengb03027d2014-10-21 12:00:20253 ~FakeSocket() override {}
[email protected]f61c3972010-12-23 09:54:15254
dchengb03027d2014-10-21 12:00:20255 int Read(IOBuffer* buf,
256 int buf_len,
257 const CompletionCallback& callback) override {
[email protected]3f55aa12011-12-07 02:03:33258 // Read random number of bytes.
259 buf_len = rand() % buf_len + 1;
260 return incoming_->Read(buf, buf_len, callback);
261 }
[email protected]f61c3972010-12-23 09:54:15262
dchengb03027d2014-10-21 12:00:20263 int Write(IOBuffer* buf,
264 int buf_len,
265 const CompletionCallback& callback) override {
[email protected]55ee0e52011-07-21 18:29:44266 // Write random number of bytes.
267 buf_len = rand() % buf_len + 1;
[email protected]f61c3972010-12-23 09:54:15268 return outgoing_->Write(buf, buf_len, callback);
269 }
270
Avi Drissman13fc8932015-12-20 04:40:46271 int SetReceiveBufferSize(int32_t size) override { return OK; }
[email protected]f61c3972010-12-23 09:54:15272
Avi Drissman13fc8932015-12-20 04:40:46273 int SetSendBufferSize(int32_t size) override { return OK; }
[email protected]f61c3972010-12-23 09:54:15274
dchengb03027d2014-10-21 12:00:20275 int Connect(const CompletionCallback& callback) override { return OK; }
[email protected]f61c3972010-12-23 09:54:15276
dchengb03027d2014-10-21 12:00:20277 void Disconnect() override {
[email protected]c0e4dd12012-05-16 19:36:31278 incoming_->Close();
279 outgoing_->Close();
280 }
[email protected]f61c3972010-12-23 09:54:15281
dchengb03027d2014-10-21 12:00:20282 bool IsConnected() const override { return true; }
[email protected]f61c3972010-12-23 09:54:15283
dchengb03027d2014-10-21 12:00:20284 bool IsConnectedAndIdle() const override { return true; }
[email protected]f61c3972010-12-23 09:54:15285
dchengb03027d2014-10-21 12:00:20286 int GetPeerAddress(IPEndPoint* address) const override {
martijna2e83bd2016-03-18 13:10:45287 *address = IPEndPoint(IPAddress::IPv4AllZeros(), 0 /*port*/);
[email protected]fa6ce922014-07-17 04:27:04288 return OK;
[email protected]f61c3972010-12-23 09:54:15289 }
290
dchengb03027d2014-10-21 12:00:20291 int GetLocalAddress(IPEndPoint* address) const override {
martijna2e83bd2016-03-18 13:10:45292 *address = IPEndPoint(IPAddress::IPv4AllZeros(), 0 /*port*/);
[email protected]fa6ce922014-07-17 04:27:04293 return OK;
[email protected]e7f74da2011-04-19 23:49:35294 }
295
dchengb03027d2014-10-21 12:00:20296 const BoundNetLog& NetLog() const override { return net_log_; }
[email protected]f61c3972010-12-23 09:54:15297
dchengb03027d2014-10-21 12:00:20298 void SetSubresourceSpeculation() override {}
299 void SetOmniboxSpeculation() override {}
[email protected]f61c3972010-12-23 09:54:15300
dchengb03027d2014-10-21 12:00:20301 bool WasEverUsed() const override { return true; }
[email protected]f61c3972010-12-23 09:54:15302
dchengb03027d2014-10-21 12:00:20303 bool WasNpnNegotiated() const override { return false; }
[email protected]5e6efa52011-06-27 17:26:41304
dchengb03027d2014-10-21 12:00:20305 NextProto GetNegotiatedProtocol() const override { return kProtoUnknown; }
[email protected]2d88e7d2012-07-19 17:55:17306
dchengb03027d2014-10-21 12:00:20307 bool GetSSLInfo(SSLInfo* ssl_info) override { return false; }
[email protected]2d88e7d2012-07-19 17:55:17308
ttuttle23fdb7b2015-05-15 01:28:03309 void GetConnectionAttempts(ConnectionAttempts* out) const override {
310 out->clear();
311 }
312
313 void ClearConnectionAttempts() override {}
314
315 void AddConnectionAttempts(const ConnectionAttempts& attempts) override {}
316
tbansalf82cc8e2015-10-14 20:05:49317 int64_t GetTotalReceivedBytes() const override {
318 NOTIMPLEMENTED();
319 return 0;
320 }
321
[email protected]f61c3972010-12-23 09:54:15322 private:
[email protected]fa6ce922014-07-17 04:27:04323 BoundNetLog net_log_;
[email protected]f61c3972010-12-23 09:54:15324 FakeDataChannel* incoming_;
325 FakeDataChannel* outgoing_;
326
327 DISALLOW_COPY_AND_ASSIGN(FakeSocket);
328};
329
330} // namespace
331
332// Verify the correctness of the test helper classes first.
333TEST(FakeSocketTest, DataTransfer) {
334 // Establish channels between two sockets.
335 FakeDataChannel channel_1;
336 FakeDataChannel channel_2;
337 FakeSocket client(&channel_1, &channel_2);
338 FakeSocket server(&channel_2, &channel_1);
339
340 const char kTestData[] = "testing123";
341 const int kTestDataSize = strlen(kTestData);
342 const int kReadBufSize = 1024;
[email protected]fa6ce922014-07-17 04:27:04343 scoped_refptr<IOBuffer> write_buf = new StringIOBuffer(kTestData);
344 scoped_refptr<IOBuffer> read_buf = new IOBuffer(kReadBufSize);
[email protected]f61c3972010-12-23 09:54:15345
346 // Write then read.
[email protected]90499482013-06-01 00:39:50347 int written =
348 server.Write(write_buf.get(), kTestDataSize, CompletionCallback());
[email protected]55ee0e52011-07-21 18:29:44349 EXPECT_GT(written, 0);
350 EXPECT_LE(written, kTestDataSize);
351
[email protected]90499482013-06-01 00:39:50352 int read = client.Read(read_buf.get(), kReadBufSize, CompletionCallback());
[email protected]55ee0e52011-07-21 18:29:44353 EXPECT_GT(read, 0);
354 EXPECT_LE(read, written);
355 EXPECT_EQ(0, memcmp(kTestData, read_buf->data(), read));
[email protected]f61c3972010-12-23 09:54:15356
357 // Read then write.
