OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "build/build_config.h" | 5 #include "build/build_config.h" |
6 | 6 |
7 #if defined(OS_WIN) | 7 #if defined(OS_WIN) |
8 #include <windows.h> | 8 #include <windows.h> |
9 #include <shlobj.h> | 9 #include <shlobj.h> |
10 #endif | 10 #endif |
(...skipping 1366 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1377 EXPECT_NE(0, d.bytes_received()); | 1377 EXPECT_NE(0, d.bytes_received()); |
1378 CheckSSLInfo(r.ssl_info()); | 1378 CheckSSLInfo(r.ssl_info()); |
1379 EXPECT_EQ(test_server.host_port_pair().host(), | 1379 EXPECT_EQ(test_server.host_port_pair().host(), |
1380 r.GetSocketAddress().host()); | 1380 r.GetSocketAddress().host()); |
1381 EXPECT_EQ(test_server.host_port_pair().port(), | 1381 EXPECT_EQ(test_server.host_port_pair().port(), |
1382 r.GetSocketAddress().port()); | 1382 r.GetSocketAddress().port()); |
1383 } | 1383 } |
1384 } | 1384 } |
1385 | 1385 |
1386 TEST_F(HTTPSRequestTest, HTTPSMismatchedTest) { | 1386 TEST_F(HTTPSRequestTest, HTTPSMismatchedTest) { |
1387 TestServer::HTTPSOptions https_options( | 1387 TestServer::SSLOptions ssl_options( |
1388 TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); | 1388 TestServer::SSLOptions::CERT_MISMATCHED_NAME); |
1389 TestServer test_server(https_options, | 1389 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1390 ssl_options, |
1390 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1391 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1391 ASSERT_TRUE(test_server.Start()); | 1392 ASSERT_TRUE(test_server.Start()); |
1392 | 1393 |
1393 bool err_allowed = true; | 1394 bool err_allowed = true; |
1394 for (int i = 0; i < 2 ; i++, err_allowed = !err_allowed) { | 1395 for (int i = 0; i < 2 ; i++, err_allowed = !err_allowed) { |
1395 TestDelegate d; | 1396 TestDelegate d; |
1396 { | 1397 { |
1397 d.set_allow_certificate_errors(err_allowed); | 1398 d.set_allow_certificate_errors(err_allowed); |
1398 URLRequest r(test_server.GetURL(""), &d, &default_context_); | 1399 URLRequest r(test_server.GetURL(""), &d, &default_context_); |
1399 | 1400 |
1400 r.Start(); | 1401 r.Start(); |
1401 EXPECT_TRUE(r.is_pending()); | 1402 EXPECT_TRUE(r.is_pending()); |
1402 | 1403 |
1403 MessageLoop::current()->Run(); | 1404 MessageLoop::current()->Run(); |
1404 | 1405 |
1405 EXPECT_EQ(1, d.response_started_count()); | 1406 EXPECT_EQ(1, d.response_started_count()); |
1406 EXPECT_FALSE(d.received_data_before_response()); | 1407 EXPECT_FALSE(d.received_data_before_response()); |
1407 EXPECT_TRUE(d.have_certificate_errors()); | 1408 EXPECT_TRUE(d.have_certificate_errors()); |
1408 if (err_allowed) { | 1409 if (err_allowed) { |
1409 EXPECT_NE(0, d.bytes_received()); | 1410 EXPECT_NE(0, d.bytes_received()); |
1410 CheckSSLInfo(r.ssl_info()); | 1411 CheckSSLInfo(r.ssl_info()); |
1411 } else { | 1412 } else { |
1412 EXPECT_EQ(0, d.bytes_received()); | 1413 EXPECT_EQ(0, d.bytes_received()); |
1413 } | 1414 } |
1414 } | 1415 } |
1415 } | 1416 } |
1416 } | 1417 } |
1417 | 1418 |
1418 TEST_F(HTTPSRequestTest, HTTPSExpiredTest) { | 1419 TEST_F(HTTPSRequestTest, HTTPSExpiredTest) { |
1419 TestServer::HTTPSOptions https_options( | 1420 TestServer::SSLOptions ssl_options( |
1420 TestServer::HTTPSOptions::CERT_EXPIRED); | 1421 TestServer::SSLOptions::CERT_EXPIRED); |
1421 TestServer test_server(https_options, | 1422 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1423 ssl_options, |
1422 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1424 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1423 ASSERT_TRUE(test_server.Start()); | 1425 ASSERT_TRUE(test_server.Start()); |
1424 | 1426 |
1425 // Iterate from false to true, just so that we do the opposite of the | 1427 // Iterate from false to true, just so that we do the opposite of the |
1426 // previous test in order to increase test coverage. | 1428 // previous test in order to increase test coverage. |
1427 bool err_allowed = false; | 1429 bool err_allowed = false; |
1428 for (int i = 0; i < 2 ; i++, err_allowed = !err_allowed) { | 1430 for (int i = 0; i < 2 ; i++, err_allowed = !err_allowed) { |
1429 TestDelegate d; | 1431 TestDelegate d; |
1430 { | 1432 { |
1431 d.set_allow_certificate_errors(err_allowed); | 1433 d.set_allow_certificate_errors(err_allowed); |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1499 ImportCertFromFile(GetTestCertsDirectory(), "ocsp-test-root.pem"); | 1501 ImportCertFromFile(GetTestCertsDirectory(), "ocsp-test-root.pem"); |
1500 CHECK_NE(static_cast<X509Certificate*>(NULL), root_cert); | 1502 CHECK_NE(static_cast<X509Certificate*>(NULL), root_cert); |
1501 test_root_.reset(new ScopedTestRoot(root_cert)); | 1503 test_root_.reset(new ScopedTestRoot(root_cert)); |
1502 | 1504 |
1503 #if defined(USE_NSS) | 1505 #if defined(USE_NSS) |
1504 SetURLRequestContextForNSSHttpIO(&context_); | 1506 SetURLRequestContextForNSSHttpIO(&context_); |
1505 EnsureNSSHttpIOInit(); | 1507 EnsureNSSHttpIOInit(); |
1506 #endif | 1508 #endif |
1507 } | 1509 } |
1508 | 1510 |
1509 void DoConnection(const TestServer::HTTPSOptions& https_options, | 1511 void DoConnection(const TestServer::SSLOptions& ssl_options, |
1510 CertStatus* out_cert_status) { | 1512 CertStatus* out_cert_status) { |
1511 TestServer test_server(https_options, | 1513 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1514 ssl_options, |
1512 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1515 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1513 ASSERT_TRUE(test_server.Start()); | 1516 ASSERT_TRUE(test_server.Start()); |
1514 | 1517 |
1515 TestDelegate d; | 1518 TestDelegate d; |
1516 d.set_allow_certificate_errors(true); | 1519 d.set_allow_certificate_errors(true); |
1517 URLRequest r(test_server.GetURL(""), &d, &context_); | 1520 URLRequest r(test_server.GetURL(""), &d, &context_); |
1518 r.Start(); | 1521 r.Start(); |
1519 | 1522 |
1520 MessageLoop::current()->Run(); | 1523 MessageLoop::current()->Run(); |
1521 | 1524 |
(...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1584 return true; | 1587 return true; |
1585 #endif | 1588 #endif |
1586 } | 1589 } |
1587 | 1590 |
1588 TEST_F(HTTPSOCSPTest, Valid) { | 1591 TEST_F(HTTPSOCSPTest, Valid) { |
1589 if (!SystemSupportsOCSP()) { | 1592 if (!SystemSupportsOCSP()) { |
1590 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1593 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1591 return; | 1594 return; |
1592 } | 1595 } |
1593 | 1596 |
1594 TestServer::HTTPSOptions https_options(TestServer::HTTPSOptions::CERT_AUTO); | 1597 TestServer::SSLOptions ssl_options(TestServer::SSLOptions::CERT_AUTO); |
1595 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_OK; | 1598 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_OK; |
1596 | 1599 |
1597 CertStatus cert_status = 0; | 1600 CertStatus cert_status = 0; |
1598 DoConnection(https_options, &cert_status); | 1601 DoConnection(ssl_options, &cert_status); |
1599 | 1602 |
1600 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); | 1603 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); |
1601 | 1604 |
1602 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1605 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1603 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); | 1606 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); |
1604 | 1607 |
1605 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1608 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1606 } | 1609 } |
1607 | 1610 |
1608 TEST_F(HTTPSOCSPTest, Revoked) { | 1611 TEST_F(HTTPSOCSPTest, Revoked) { |
1609 if (!SystemSupportsOCSP()) { | 1612 if (!SystemSupportsOCSP()) { |
1610 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1613 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1611 return; | 1614 return; |
1612 } | 1615 } |
1613 | 1616 |
1614 TestServer::HTTPSOptions https_options( | 1617 TestServer::SSLOptions ssl_options( |
1615 TestServer::HTTPSOptions::CERT_AUTO); | 1618 TestServer::SSLOptions::CERT_AUTO); |
1616 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_REVOKED; | 1619 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_REVOKED; |
1617 | 1620 |
1618 CertStatus cert_status; | 1621 CertStatus cert_status; |
1619 DoConnection(https_options, &cert_status); | 1622 DoConnection(ssl_options, &cert_status); |
1620 | 1623 |
1621 #if !defined(OS_MACOSX) | 1624 #if !defined(OS_MACOSX) |
1622 // Doesn't pass on OS X yet for reasons that need to be investigated. | 1625 // Doesn't pass on OS X yet for reasons that need to be investigated. |
1623 EXPECT_EQ(CERT_STATUS_REVOKED, cert_status & CERT_STATUS_ALL_ERRORS); | 1626 EXPECT_EQ(CERT_STATUS_REVOKED, cert_status & CERT_STATUS_ALL_ERRORS); |
1624 #endif | 1627 #endif |
1625 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1628 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1626 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1629 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1627 } | 1630 } |