[email protected]83039bb2011-12-09 18:43:55358 TestCompletionCallback callback;
[email protected]fa6ce922014-07-17 04:27:04359 EXPECT_EQ(ERR_IO_PENDING,
[email protected]90499482013-06-01 00:39:50360 server.Read(read_buf.get(), kReadBufSize, callback.callback()));
[email protected]55ee0e52011-07-21 18:29:44361
[email protected]90499482013-06-01 00:39:50362 written = client.Write(write_buf.get(), kTestDataSize, CompletionCallback());
[email protected]55ee0e52011-07-21 18:29:44363 EXPECT_GT(written, 0);
364 EXPECT_LE(written, kTestDataSize);
365
366 read = callback.WaitForResult();
367 EXPECT_GT(read, 0);
368 EXPECT_LE(read, written);
369 EXPECT_EQ(0, memcmp(kTestData, read_buf->data(), read));
[email protected]f61c3972010-12-23 09:54:15370}
371
372class SSLServerSocketTest : public PlatformTest {
373 public:
374 SSLServerSocketTest()
[email protected]fa6ce922014-07-17 04:27:04375 : socket_factory_(ClientSocketFactory::GetDefaultFactory()),
[email protected]b1c988b2013-06-13 06:48:11376 cert_verifier_(new MockCertVerifier()),
ryanchung987b2ff2016-02-19 00:17:12377 client_cert_verifier_(new MockClientCertVerifier()),
rsleevid6de8302016-06-21 01:33:20378 transport_security_state_(new TransportSecurityState),
379 ct_verifier_(new MockCTVerifier),
380 ct_policy_enforcer_(new MockCTPolicyEnforcer) {}
rsleevia5c430222016-03-11 05:55:12381
382 void SetUp() override {
383 PlatformTest::SetUp();
384
ryanchung987b2ff2016-02-19 00:17:12385 cert_verifier_->set_default_result(ERR_CERT_AUTHORITY_INVALID);
386 client_cert_verifier_->set_default_result(ERR_CERT_AUTHORITY_INVALID);
[email protected]f61c3972010-12-23 09:54:15387
ryanchungeb9e3bc2016-03-08 05:08:10388 server_cert_ =
389 ImportCertFromFile(GetTestCertsDirectory(), "unittest.selfsigned.der");
rsleevia5c430222016-03-11 05:55:12390 ASSERT_TRUE(server_cert_);
ryanchungeb9e3bc2016-03-08 05:08:10391 server_private_key_ = ReadTestKey("unittest.key.bin");
rsleevia5c430222016-03-11 05:55:12392 ASSERT_TRUE(server_private_key_);
[email protected]f61c3972010-12-23 09:54:15393
sergeyuff826d5e2015-05-13 20:35:22394 client_ssl_config_.false_start_enabled = false;
395 client_ssl_config_.channel_id_enabled = false;
[email protected]f61c3972010-12-23 09:54:15396
397 // Certificate provided by the host doesn't need authority.
rsleevi74e99742016-09-13 20:35:25398 client_ssl_config_.allowed_bad_certs.emplace_back(
399 server_cert_, CERT_STATUS_AUTHORITY_INVALID);
ryanchungeb9e3bc2016-03-08 05:08:10400 }
401
402 protected:
403 void CreateContext() {
404 client_socket_.reset();
405 server_socket_.reset();
406 channel_1_.reset();
407 channel_2_.reset();
408 server_context_.reset();
409 server_context_ = CreateSSLServerContext(
410 server_cert_.get(), *server_private_key_, server_ssl_config_);
411 }
412
413 void CreateSockets() {
414 client_socket_.reset();
415 server_socket_.reset();
416 channel_1_.reset(new FakeDataChannel());
417 channel_2_.reset(new FakeDataChannel());
danakj655b66c2016-04-16 00:51:38418 std::unique_ptr<ClientSocketHandle> client_connection(
419 new ClientSocketHandle);
420 client_connection->SetSocket(std::unique_ptr<StreamSocket>(
ryanchungeb9e3bc2016-03-08 05:08:10421 new FakeSocket(channel_1_.get(), channel_2_.get())));
danakj655b66c2016-04-16 00:51:38422 std::unique_ptr<StreamSocket> server_socket(
ryanchungeb9e3bc2016-03-08 05:08:10423 new FakeSocket(channel_2_.get(), channel_1_.get()));
[email protected]f61c3972010-12-23 09:54:15424
[email protected]fa6ce922014-07-17 04:27:04425 HostPortPair host_and_pair("unittest", 0);
426 SSLClientSocketContext context;
[email protected]9f59fac2012-03-21 23:18:11427 context.cert_verifier = cert_verifier_.get();
[email protected]b1c988b2013-06-13 06:48:11428 context.transport_security_state = transport_security_state_.get();
rsleevid6de8302016-06-21 01:33:20429 context.cert_transparency_verifier = ct_verifier_.get();
430 context.ct_policy_enforcer = ct_policy_enforcer_.get();
rsleevia5c430222016-03-11 05:55:12431
sergeyuff826d5e2015-05-13 20:35:22432 client_socket_ = socket_factory_->CreateSSLClientSocket(
dchengc7eeda422015-12-26 03:56:48433 std::move(client_connection), host_and_pair, client_ssl_config_,
434 context);
rsleevia5c430222016-03-11 05:55:12435 ASSERT_TRUE(client_socket_);
ryanchungeb9e3bc2016-03-08 05:08:10436
ryanchung987b2ff2016-02-19 00:17:12437 server_socket_ =
ryanchungeb9e3bc2016-03-08 05:08:10438 server_context_->CreateSSLServerSocket(std::move(server_socket));
rsleevia5c430222016-03-11 05:55:12439 ASSERT_TRUE(server_socket_);
[email protected]f61c3972010-12-23 09:54:15440 }
441
ryanchung987b2ff2016-02-19 00:17:12442 void ConfigureClientCertsForClient(const char* cert_file_name,
443 const char* private_key_file_name) {
444 client_ssl_config_.send_client_cert = true;
445 client_ssl_config_.client_cert =
446 ImportCertFromFile(GetTestCertsDirectory(), cert_file_name);
447 ASSERT_TRUE(client_ssl_config_.client_cert);
rsleevia5c430222016-03-11 05:55:12448
danakj655b66c2016-04-16 00:51:38449 std::unique_ptr<crypto::RSAPrivateKey> key =
450 ReadTestKey(private_key_file_name);
ryanchung987b2ff2016-02-19 00:17:12451 ASSERT_TRUE(key);
rsleevia5c430222016-03-11 05:55:12452
agl5a7cadf2016-07-13 16:52:53453 EVP_PKEY_up_ref(key->key());
454 client_ssl_config_.client_private_key =
455 WrapOpenSSLPrivateKey(crypto::ScopedEVP_PKEY(key->key()));
ryanchung987b2ff2016-02-19 00:17:12456 }
457
458 void ConfigureClientCertsForServer() {
459 server_ssl_config_.client_cert_type =
460 SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT;
461
462 ScopedX509NameStack cert_names(
463 SSL_load_client_CA_file(GetTestCertsDirectory()
464 .AppendASCII(kClientCertCAFileName)
465 .MaybeAsASCII()