1628 | 1631 |
1629 TEST_F(HTTPSOCSPTest, Invalid) { | 1632 TEST_F(HTTPSOCSPTest, Invalid) { |
1630 if (!SystemSupportsOCSP()) { | 1633 if (!SystemSupportsOCSP()) { |
1631 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1634 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1632 return; | 1635 return; |
1633 } | 1636 } |
1634 | 1637 |
1635 TestServer::HTTPSOptions https_options( | 1638 TestServer::SSLOptions ssl_options( |
1636 TestServer::HTTPSOptions::CERT_AUTO); | 1639 TestServer::SSLOptions::CERT_AUTO); |
1637 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_INVALID; | 1640 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_INVALID; |
1638 | 1641 |
1639 CertStatus cert_status = 0; | 1642 CertStatus cert_status = 0; |
1640 DoConnection(https_options, &cert_status); | 1643 DoConnection(ssl_options, &cert_status); |
1641 | 1644 |
1642 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), | 1645 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), |
1643 cert_status & CERT_STATUS_ALL_ERRORS); | 1646 cert_status & CERT_STATUS_ALL_ERRORS); |
1644 | 1647 |
1645 // Without a positive OCSP response, we shouldn't show the EV status. | 1648 // Without a positive OCSP response, we shouldn't show the EV status. |
1646 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1649 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1647 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1650 EXPECT_TRUE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1648 } | 1651 } |
1649 | 1652 |
1650 class HTTPSEVCRLSetTest : public HTTPSOCSPTest { | 1653 class HTTPSEVCRLSetTest : public HTTPSOCSPTest { |
1651 protected: | 1654 protected: |
1652 virtual void SetupContext(URLRequestContext* context) OVERRIDE { | 1655 virtual void SetupContext(URLRequestContext* context) OVERRIDE { |
1653 context->set_ssl_config_service( | 1656 context->set_ssl_config_service( |
1654 new TestSSLConfigService(true /* check for EV */, | 1657 new TestSSLConfigService(true /* check for EV */, |
1655 false /* online revocation checking */)); | 1658 false /* online revocation checking */)); |
1656 } | 1659 } |
1657 }; | 1660 }; |
1658 | 1661 |
1659 TEST_F(HTTPSEVCRLSetTest, MissingCRLSetAndInvalidOCSP) { | 1662 TEST_F(HTTPSEVCRLSetTest, MissingCRLSetAndInvalidOCSP) { |
1660 if (!SystemSupportsOCSP()) { | 1663 if (!SystemSupportsOCSP()) { |
1661 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1664 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1662 return; | 1665 return; |
1663 } | 1666 } |
1664 | 1667 |
1665 TestServer::HTTPSOptions https_options( | 1668 TestServer::SSLOptions ssl_options( |
1666 TestServer::HTTPSOptions::CERT_AUTO); | 1669 TestServer::SSLOptions::CERT_AUTO); |
1667 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_INVALID; | 1670 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_INVALID; |
1668 SSLConfigService::SetCRLSet(scoped_refptr<CRLSet>()); | 1671 SSLConfigService::SetCRLSet(scoped_refptr<CRLSet>()); |
1669 | 1672 |
1670 CertStatus cert_status = 0; | 1673 CertStatus cert_status = 0; |
1671 DoConnection(https_options, &cert_status); | 1674 DoConnection(ssl_options, &cert_status); |
1672 | 1675 |
1673 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), | 1676 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), |
1674 cert_status & CERT_STATUS_ALL_ERRORS); | 1677 cert_status & CERT_STATUS_ALL_ERRORS); |
1675 | 1678 |
1676 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1679 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1677 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1680 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1678 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); | 1681 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); |
1679 } | 1682 } |
1680 | 1683 |
1681 TEST_F(HTTPSEVCRLSetTest, MissingCRLSetAndGoodOCSP) { | 1684 TEST_F(HTTPSEVCRLSetTest, MissingCRLSetAndGoodOCSP) { |
1682 if (!SystemSupportsOCSP()) { | 1685 if (!SystemSupportsOCSP()) { |
1683 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1686 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1684 return; | 1687 return; |
1685 } | 1688 } |
1686 | 1689 |
1687 TestServer::HTTPSOptions https_options( | 1690 TestServer::SSLOptions ssl_options( |
1688 TestServer::HTTPSOptions::CERT_AUTO); | 1691 TestServer::SSLOptions::CERT_AUTO); |
1689 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_OK; | 1692 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_OK; |
1690 SSLConfigService::SetCRLSet(scoped_refptr<CRLSet>()); | 1693 SSLConfigService::SetCRLSet(scoped_refptr<CRLSet>()); |
1691 | 1694 |
1692 CertStatus cert_status; | 1695 CertStatus cert_status; |
1693 DoConnection(https_options, &cert_status); | 1696 DoConnection(ssl_options, &cert_status); |
1694 | 1697 |
1695 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); | 1698 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); |
1696 | 1699 |
1697 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1700 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1698 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); | 1701 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); |
1699 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1702 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1700 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); | 1703 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); |
1701 } | 1704 } |
1702 | 1705 |
1703 TEST_F(HTTPSEVCRLSetTest, ExpiredCRLSet) { | 1706 TEST_F(HTTPSEVCRLSetTest, ExpiredCRLSet) { |
1704 if (!SystemSupportsOCSP()) { | 1707 if (!SystemSupportsOCSP()) { |
1705 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1708 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1706 return; | 1709 return; |
1707 } | 1710 } |
1708 | 1711 |
1709 TestServer::HTTPSOptions https_options( | 1712 TestServer::SSLOptions ssl_options( |
1710 TestServer::HTTPSOptions::CERT_AUTO); | 1713 TestServer::SSLOptions::CERT_AUTO); |
1711 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_INVALID; | 1714 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_INVALID; |
1712 SSLConfigService::SetCRLSet( | 1715 SSLConfigService::SetCRLSet( |
1713 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); | 1716 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); |
1714 | 1717 |
1715 CertStatus cert_status; | 1718 CertStatus cert_status; |
1716 DoConnection(https_options, &cert_status); | 1719 DoConnection(ssl_options, &cert_status); |
1717 | 1720 |
1718 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), | 1721 EXPECT_EQ(ExpectedCertStatusForFailedOnlineRevocationCheck(), |
1719 cert_status & CERT_STATUS_ALL_ERRORS); | 1722 cert_status & CERT_STATUS_ALL_ERRORS); |
1720 | 1723 |
1721 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1724 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1722 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1725 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1723 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); | 1726 static_cast<bool>(cert_status & CERT_STATUS_REV_CHECKING_ENABLED)); |
1724 } | 1727 } |
1725 | 1728 |
1726 TEST_F(HTTPSEVCRLSetTest, FreshCRLSet) { | 1729 TEST_F(HTTPSEVCRLSetTest, FreshCRLSet) { |
1727 TestServer::HTTPSOptions https_options( | 1730 TestServer::SSLOptions ssl_options( |
1728 TestServer::HTTPSOptions::CERT_AUTO); | 1731 TestServer::SSLOptions::CERT_AUTO); |
1729 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_INVALID; | 1732 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_INVALID; |
1730 SSLConfigService::SetCRLSet( | 1733 SSLConfigService::SetCRLSet( |
1731 scoped_refptr<CRLSet>(CRLSet::EmptyCRLSetForTesting())); | 1734 scoped_refptr<CRLSet>(CRLSet::EmptyCRLSetForTesting())); |
1732 | 1735 |
1733 CertStatus cert_status = 0; | 1736 CertStatus cert_status = 0; |
1734 DoConnection(https_options, &cert_status); | 1737 DoConnection(ssl_options, &cert_status); |
1735 | 1738 |
1736 // With a valid, fresh CRLSet the bad OCSP response shouldn't matter because | 1739 // With a valid, fresh CRLSet the bad OCSP response shouldn't matter because |
1737 // we wont check it. | 1740 // we wont check it. |
1738 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); | 1741 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); |
1739 | 1742 |
1740 EXPECT_EQ(SystemUsesChromiumEVMetadata(), | 1743 EXPECT_EQ(SystemUsesChromiumEVMetadata(), |
1741 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); | 1744 static_cast<bool>(cert_status & CERT_STATUS_IS_EV)); |
1742 | 1745 |
1743 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1746 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1744 } | 1747 } |
1745 | 1748 |
1746 TEST_F(HTTPSEVCRLSetTest, ExpiredCRLSetAndRevokedNonEVCert) { | 1749 TEST_F(HTTPSEVCRLSetTest, ExpiredCRLSetAndRevokedNonEVCert) { |
1747 // Test that when EV verification is requested, but online revocation | 1750 // Test that when EV verification is requested, but online revocation |