466 .c_str()));
467 ASSERT_TRUE(cert_names);
rsleevia5c430222016-03-11 05:55:12468
ryanchung987b2ff2016-02-19 00:17:12469 for (size_t i = 0; i < sk_X509_NAME_num(cert_names.get()); ++i) {
470 uint8_t* str = nullptr;
471 int length = i2d_X509_NAME(sk_X509_NAME_value(cert_names.get(), i), &str);
rsleevia5c430222016-03-11 05:55:12472 ASSERT_LT(0, length);
473
ryanchung987b2ff2016-02-19 00:17:12474 server_ssl_config_.cert_authorities_.push_back(std::string(
475 reinterpret_cast<const char*>(str), static_cast<size_t>(length)));
476 OPENSSL_free(str);
477 }
478
479 scoped_refptr<X509Certificate> expected_client_cert(
480 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName));
rsleevia5c430222016-03-11 05:55:12481 ASSERT_TRUE(expected_client_cert);
482
ryanchung987b2ff2016-02-19 00:17:12483 client_cert_verifier_->AddResultForCert(expected_client_cert.get(), OK);
484
485 server_ssl_config_.client_cert_verifier = client_cert_verifier_.get();
486 }
487
danakj655b66c2016-04-16 00:51:38488 std::unique_ptr<crypto::RSAPrivateKey> ReadTestKey(
489 const base::StringPiece& name) {
ryanchung987b2ff2016-02-19 00:17:12490 base::FilePath certs_dir(GetTestCertsDirectory());
491 base::FilePath key_path = certs_dir.AppendASCII(name);
492 std::string key_string;
493 if (!base::ReadFileToString(key_path, &key_string))
494 return nullptr;
495 std::vector<uint8_t> key_vector(
496 reinterpret_cast<const uint8_t*>(key_string.data()),
497 reinterpret_cast<const uint8_t*>(key_string.data() +
498 key_string.length()));
danakj655b66c2016-04-16 00:51:38499 std::unique_ptr<crypto::RSAPrivateKey> key(
ryanchung987b2ff2016-02-19 00:17:12500 crypto::RSAPrivateKey::CreateFromPrivateKeyInfo(key_vector));
501 return key;
502 }
ryanchung987b2ff2016-02-19 00:17:12503
danakj655b66c2016-04-16 00:51:38504 std::unique_ptr<FakeDataChannel> channel_1_;
505 std::unique_ptr<FakeDataChannel> channel_2_;
sergeyuff826d5e2015-05-13 20:35:22506 SSLConfig client_ssl_config_;
svaldez6e7e82a22015-10-28 19:39:53507 SSLServerConfig server_ssl_config_;
danakj655b66c2016-04-16 00:51:38508 std::unique_ptr<SSLClientSocket> client_socket_;
509 std::unique_ptr<SSLServerSocket> server_socket_;
[email protected]fa6ce922014-07-17 04:27:04510 ClientSocketFactory* socket_factory_;
danakj655b66c2016-04-16 00:51:38511 std::unique_ptr<MockCertVerifier> cert_verifier_;
512 std::unique_ptr<MockClientCertVerifier> client_cert_verifier_;
513 std::unique_ptr<TransportSecurityState> transport_security_state_;
rsleevid6de8302016-06-21 01:33:20514 std::unique_ptr<MockCTVerifier> ct_verifier_;
515 std::unique_ptr<MockCTPolicyEnforcer> ct_policy_enforcer_;
danakj655b66c2016-04-16 00:51:38516 std::unique_ptr<SSLServerContext> server_context_;
517 std::unique_ptr<crypto::RSAPrivateKey> server_private_key_;
ryanchungeb9e3bc2016-03-08 05:08:10518 scoped_refptr<X509Certificate> server_cert_;
[email protected]f61c3972010-12-23 09:54:15519};
520
[email protected]f61c3972010-12-23 09:54:15521// This test only executes creation of client and server sockets. This is to
522// test that creation of sockets doesn't crash and have minimal code to run
523// under valgrind in order to help debugging memory problems.
524TEST_F(SSLServerSocketTest, Initialize) {
rsleevia5c430222016-03-11 05:55:12525 ASSERT_NO_FATAL_FAILURE(CreateContext());
526 ASSERT_NO_FATAL_FAILURE(CreateSockets());
[email protected]f61c3972010-12-23 09:54:15527}
528
[email protected]a7ac3c32011-06-17 19:10:15529// This test executes Connect() on SSLClientSocket and Handshake() on
530// SSLServerSocket to make sure handshaking between the two sockets is
[email protected]f61c3972010-12-23 09:54:15531// completed successfully.
532TEST_F(SSLServerSocketTest, Handshake) {
rsleevia5c430222016-03-11 05:55:12533 ASSERT_NO_FATAL_FAILURE(CreateContext());
534 ASSERT_NO_FATAL_FAILURE(CreateSockets());
[email protected]f61c3972010-12-23 09:54:15535
[email protected]6ea7b152011-12-21 21:21:13536 TestCompletionCallback handshake_callback;
[email protected]6ea7b152011-12-21 21:21:13537 int server_ret = server_socket_->Handshake(handshake_callback.callback());
[email protected]f61c3972010-12-23 09:54:15538
ryanchung987b2ff2016-02-19 00:17:12539 TestCompletionCallback connect_callback;
[email protected]83039bb2011-12-09 18:43:55540 int client_ret = client_socket_->Connect(connect_callback.callback());
[email protected]f61c3972010-12-23 09:54:15541
ryanchung987b2ff2016-02-19 00:17:12542 client_ret = connect_callback.GetResult(client_ret);
543 server_ret = handshake_callback.GetResult(server_ret);
544
robpercival214763f2016-07-01 23:27:01545 ASSERT_THAT(client_ret, IsOk());
546 ASSERT_THAT(server_ret, IsOk());
[email protected]4dc832e2011-04-28 22:04:24547
548 // Make sure the cert status is expected.
549 SSLInfo ssl_info;
davidben9dd84872015-05-02 00:22:58550 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info));
[email protected]4dc832e2011-04-28 22:04:24551 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, ssl_info.cert_status);
davidben9dd84872015-05-02 00:22:58552
553 // The default cipher suite should be ECDHE and, unless on NSS and the
554 // platform doesn't support it, an AEAD.
555 uint16_t cipher_suite =
556 SSLConnectionStatusToCipherSuite(ssl_info.connection_status);
557 const char* key_exchange;
558 const char* cipher;
559 const char* mac;
560 bool is_aead;
561 SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, cipher_suite);
562 EXPECT_STREQ("ECDHE_RSA", key_exchange);
davidben6cacd572015-09-29 22:24:10563 EXPECT_TRUE(is_aead);
[email protected]f61c3972010-12-23 09:54:15564}
565
ryanchungeb9e3bc2016-03-08 05:08:10566// This test makes sure the session cache is working.