1748 // checking is disabled, and the leaf certificate is not in fact EV, that | 1751 // checking is disabled, and the leaf certificate is not in fact EV, that |
1749 // no revocation checking actually happens. | 1752 // no revocation checking actually happens. |
1750 if (!SystemSupportsOCSP()) { | 1753 if (!SystemSupportsOCSP()) { |
1751 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; | 1754 LOG(WARNING) << "Skipping test because system doesn't support OCSP"; |
1752 return; | 1755 return; |
1753 } | 1756 } |
1754 | 1757 |
1755 // Unmark the certificate's OID as EV, which should disable revocation | 1758 // Unmark the certificate's OID as EV, which should disable revocation |
1756 // checking (as per the user preference) | 1759 // checking (as per the user preference) |
1757 ev_test_policy_.reset(); | 1760 ev_test_policy_.reset(); |
1758 | 1761 |
1759 TestServer::HTTPSOptions https_options( | 1762 TestServer::SSLOptions ssl_options( |
1760 TestServer::HTTPSOptions::CERT_AUTO); | 1763 TestServer::SSLOptions::CERT_AUTO); |
1761 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_REVOKED; | 1764 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_REVOKED; |
1762 SSLConfigService::SetCRLSet( | 1765 SSLConfigService::SetCRLSet( |
1763 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); | 1766 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); |
1764 | 1767 |
1765 CertStatus cert_status; | 1768 CertStatus cert_status; |
1766 DoConnection(https_options, &cert_status); | 1769 DoConnection(ssl_options, &cert_status); |
1767 | 1770 |
1768 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); | 1771 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); |
1769 | 1772 |
1770 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1773 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1771 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1774 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1772 } | 1775 } |
1773 | 1776 |
1774 class HTTPSCRLSetTest : public HTTPSOCSPTest { | 1777 class HTTPSCRLSetTest : public HTTPSOCSPTest { |
1775 protected: | 1778 protected: |
1776 virtual void SetupContext(URLRequestContext* context) OVERRIDE { | 1779 virtual void SetupContext(URLRequestContext* context) OVERRIDE { |
1777 context->set_ssl_config_service( | 1780 context->set_ssl_config_service( |
1778 new TestSSLConfigService(false /* check for EV */, | 1781 new TestSSLConfigService(false /* check for EV */, |
1779 false /* online revocation checking */)); | 1782 false /* online revocation checking */)); |
1780 } | 1783 } |
1781 }; | 1784 }; |
1782 | 1785 |
1783 TEST_F(HTTPSCRLSetTest, ExpiredCRLSet) { | 1786 TEST_F(HTTPSCRLSetTest, ExpiredCRLSet) { |
1784 TestServer::HTTPSOptions https_options( | 1787 TestServer::SSLOptions ssl_options( |
1785 TestServer::HTTPSOptions::CERT_AUTO); | 1788 TestServer::SSLOptions::CERT_AUTO); |
1786 https_options.ocsp_status = TestServer::HTTPSOptions::OCSP_INVALID; | 1789 ssl_options.ocsp_status = TestServer::SSLOptions::OCSP_INVALID; |
1787 SSLConfigService::SetCRLSet( | 1790 SSLConfigService::SetCRLSet( |
1788 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); | 1791 scoped_refptr<CRLSet>(CRLSet::ExpiredCRLSetForTesting())); |
1789 | 1792 |
1790 CertStatus cert_status = 0; | 1793 CertStatus cert_status = 0; |
1791 DoConnection(https_options, &cert_status); | 1794 DoConnection(ssl_options, &cert_status); |
1792 | 1795 |
1793 // If we're not trying EV verification then, even if the CRLSet has expired, | 1796 // If we're not trying EV verification then, even if the CRLSet has expired, |
1794 // we don't fall back to online revocation checks. | 1797 // we don't fall back to online revocation checks. |
1795 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); | 1798 EXPECT_EQ(0u, cert_status & CERT_STATUS_ALL_ERRORS); |
1796 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); | 1799 EXPECT_FALSE(cert_status & CERT_STATUS_IS_EV); |
1797 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); | 1800 EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED); |
1798 } | 1801 } |
1799 | 1802 |
1800 TEST_F(HTTPSRequestTest, SSLv3Fallback) { | 1803 TEST_F(HTTPSRequestTest, SSLv3Fallback) { |
1801 TestServer::HTTPSOptions https_options( | 1804 TestServer::SSLOptions ssl_options( |
1802 TestServer::HTTPSOptions::CERT_OK); | 1805 TestServer::SSLOptions::CERT_OK); |
1803 https_options.tls_intolerant = TestServer::HTTPSOptions::TLS_INTOLERANT_ALL; | 1806 ssl_options.tls_intolerant = TestServer::SSLOptions::TLS_INTOLERANT_ALL; |