567TEST_F(SSLServerSocketTest, HandshakeCached) {
rsleevia5c430222016-03-11 05:55:12568 ASSERT_NO_FATAL_FAILURE(CreateContext());
569 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10570
571 TestCompletionCallback handshake_callback;
572 int server_ret = server_socket_->Handshake(handshake_callback.callback());
573
574 TestCompletionCallback connect_callback;
575 int client_ret = client_socket_->Connect(connect_callback.callback());
576
577 client_ret = connect_callback.GetResult(client_ret);
578 server_ret = handshake_callback.GetResult(server_ret);
579
robpercival214763f2016-07-01 23:27:01580 ASSERT_THAT(client_ret, IsOk());
581 ASSERT_THAT(server_ret, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10582
583 // Make sure the cert status is expected.
584 SSLInfo ssl_info;
585 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info));
586 EXPECT_EQ(ssl_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
587 SSLInfo ssl_server_info;
588 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info));
589 EXPECT_EQ(ssl_server_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
590
591 // Make sure the second connection is cached.
rsleevia5c430222016-03-11 05:55:12592 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10593 TestCompletionCallback handshake_callback2;
594 int server_ret2 = server_socket_->Handshake(handshake_callback2.callback());
595
596 TestCompletionCallback connect_callback2;
597 int client_ret2 = client_socket_->Connect(connect_callback2.callback());
598
599 client_ret2 = connect_callback2.GetResult(client_ret2);
600 server_ret2 = handshake_callback2.GetResult(server_ret2);
601
robpercival214763f2016-07-01 23:27:01602 ASSERT_THAT(client_ret2, IsOk());
603 ASSERT_THAT(server_ret2, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10604
605 // Make sure the cert status is expected.
606 SSLInfo ssl_info2;
607 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info2));
608 EXPECT_EQ(ssl_info2.handshake_type, SSLInfo::HANDSHAKE_RESUME);
609 SSLInfo ssl_server_info2;
610 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info2));
611 EXPECT_EQ(ssl_server_info2.handshake_type, SSLInfo::HANDSHAKE_RESUME);
612}
613
614// This test makes sure the session cache separates out by server context.
615TEST_F(SSLServerSocketTest, HandshakeCachedContextSwitch) {
rsleevia5c430222016-03-11 05:55:12616 ASSERT_NO_FATAL_FAILURE(CreateContext());
617 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10618
619 TestCompletionCallback handshake_callback;
620 int server_ret = server_socket_->Handshake(handshake_callback.callback());
621
622 TestCompletionCallback connect_callback;
623 int client_ret = client_socket_->Connect(connect_callback.callback());
624
625 client_ret = connect_callback.GetResult(client_ret);
626 server_ret = handshake_callback.GetResult(server_ret);
627
robpercival214763f2016-07-01 23:27:01628 ASSERT_THAT(client_ret, IsOk());
629 ASSERT_THAT(server_ret, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10630
631 // Make sure the cert status is expected.
632 SSLInfo ssl_info;
633 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info));
634 EXPECT_EQ(ssl_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
635 SSLInfo ssl_server_info;
636 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info));
637 EXPECT_EQ(ssl_server_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
638
639 // Make sure the second connection is NOT cached when using a new context.
rsleevia5c430222016-03-11 05:55:12640 ASSERT_NO_FATAL_FAILURE(CreateContext());
641 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10642
643 TestCompletionCallback handshake_callback2;
644 int server_ret2 = server_socket_->Handshake(handshake_callback2.callback());
645
646 TestCompletionCallback connect_callback2;
647 int client_ret2 = client_socket_->Connect(connect_callback2.callback());
648
649 client_ret2 = connect_callback2.GetResult(client_ret2);
650 server_ret2 = handshake_callback2.GetResult(server_ret2);
651
robpercival214763f2016-07-01 23:27:01652 ASSERT_THAT(client_ret2, IsOk());
653 ASSERT_THAT(server_ret2, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10654
655 // Make sure the cert status is expected.
656 SSLInfo ssl_info2;
657 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info2));
658 EXPECT_EQ(ssl_info2.handshake_type, SSLInfo::HANDSHAKE_FULL);
659 SSLInfo ssl_server_info2;
660 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info2));
661 EXPECT_EQ(ssl_server_info2.handshake_type, SSLInfo::HANDSHAKE_FULL);
662}
663
ryanchung987b2ff2016-02-19 00:17:12664// This test executes Connect() on SSLClientSocket and Handshake() on
665// SSLServerSocket to make sure handshaking between the two sockets is
666// completed successfully, using client certificate.
667TEST_F(SSLServerSocketTest, HandshakeWithClientCert) {
668 scoped_refptr<X509Certificate> client_cert =
669 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12670 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForClient(
671 kClientCertFileName, kClientPrivateKeyFileName));
672 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
673 ASSERT_NO_FATAL_FAILURE(CreateContext());
674 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchung987b2ff2016-02-19 00:17:12675
676 TestCompletionCallback handshake_callback;
677 int server_ret = server_socket_->Handshake(handshake_callback.callback());
678
679 TestCompletionCallback connect_callback;
680 int client_ret = client_socket_->Connect(connect_callback.callback());
681
682 client_ret = connect_callback.GetResult(client_ret);
683 server_ret = handshake_callback.GetResult(server_ret);
684
robpercival214763f2016-07-01 23:27:01685 ASSERT_THAT(client_ret, IsOk());
686 ASSERT_THAT(server_ret, IsOk());
ryanchung987b2ff2016-02-19 00:17:12687
688 // Make sure the cert status is expected.
689 SSLInfo ssl_info;
690 client_socket_->GetSSLInfo(&ssl_info);
691 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, ssl_info.cert_status);
692 server_socket_->GetSSLInfo(&ssl_info);
rsleevia5c430222016-03-11 05:55:12693 ASSERT_TRUE(ssl_info.cert.get());
ryanchung987b2ff2016-02-19 00:17:12694 EXPECT_TRUE(client_cert->Equals(ssl_info.cert.get()));
695}
696
ryanchungeb9e3bc2016-03-08 05:08:10697// This test executes Connect() on SSLClientSocket and Handshake() twice on
698// SSLServerSocket to make sure handshaking between the two sockets is
699// completed successfully, using client certificate. The second connection is
700// expected to succeed through the session cache.
701TEST_F(SSLServerSocketTest, HandshakeWithClientCertCached) {
702 scoped_refptr<X509Certificate> client_cert =
703 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12704 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForClient(
705 kClientCertFileName, kClientPrivateKeyFileName));
706 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
707 ASSERT_NO_FATAL_FAILURE(CreateContext());
708 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10709
710 TestCompletionCallback handshake_callback;
711 int server_ret = server_socket_->Handshake(handshake_callback.callback());
712
713 TestCompletionCallback connect_callback;
714 int client_ret = client_socket_->Connect(connect_callback.callback());
715
716 client_ret = connect_callback.GetResult(client_ret);
717 server_ret = handshake_callback.GetResult(server_ret);
718
robpercival214763f2016-07-01 23:27:01719 ASSERT_THAT(client_ret, IsOk());
720 ASSERT_THAT(server_ret, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10721
722 // Make sure the cert status is expected.
723 SSLInfo ssl_info;
724 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info));
725 EXPECT_EQ(ssl_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
726 SSLInfo ssl_server_info;
727 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info));
728 ASSERT_TRUE(ssl_server_info.cert.get());
729 EXPECT_TRUE(client_cert->Equals(ssl_server_info.cert.get()));
730 EXPECT_EQ(ssl_server_info.handshake_type, SSLInfo::HANDSHAKE_FULL);
731 server_socket_->Disconnect();
732 client_socket_->Disconnect();
733
734 // Create the connection again.
rsleevia5c430222016-03-11 05:55:12735 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10736 TestCompletionCallback handshake_callback2;
737 int server_ret2 = server_socket_->Handshake(handshake_callback2.callback());
738
739 TestCompletionCallback connect_callback2;
740 int client_ret2 = client_socket_->Connect(connect_callback2.callback());
741
742 client_ret2 = connect_callback2.GetResult(client_ret2);
743 server_ret2 = handshake_callback2.GetResult(server_ret2);
744
robpercival214763f2016-07-01 23:27:01745 ASSERT_THAT(client_ret2, IsOk());
746 ASSERT_THAT(server_ret2, IsOk());
ryanchungeb9e3bc2016-03-08 05:08:10747
748 // Make sure the cert status is expected.
749 SSLInfo ssl_info2;
750 ASSERT_TRUE(client_socket_->GetSSLInfo(&ssl_info2));
751 EXPECT_EQ(ssl_info2.handshake_type, SSLInfo::HANDSHAKE_RESUME);
752 SSLInfo ssl_server_info2;
753 ASSERT_TRUE(server_socket_->GetSSLInfo(&ssl_server_info2));
754 ASSERT_TRUE(ssl_server_info2.cert.get());
755 EXPECT_TRUE(client_cert->Equals(ssl_server_info2.cert.get()));
756 EXPECT_EQ(ssl_server_info2.handshake_type, SSLInfo::HANDSHAKE_RESUME);
757}
758
ryanchung987b2ff2016-02-19 00:17:12759TEST_F(SSLServerSocketTest, HandshakeWithClientCertRequiredNotSupplied) {
rsleevia5c430222016-03-11 05:55:12760 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
761 ASSERT_NO_FATAL_FAILURE(CreateContext());
762 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchung987b2ff2016-02-19 00:17:12763 // Use the default setting for the client socket, which is to not send
764 // a client certificate. This will cause the client to receive an
765 // ERR_SSL_CLIENT_AUTH_CERT_NEEDED error, and allow for inspecting the
766 // requested cert_authorities from the CertificateRequest sent by the
767 // server.
768
769 TestCompletionCallback handshake_callback;
770 int server_ret = server_socket_->Handshake(handshake_callback.callback());
771
772 TestCompletionCallback connect_callback;
773 EXPECT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED,
774 connect_callback.GetResult(
775 client_socket_->Connect(connect_callback.callback())));
776
777 scoped_refptr<SSLCertRequestInfo> request_info = new SSLCertRequestInfo();
778 client_socket_->GetSSLCertRequestInfo(request_info.get());
779
780 // Check that the authority name that arrived in the CertificateRequest
781 // handshake message is as expected.
782 scoped_refptr<X509Certificate> client_cert =
783 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12784 ASSERT_TRUE(client_cert);
ryanchung987b2ff2016-02-19 00:17:12785 EXPECT_TRUE(client_cert->IsIssuedByEncoded(request_info->cert_authorities));
786
787 client_socket_->Disconnect();
788
robpercival214763f2016-07-01 23:27:01789 EXPECT_THAT(handshake_callback.GetResult(server_ret), IsError(ERR_FAILED));
ryanchung987b2ff2016-02-19 00:17:12790}
791
ryanchungeb9e3bc2016-03-08 05:08:10792TEST_F(SSLServerSocketTest, HandshakeWithClientCertRequiredNotSuppliedCached) {
rsleevia5c430222016-03-11 05:55:12793 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
794 ASSERT_NO_FATAL_FAILURE(CreateContext());
795 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10796 // Use the default setting for the client socket, which is to not send
797 // a client certificate. This will cause the client to receive an
798 // ERR_SSL_CLIENT_AUTH_CERT_NEEDED error, and allow for inspecting the
799 // requested cert_authorities from the CertificateRequest sent by the
800 // server.
801
802 TestCompletionCallback handshake_callback;
803 int server_ret = server_socket_->Handshake(handshake_callback.callback());
804
805 TestCompletionCallback connect_callback;
806 EXPECT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED,
807 connect_callback.GetResult(
808 client_socket_->Connect(connect_callback.callback())));
809
810 scoped_refptr<SSLCertRequestInfo> request_info = new SSLCertRequestInfo();
811 client_socket_->GetSSLCertRequestInfo(request_info.get());
812
813 // Check that the authority name that arrived in the CertificateRequest
814 // handshake message is as expected.
815 scoped_refptr<X509Certificate> client_cert =
816 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12817 ASSERT_TRUE(client_cert);
ryanchungeb9e3bc2016-03-08 05:08:10818 EXPECT_TRUE(client_cert->IsIssuedByEncoded(request_info->cert_authorities));
819
820 client_socket_->Disconnect();
821
robpercival214763f2016-07-01 23:27:01822 EXPECT_THAT(handshake_callback.GetResult(server_ret), IsError(ERR_FAILED));
ryanchungeb9e3bc2016-03-08 05:08:10823 server_socket_->Disconnect();
824
825 // Below, check that the cache didn't store the result of a failed handshake.
rsleevia5c430222016-03-11 05:55:12826 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10827 TestCompletionCallback handshake_callback2;
828 int server_ret2 = server_socket_->Handshake(handshake_callback2.callback());
829
830 TestCompletionCallback connect_callback2;
831 EXPECT_EQ(ERR_SSL_CLIENT_AUTH_CERT_NEEDED,
832 connect_callback2.GetResult(
833 client_socket_->Connect(connect_callback2.callback())));
834
835 scoped_refptr<SSLCertRequestInfo> request_info2 = new SSLCertRequestInfo();
836 client_socket_->GetSSLCertRequestInfo(request_info2.get());
837
838 // Check that the authority name that arrived in the CertificateRequest
839 // handshake message is as expected.