1804 TestServer test_server(https_options, | 1807 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1808 ssl_options, |
1805 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1809 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1806 ASSERT_TRUE(test_server.Start()); | 1810 ASSERT_TRUE(test_server.Start()); |
1807 | 1811 |
1808 TestDelegate d; | 1812 TestDelegate d; |
1809 TestURLRequestContext context(true); | 1813 TestURLRequestContext context(true); |
1810 context.Init(); | 1814 context.Init(); |
1811 d.set_allow_certificate_errors(true); | 1815 d.set_allow_certificate_errors(true); |
1812 URLRequest r(test_server.GetURL(""), &d, &context); | 1816 URLRequest r(test_server.GetURL(""), &d, &context); |
1813 r.Start(); | 1817 r.Start(); |
1814 | 1818 |
(...skipping 10 matching lines...) Expand all Loading... |
1825 // than necessary. | 1829 // than necessary. |
1826 TEST_F(HTTPSRequestTest, TLSv1Fallback) { | 1830 TEST_F(HTTPSRequestTest, TLSv1Fallback) { |
1827 uint16 default_version_max = SSLConfigService::default_version_max(); | 1831 uint16 default_version_max = SSLConfigService::default_version_max(); |
1828 // The OpenSSL library in use may not support TLS 1.1. | 1832 // The OpenSSL library in use may not support TLS 1.1. |
1829 #if !defined(USE_OPENSSL) | 1833 #if !defined(USE_OPENSSL) |
1830 EXPECT_GT(default_version_max, SSL_PROTOCOL_VERSION_TLS1); | 1834 EXPECT_GT(default_version_max, SSL_PROTOCOL_VERSION_TLS1); |
1831 #endif | 1835 #endif |
1832 if (default_version_max <= SSL_PROTOCOL_VERSION_TLS1) | 1836 if (default_version_max <= SSL_PROTOCOL_VERSION_TLS1) |
1833 return; | 1837 return; |
1834 | 1838 |
1835 TestServer::HTTPSOptions https_options( | 1839 TestServer::SSLOptions ssl_options( |
1836 TestServer::HTTPSOptions::CERT_OK); | 1840 TestServer::SSLOptions::CERT_OK); |
1837 https_options.tls_intolerant = | 1841 ssl_options.tls_intolerant = |
1838 TestServer::HTTPSOptions::TLS_INTOLERANT_TLS1_1; | 1842 TestServer::SSLOptions::TLS_INTOLERANT_TLS1_1; |
1839 TestServer test_server(https_options, | 1843 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1844 ssl_options, |
1840 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1845 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1841 ASSERT_TRUE(test_server.Start()); | 1846 ASSERT_TRUE(test_server.Start()); |
1842 | 1847 |
1843 TestDelegate d; | 1848 TestDelegate d; |
1844 TestURLRequestContext context(true); | 1849 TestURLRequestContext context(true); |
1845 context.Init(); | 1850 context.Init(); |
1846 d.set_allow_certificate_errors(true); | 1851 d.set_allow_certificate_errors(true); |
1847 URLRequest r(test_server.GetURL(""), &d, &context); | 1852 URLRequest r(test_server.GetURL(""), &d, &context); |
1848 r.Start(); | 1853 r.Start(); |
1849 | 1854 |
1850 MessageLoop::current()->Run(); | 1855 MessageLoop::current()->Run(); |
1851 | 1856 |
1852 EXPECT_EQ(1, d.response_started_count()); | 1857 EXPECT_EQ(1, d.response_started_count()); |
1853 EXPECT_NE(0, d.bytes_received()); | 1858 EXPECT_NE(0, d.bytes_received()); |
1854 EXPECT_EQ(static_cast<int>(SSL_CONNECTION_VERSION_TLS1), | 1859 EXPECT_EQ(static_cast<int>(SSL_CONNECTION_VERSION_TLS1), |
1855 SSLConnectionStatusToVersion(r.ssl_info().connection_status)); | 1860 SSLConnectionStatusToVersion(r.ssl_info().connection_status)); |
1856 EXPECT_TRUE(r.ssl_info().connection_status & SSL_CONNECTION_VERSION_FALLBACK); | 1861 EXPECT_TRUE(r.ssl_info().connection_status & SSL_CONNECTION_VERSION_FALLBACK); |
1857 } | 1862 } |
1858 | 1863 |
1859 // This tests that a load of www.google.com with a certificate error sets | 1864 // This tests that a load of www.google.com with a certificate error sets |
1860 // the |certificate_errors_are_fatal| flag correctly. This flag will cause | 1865 // the |certificate_errors_are_fatal| flag correctly. This flag will cause |
1861 // the interstitial to be fatal. | 1866 // the interstitial to be fatal. |
1862 TEST_F(HTTPSRequestTest, HTTPSPreloadedHSTSTest) { | 1867 TEST_F(HTTPSRequestTest, HTTPSPreloadedHSTSTest) { |
1863 TestServer::HTTPSOptions https_options( | 1868 TestServer::SSLOptions ssl_options( |
1864 TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); | 1869 TestServer::SSLOptions::CERT_MISMATCHED_NAME); |
1865 TestServer test_server(https_options, | 1870 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1871 ssl_options, |
1866 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1872 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1867 ASSERT_TRUE(test_server.Start()); | 1873 ASSERT_TRUE(test_server.Start()); |
1868 | 1874 |
1869 // We require that the URL be www.google.com in order to pick up the | 1875 // We require that the URL be www.google.com in order to pick up the |
1870 // preloaded HSTS entries in the TransportSecurityState. This means that we | 1876 // preloaded HSTS entries in the TransportSecurityState. This means that we |
1871 // have to use a MockHostResolver in order to direct www.google.com to the | 1877 // have to use a MockHostResolver in order to direct www.google.com to the |
1872 // testserver. | 1878 // testserver. |
1873 | 1879 |
1874 MockHostResolver host_resolver; | 1880 MockHostResolver host_resolver; |
1875 host_resolver.rules()->AddRule("www.google.com", "127.0.0.1"); | 1881 host_resolver.rules()->AddRule("www.google.com", "127.0.0.1"); |
(...skipping 20 matching lines...) Expand all Loading... |
1896 EXPECT_FALSE(d.received_data_before_response()); | 1902 EXPECT_FALSE(d.received_data_before_response()); |
1897 EXPECT_TRUE(d.have_certificate_errors()); | 1903 EXPECT_TRUE(d.have_certificate_errors()); |
1898 EXPECT_TRUE(d.certificate_errors_are_fatal()); | 1904 EXPECT_TRUE(d.certificate_errors_are_fatal()); |
1899 } | 1905 } |
1900 | 1906 |
1901 // This tests that cached HTTPS page loads do not cause any updates to the | 1907 // This tests that cached HTTPS page loads do not cause any updates to the |
1902 // TransportSecurityState. | 1908 // TransportSecurityState. |
1903 TEST_F(HTTPSRequestTest, HTTPSErrorsNoClobberTSSTest) { | 1909 TEST_F(HTTPSRequestTest, HTTPSErrorsNoClobberTSSTest) { |
1904 // The actual problem -- CERT_MISMATCHED_NAME in this case -- doesn't | 1910 // The actual problem -- CERT_MISMATCHED_NAME in this case -- doesn't |
1905 // matter. It just has to be any error. | 1911 // matter. It just has to be any error. |
1906 TestServer::HTTPSOptions https_options( | 1912 TestServer::SSLOptions ssl_options( |
1907 TestServer::HTTPSOptions::CERT_MISMATCHED_NAME); | 1913 TestServer::SSLOptions::CERT_MISMATCHED_NAME); |
1908 TestServer test_server(https_options, | 1914 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1915 ssl_options, |
1909 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1916 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1910 ASSERT_TRUE(test_server.Start()); | 1917 ASSERT_TRUE(test_server.Start()); |
1911 | 1918 |
1912 // We require that the URL be www.google.com in order to pick up the | 1919 // We require that the URL be www.google.com in order to pick up the |
1913 // preloaded and dynamic HSTS and public key pin entries in the | 1920 // preloaded and dynamic HSTS and public key pin entries in the |
1914 // TransportSecurityState. This means that we have to use a | 1921 // TransportSecurityState. This means that we have to use a |
1915 // MockHostResolver in order to direct www.google.com to the testserver. | 1922 // MockHostResolver in order to direct www.google.com to the testserver. |
1916 | 1923 |
1917 MockHostResolver host_resolver; | 1924 MockHostResolver host_resolver; |
1918 host_resolver.rules()->AddRule("www.google.com", "127.0.0.1"); | 1925 host_resolver.rules()->AddRule("www.google.com", "127.0.0.1"); |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1978 }; | 1985 }; |
1979 | 1986 |
1980 } // namespace | 1987 } // namespace |
1981 | 1988 |
1982 // TODO(davidben): Test the rest of the code. Specifically, | 1989 // TODO(davidben): Test the rest of the code. Specifically, |
1983 // - Filtering which certificates to select. | 1990 // - Filtering which certificates to select. |
1984 // - Sending a certificate back. | 1991 // - Sending a certificate back. |
1985 // - Getting a certificate request in an SSL renegotiation sending the | 1992 // - Getting a certificate request in an SSL renegotiation sending the |
1986 // HTTP request. | 1993 // HTTP request. |
1987 TEST_F(HTTPSRequestTest, ClientAuthTest) { | 1994 TEST_F(HTTPSRequestTest, ClientAuthTest) { |
1988 TestServer::HTTPSOptions https_options; | 1995 TestServer::SSLOptions ssl_options; |
1989 https_options.request_client_certificate = true; | 1996 ssl_options.request_client_certificate = true; |
1990 TestServer test_server(https_options, | 1997 TestServer test_server(TestServer::TYPE_HTTPS, |
| 1998 ssl_options, |
1991 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 1999 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