840 EXPECT_TRUE(client_cert->IsIssuedByEncoded(request_info2->cert_authorities));
841
842 client_socket_->Disconnect();
843
robpercival214763f2016-07-01 23:27:01844 EXPECT_THAT(handshake_callback2.GetResult(server_ret2), IsError(ERR_FAILED));
ryanchungeb9e3bc2016-03-08 05:08:10845}
846
ryanchung987b2ff2016-02-19 00:17:12847TEST_F(SSLServerSocketTest, HandshakeWithWrongClientCertSupplied) {
848 scoped_refptr<X509Certificate> client_cert =
849 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12850 ASSERT_TRUE(client_cert);
851
852 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForClient(
853 kWrongClientCertFileName, kWrongClientPrivateKeyFileName));
854 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
855 ASSERT_NO_FATAL_FAILURE(CreateContext());
856 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchung987b2ff2016-02-19 00:17:12857
858 TestCompletionCallback handshake_callback;
859 int server_ret = server_socket_->Handshake(handshake_callback.callback());
860
861 TestCompletionCallback connect_callback;
862 int client_ret = client_socket_->Connect(connect_callback.callback());
863
864 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
865 connect_callback.GetResult(client_ret));
866 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
867 handshake_callback.GetResult(server_ret));
868}
ryanchungeb9e3bc2016-03-08 05:08:10869
870TEST_F(SSLServerSocketTest, HandshakeWithWrongClientCertSuppliedCached) {
871 scoped_refptr<X509Certificate> client_cert =
872 ImportCertFromFile(GetTestCertsDirectory(), kClientCertFileName);
rsleevia5c430222016-03-11 05:55:12873 ASSERT_TRUE(client_cert);
874
875 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForClient(
876 kWrongClientCertFileName, kWrongClientPrivateKeyFileName));
877 ASSERT_NO_FATAL_FAILURE(ConfigureClientCertsForServer());
878 ASSERT_NO_FATAL_FAILURE(CreateContext());
879 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10880
881 TestCompletionCallback handshake_callback;
882 int server_ret = server_socket_->Handshake(handshake_callback.callback());
883
884 TestCompletionCallback connect_callback;
885 int client_ret = client_socket_->Connect(connect_callback.callback());
886
887 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
888 connect_callback.GetResult(client_ret));
889 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
890 handshake_callback.GetResult(server_ret));
891
892 client_socket_->Disconnect();
893 server_socket_->Disconnect();
894
895 // Below, check that the cache didn't store the result of a failed handshake.
rsleevia5c430222016-03-11 05:55:12896 ASSERT_NO_FATAL_FAILURE(CreateSockets());
ryanchungeb9e3bc2016-03-08 05:08:10897 TestCompletionCallback handshake_callback2;
898 int server_ret2 = server_socket_->Handshake(handshake_callback2.callback());
899
900 TestCompletionCallback connect_callback2;
901 int client_ret2 = client_socket_->Connect(connect_callback2.callback());
902
903 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
904 connect_callback2.GetResult(client_ret2));
905 EXPECT_EQ(ERR_BAD_SSL_CLIENT_AUTH_CERT,
906 handshake_callback2.GetResult(server_ret2));
907}
ryanchung987b2ff2016-02-19 00:17:12908
[email protected]f61c3972010-12-23 09:54:15909TEST_F(SSLServerSocketTest, DataTransfer) {
rsleevia5c430222016-03-11 05:55:12910 ASSERT_NO_FATAL_FAILURE(CreateContext());
911 ASSERT_NO_FATAL_FAILURE(CreateSockets());
[email protected]f61c3972010-12-23 09:54:15912
[email protected]f61c3972010-12-23 09:54:15913 // Establish connection.
ryanchung987b2ff2016-02-19 00:17:12914 TestCompletionCallback connect_callback;
[email protected]83039bb2011-12-09 18:43:55915 int client_ret = client_socket_->Connect(connect_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04916 ASSERT_TRUE(client_ret == OK || client_ret == ERR_IO_PENDING);
[email protected]f61c3972010-12-23 09:54:15917
ryanchung987b2ff2016-02-19 00:17:12918 TestCompletionCallback handshake_callback;
[email protected]6ea7b152011-12-21 21:21:13919 int server_ret = server_socket_->Handshake(handshake_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04920 ASSERT_TRUE(server_ret == OK || server_ret == ERR_IO_PENDING);
[email protected]f61c3972010-12-23 09:54:15921
[email protected]febbbb52011-08-17 04:59:23922 client_ret = connect_callback.GetResult(client_ret);
robpercival214763f2016-07-01 23:27:01923 ASSERT_THAT(client_ret, IsOk());
[email protected]febbbb52011-08-17 04:59:23924 server_ret = handshake_callback.GetResult(server_ret);
robpercival214763f2016-07-01 23:27:01925 ASSERT_THAT(server_ret, IsOk());
[email protected]f61c3972010-12-23 09:54:15926
927 const int kReadBufSize = 1024;
[email protected]fa6ce922014-07-17 04:27:04928 scoped_refptr<StringIOBuffer> write_buf =
929 new StringIOBuffer("testing123");
930 scoped_refptr<DrainableIOBuffer> read_buf =
931 new DrainableIOBuffer(new IOBuffer(kReadBufSize), kReadBufSize);
[email protected]f61c3972010-12-23 09:54:15932
933 // Write then read.
[email protected]83039bb2011-12-09 18:43:55934 TestCompletionCallback write_callback;
935 TestCompletionCallback read_callback;
ryanchungeb9e3bc2016-03-08 05:08:10936 server_ret = server_socket_->Write(write_buf.get(), write_buf->size(),
937 write_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04938 EXPECT_TRUE(server_ret > 0 || server_ret == ERR_IO_PENDING);
[email protected]90499482013-06-01 00:39:50939 client_ret = client_socket_->Read(
940 read_buf.get(), read_buf->BytesRemaining(), read_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04941 EXPECT_TRUE(client_ret > 0 || client_ret == ERR_IO_PENDING);
[email protected]f61c3972010-12-23 09:54:15942
[email protected]febbbb52011-08-17 04:59:23943 server_ret = write_callback.GetResult(server_ret);
944 EXPECT_GT(server_ret, 0);
945 client_ret = read_callback.GetResult(client_ret);
946 ASSERT_GT(client_ret, 0);
947
948 read_buf->DidConsume(client_ret);
949 while (read_buf->BytesConsumed() < write_buf->size()) {
[email protected]90499482013-06-01 00:39:50950 client_ret = client_socket_->Read(
951 read_buf.get(), read_buf->BytesRemaining(), read_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04952 EXPECT_TRUE(client_ret > 0 || client_ret == ERR_IO_PENDING);
[email protected]febbbb52011-08-17 04:59:23953 client_ret = read_callback.GetResult(client_ret);
954 ASSERT_GT(client_ret, 0);
955 read_buf->DidConsume(client_ret);
[email protected]f61c3972010-12-23 09:54:15956 }
[email protected]febbbb52011-08-17 04:59:23957 EXPECT_EQ(write_buf->size(), read_buf->BytesConsumed());
958 read_buf->SetOffset(0);
[email protected]f61c3972010-12-23 09:54:15959 EXPECT_EQ(0, memcmp(write_buf->data(), read_buf->data(), write_buf->size()));
960
961 // Read then write.
[email protected]fa6ce922014-07-17 04:27:04962 write_buf = new StringIOBuffer("hello123");
[email protected]90499482013-06-01 00:39:50963 server_ret = server_socket_->Read(
964 read_buf.get(), read_buf->BytesRemaining(), read_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04965 EXPECT_TRUE(server_ret > 0 || server_ret == ERR_IO_PENDING);
ryanchungeb9e3bc2016-03-08 05:08:10966 client_ret = client_socket_->Write(write_buf.get(), write_buf->size(),
967 write_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04968 EXPECT_TRUE(client_ret > 0 || client_ret == ERR_IO_PENDING);
[email protected]f61c3972010-12-23 09:54:15969
[email protected]febbbb52011-08-17 04:59:23970 server_ret = read_callback.GetResult(server_ret);
971 ASSERT_GT(server_ret, 0);
972 client_ret = write_callback.GetResult(client_ret);
973 EXPECT_GT(client_ret, 0);
974
975 read_buf->DidConsume(server_ret);
976 while (read_buf->BytesConsumed() < write_buf->size()) {
[email protected]90499482013-06-01 00:39:50977 server_ret = server_socket_->Read(
978 read_buf.get(), read_buf->BytesRemaining(), read_callback.callback());
[email protected]fa6ce922014-07-17 04:27:04979 EXPECT_TRUE(server_ret > 0 || server_ret == ERR_IO_PENDING);
[email protected]febbbb52011-08-17 04:59:23980 server_ret = read_callback.GetResult(server_ret);
981 ASSERT_GT(server_ret, 0);
982 read_buf->DidConsume(server_ret);
[email protected]f61c3972010-12-23 09:54:15983 }
[email protected]febbbb52011-08-17 04:59:23984 EXPECT_EQ(write_buf->size(), read_buf->BytesConsumed());
985 read_buf->SetOffset(0);
[email protected]f61c3972010-12-23 09:54:15986 EXPECT_EQ(0, memcmp(write_buf->data(), read_buf->data(), write_buf->size()));
987}
[email protected]b0ff3f82011-07-23 05:12:39988
[email protected]c0e4dd12012-05-16 19:36:31989// A regression test for bug 127822 (http://crbug.com/127822).
990// If the server closes the connection after the handshake is finished,
991// the client's Write() call should not cause an infinite loop.
992// NOTE: this is a test for SSLClientSocket rather than SSLServerSocket.
[email protected]4da82282014-07-16 18:40:43993TEST_F(SSLServerSocketTest, ClientWriteAfterServerClose) {
rsleevia5c430222016-03-11 05:55:12994 ASSERT_NO_FATAL_FAILURE(CreateContext());
995 ASSERT_NO_FATAL_FAILURE(CreateSockets());
[email protected]c0e4dd12012-05-16 19:36:31996
997 // Establish connection.
ryanchung987b2ff2016-02-19 00:17:12998 TestCompletionCallback connect_callback;
[email protected]c0e4dd12012-05-16 19:36:31999 int client_ret = client_socket_->Connect(connect_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041000 ASSERT_TRUE(client_ret == OK || client_ret == ERR_IO_PENDING);
[email protected]c0e4dd12012-05-16 19:36:311001
ryanchung987b2ff2016-02-19 00:17:121002 TestCompletionCallback handshake_callback;
[email protected]c0e4dd12012-05-16 19:36:311003 int server_ret = server_socket_->Handshake(handshake_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041004 ASSERT_TRUE(server_ret == OK || server_ret == ERR_IO_PENDING);
[email protected]c0e4dd12012-05-16 19:36:311005
1006 client_ret = connect_callback.GetResult(client_ret);
robpercival214763f2016-07-01 23:27:011007 ASSERT_THAT(client_ret, IsOk());
[email protected]c0e4dd12012-05-16 19:36:311008 server_ret = handshake_callback.GetResult(server_ret);
robpercival214763f2016-07-01 23:27:011009 ASSERT_THAT(server_ret, IsOk());
[email protected]c0e4dd12012-05-16 19:36:311010
[email protected]fa6ce922014-07-17 04:27:041011 scoped_refptr<StringIOBuffer> write_buf = new StringIOBuffer("testing123");
[email protected]c0e4dd12012-05-16 19:36:311012
1013 // The server closes the connection. The server needs to write some
1014 // data first so that the client's Read() calls from the transport
1015 // socket won't return ERR_IO_PENDING. This ensures that the client
1016 // will call Read() on the transport socket again.
1017 TestCompletionCallback write_callback;
ryanchungeb9e3bc2016-03-08 05:08:101018 server_ret = server_socket_->Write(write_buf.get(), write_buf->size(),
1019 write_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041020 EXPECT_TRUE(server_ret > 0 || server_ret == ERR_IO_PENDING);
[email protected]c0e4dd12012-05-16 19:36:311021
1022 server_ret = write_callback.GetResult(server_ret);
1023 EXPECT_GT(server_ret, 0);
1024
1025 server_socket_->Disconnect();
1026
1027 // The client writes some data. This should not cause an infinite loop.
ryanchungeb9e3bc2016-03-08 05:08:101028 client_ret = client_socket_->Write(write_buf.get(), write_buf->size(),
1029 write_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041030 EXPECT_TRUE(client_ret > 0 || client_ret == ERR_IO_PENDING);
[email protected]c0e4dd12012-05-16 19:36:311031
1032 client_ret = write_callback.GetResult(client_ret);
1033 EXPECT_GT(client_ret, 0);
1034
skyostil4891b25b2015-06-11 11:43:451035 base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
ki.stfu375812e2015-10-09 20:23:171036 FROM_HERE, base::MessageLoop::QuitWhenIdleClosure(),
[email protected]c0e4dd12012-05-16 19:36:311037 base::TimeDelta::FromMilliseconds(10));
fdoray5eeb7642016-06-22 16:11:281038 base::RunLoop().Run();
[email protected]c0e4dd12012-05-16 19:36:311039}
1040
[email protected]b0ff3f82011-07-23 05:12:391041// This test executes ExportKeyingMaterial() on the client and server sockets,
1042// after connecting them, and verifies that the results match.