1992 ASSERT_TRUE(test_server.Start()); | 2000 ASSERT_TRUE(test_server.Start()); |
1993 | 2001 |
1994 SSLClientAuthTestDelegate d; | 2002 SSLClientAuthTestDelegate d; |
1995 { | 2003 { |
1996 URLRequest r(test_server.GetURL(""), &d, &default_context_); | 2004 URLRequest r(test_server.GetURL(""), &d, &default_context_); |
1997 | 2005 |
1998 r.Start(); | 2006 r.Start(); |
1999 EXPECT_TRUE(r.is_pending()); | 2007 EXPECT_TRUE(r.is_pending()); |
2000 | 2008 |
(...skipping 12 matching lines...) Expand all Loading... |
2013 | 2021 |
2014 EXPECT_EQ(1, d.response_started_count()); | 2022 EXPECT_EQ(1, d.response_started_count()); |
2015 EXPECT_FALSE(d.received_data_before_response()); | 2023 EXPECT_FALSE(d.received_data_before_response()); |
2016 EXPECT_NE(0, d.bytes_received()); | 2024 EXPECT_NE(0, d.bytes_received()); |
2017 } | 2025 } |
2018 } | 2026 } |
2019 | 2027 |
2020 TEST_F(HTTPSRequestTest, ResumeTest) { | 2028 TEST_F(HTTPSRequestTest, ResumeTest) { |
2021 // Test that we attempt a session resume when making two connections to the | 2029 // Test that we attempt a session resume when making two connections to the |
2022 // same host. | 2030 // same host. |
2023 TestServer::HTTPSOptions https_options; | 2031 TestServer::SSLOptions ssl_options; |
2024 https_options.record_resume = true; | 2032 ssl_options.record_resume = true; |
2025 TestServer test_server(https_options, | 2033 TestServer test_server(TestServer::TYPE_HTTPS, |
| 2034 ssl_options, |
2026 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 2035 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
2027 ASSERT_TRUE(test_server.Start()); | 2036 ASSERT_TRUE(test_server.Start()); |
2028 | 2037 |
2029 SSLClientSocket::ClearSessionCache(); | 2038 SSLClientSocket::ClearSessionCache(); |
2030 | 2039 |
2031 { | 2040 { |
2032 TestDelegate d; | 2041 TestDelegate d; |
2033 URLRequest r( | 2042 URLRequest r( |
2034 test_server.GetURL("ssl-session-cache"), &d, &default_context_); | 2043 test_server.GetURL("ssl-session-cache"), &d, &default_context_); |
2035 | 2044 |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2080 EXPECT_EQ("lookup", parts[0]); | 2089 EXPECT_EQ("lookup", parts[0]); |
2081 EXPECT_EQ(session_id, parts[1]); | 2090 EXPECT_EQ(session_id, parts[1]); |
2082 } | 2091 } |
2083 } | 2092 } |
2084 } | 2093 } |
2085 } | 2094 } |
2086 | 2095 |
2087 TEST_F(HTTPSRequestTest, SSLSessionCacheShardTest) { | 2096 TEST_F(HTTPSRequestTest, SSLSessionCacheShardTest) { |
2088 // Test that sessions aren't resumed when the value of ssl_session_cache_shard | 2097 // Test that sessions aren't resumed when the value of ssl_session_cache_shard |
2089 // differs. | 2098 // differs. |
2090 TestServer::HTTPSOptions https_options; | 2099 TestServer::SSLOptions ssl_options; |
2091 https_options.record_resume = true; | 2100 ssl_options.record_resume = true; |
2092 TestServer test_server(https_options, | 2101 TestServer test_server(TestServer::TYPE_HTTPS, |
| 2102 ssl_options, |
2093 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); | 2103 FilePath(FILE_PATH_LITERAL("net/data/ssl"))); |
2094 ASSERT_TRUE(test_server.Start()); | 2104 ASSERT_TRUE(test_server.Start()); |
2095 | 2105 |
2096 SSLClientSocket::ClearSessionCache(); | 2106 SSLClientSocket::ClearSessionCache(); |
2097 | 2107 |
2098 { | 2108 { |
2099 TestDelegate d; | 2109 TestDelegate d; |
2100 URLRequest r( | 2110 URLRequest r( |
2101 test_server.GetURL("ssl-session-cache"), &d, &default_context_); | 2111 test_server.GetURL("ssl-session-cache"), &d, &default_context_); |
2102 | 2112 |
(...skipping 2559 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
4662 req.SetExtraRequestHeaders(headers); | 4672 req.SetExtraRequestHeaders(headers); |
4663 req.Start(); | 4673 req.Start(); |
4664 MessageLoop::current()->Run(); | 4674 MessageLoop::current()->Run(); |
4665 // If the net tests are being run with ChromeFrame then we need to allow for | 4675 // If the net tests are being run with ChromeFrame then we need to allow for |
4666 // the 'chromeframe' suffix which is added to the user agent before the | 4676 // the 'chromeframe' suffix which is added to the user agent before the |
4667 // closing parentheses. | 4677 // closing parentheses. |
4668 EXPECT_TRUE(StartsWithASCII(d.data_received(), "Lynx (textmode", true)); | 4678 EXPECT_TRUE(StartsWithASCII(d.data_received(), "Lynx (textmode", true)); |
4669 } | 4679 } |
4670 | 4680 |
4671 } // namespace net | 4681 } // namespace net |
OLD | NEW |