1043// This test will fail if False Start is enabled (see crbug.com/90208).
1044TEST_F(SSLServerSocketTest, ExportKeyingMaterial) {
rsleevia5c430222016-03-11 05:55:121045 ASSERT_NO_FATAL_FAILURE(CreateContext());
1046 ASSERT_NO_FATAL_FAILURE(CreateSockets());
[email protected]b0ff3f82011-07-23 05:12:391047
[email protected]83039bb2011-12-09 18:43:551048 TestCompletionCallback connect_callback;
[email protected]83039bb2011-12-09 18:43:551049 int client_ret = client_socket_->Connect(connect_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041050 ASSERT_TRUE(client_ret == OK || client_ret == ERR_IO_PENDING);
[email protected]b0ff3f82011-07-23 05:12:391051
ryanchung987b2ff2016-02-19 00:17:121052 TestCompletionCallback handshake_callback;
[email protected]6ea7b152011-12-21 21:21:131053 int server_ret = server_socket_->Handshake(handshake_callback.callback());
[email protected]fa6ce922014-07-17 04:27:041054 ASSERT_TRUE(server_ret == OK || server_ret == ERR_IO_PENDING);
[email protected]b0ff3f82011-07-23 05:12:391055
[email protected]fa6ce922014-07-17 04:27:041056 if (client_ret == ERR_IO_PENDING) {
robpercival214763f2016-07-01 23:27:011057 ASSERT_THAT(connect_callback.WaitForResult(), IsOk());
[email protected]b0ff3f82011-07-23 05:12:391058 }
[email protected]fa6ce922014-07-17 04:27:041059 if (server_ret == ERR_IO_PENDING) {
robpercival214763f2016-07-01 23:27:011060 ASSERT_THAT(handshake_callback.WaitForResult(), IsOk());
[email protected]b0ff3f82011-07-23 05:12:391061 }
1062
1063 const int kKeyingMaterialSize = 32;
thestig9d3bb0c2015-01-24 00:49:511064 const char kKeyingLabel[] = "EXPERIMENTAL-server-socket-test";
1065 const char kKeyingContext[] = "";
[email protected]b0ff3f82011-07-23 05:12:391066 unsigned char server_out[kKeyingMaterialSize];
ryanchungeb9e3bc2016-03-08 05:08:101067 int rv = server_socket_->ExportKeyingMaterial(
1068 kKeyingLabel, false, kKeyingContext, server_out, sizeof(server_out));
robpercival214763f2016-07-01 23:27:011069 ASSERT_THAT(rv, IsOk());
[email protected]b0ff3f82011-07-23 05:12:391070
1071 unsigned char client_out[kKeyingMaterialSize];
ryanchungeb9e3bc2016-03-08 05:08:101072 rv = client_socket_->ExportKeyingMaterial(kKeyingLabel, false, kKeyingContext,
[email protected]b0ff3f82011-07-23 05:12:391073 client_out, sizeof(client_out));
robpercival214763f2016-07-01 23:27:011074 ASSERT_THAT(rv, IsOk());
[email protected]47a12862012-04-10 01:00:491075 EXPECT_EQ(0, memcmp(server_out, client_out, sizeof(server_out)));
[email protected]b0ff3f82011-07-23 05:12:391076
thestig9d3bb0c2015-01-24 00:49:511077 const char kKeyingLabelBad[] = "EXPERIMENTAL-server-socket-test-bad";
[email protected]b0ff3f82011-07-23 05:12:391078 unsigned char client_bad[kKeyingMaterialSize];
ryanchungeb9e3bc2016-03-08 05:08:101079 rv = client_socket_->ExportKeyingMaterial(
1080 kKeyingLabelBad, false, kKeyingContext, client_bad, sizeof(client_bad));
[email protected]fa6ce922014-07-17 04:27:041081 ASSERT_EQ(rv, OK);
[email protected]47a12862012-04-10 01:00:491082 EXPECT_NE(0, memcmp(server_out, client_bad, sizeof(server_out)));
[email protected]b0ff3f82011-07-23 05:12:391083}
[email protected]f61c3972010-12-23 09:54:151084
sergeyuff826d5e2015-05-13 20:35:221085// Verifies that SSLConfig::require_ecdhe flags works properly.
1086TEST_F(SSLServerSocketTest, RequireEcdheFlag) {
1087 // Disable all ECDHE suites on the client side.
1088 uint16_t kEcdheCiphers[] = {
1089 0xc007, // ECDHE_ECDSA_WITH_RC4_128_SHA
1090 0xc009, // ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1091 0xc00a, // ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1092 0xc011, // ECDHE_RSA_WITH_RC4_128_SHA
1093 0xc013, // ECDHE_RSA_WITH_AES_128_CBC_SHA
1094 0xc014, // ECDHE_RSA_WITH_AES_256_CBC_SHA
1095 0xc02b, // ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1096 0xc02f, // ECDHE_RSA_WITH_AES_128_GCM_SHA256
1097 0xcc13, // ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1098 0xcc14, // ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1099 };
1100 client_ssl_config_.disabled_cipher_suites.assign(
1101 kEcdheCiphers, kEcdheCiphers + arraysize(kEcdheCiphers));
1102
1103 // Require ECDHE on the server.
1104 server_ssl_config_.require_ecdhe = true;
1105
rsleevia5c430222016-03-11 05:55:121106 ASSERT_NO_FATAL_FAILURE(CreateContext());
1107 ASSERT_NO_FATAL_FAILURE(CreateSockets());
sergeyuff826d5e2015-05-13 20:35:221108
1109 TestCompletionCallback connect_callback;
sergeyuff826d5e2015-05-13 20:35:221110 int client_ret = client_socket_->Connect(connect_callback.callback());
ryanchung987b2ff2016-02-19 00:17:121111
1112 TestCompletionCallback handshake_callback;
sergeyuff826d5e2015-05-13 20:35:221113 int server_ret = server_socket_->Handshake(handshake_callback.callback());
1114
1115 client_ret = connect_callback.GetResult(client_ret);
1116 server_ret = handshake_callback.GetResult(server_ret);
1117
robpercival214763f2016-07-01 23:27:011118 ASSERT_THAT(client_ret, IsError(ERR_SSL_VERSION_OR_CIPHER_MISMATCH));
1119 ASSERT_THAT(server_ret, IsError(ERR_SSL_VERSION_OR_CIPHER_MISMATCH));
sergeyuff826d5e2015-05-13 20:35:221120}
1121
[email protected]f61c3972010-12-23 09:54:151122} // namespace net