ssl_client_auth_cache_unittest.cc 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187
  1. // Copyright (c) 2009 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/ssl_client_auth_cache.h"
  5. #include <utility>
  6. #include "base/callback.h"
  7. #include "base/time/time.h"
  8. #include "net/cert/x509_certificate.h"
  9. #include "net/ssl/ssl_private_key.h"
  10. #include "net/ssl/test_ssl_private_key.h"
  11. #include "net/test/cert_test_util.h"
  12. #include "net/test/test_data_directory.h"
  13. #include "testing/gtest/include/gtest/gtest.h"
  14. #include "third_party/boringssl/src/include/openssl/evp.h"
  15. namespace net {
  16. namespace {
  17. scoped_refptr<SSLPrivateKey> MakeMockKey() {
  18. bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
  19. return WrapOpenSSLPrivateKey(std::move(pkey));
  20. }
  21. } // namespace
  22. TEST(SSLClientAuthCacheTest, LookupAddRemove) {
  23. SSLClientAuthCache cache;
  24. HostPortPair server1("foo1", 443);
  25. scoped_refptr<X509Certificate> cert1(
  26. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem"));
  27. ASSERT_TRUE(cert1);
  28. HostPortPair server2("foo2", 443);
  29. scoped_refptr<X509Certificate> cert2(
  30. ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem"));
  31. ASSERT_TRUE(cert2);
  32. HostPortPair server3("foo3", 443);
  33. scoped_refptr<X509Certificate> cert3(
  34. ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem"));
  35. ASSERT_TRUE(cert3);
  36. scoped_refptr<X509Certificate> cached_cert;
  37. scoped_refptr<SSLPrivateKey> cached_pkey;
  38. // Lookup non-existent client certificate.
  39. cached_cert = nullptr;
  40. EXPECT_FALSE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  41. // Add client certificate for server1.
  42. cache.Add(server1, cert1.get(), MakeMockKey());
  43. cached_cert = nullptr;
  44. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  45. EXPECT_EQ(cert1, cached_cert);
  46. // Add client certificate for server2.
  47. cache.Add(server2, cert2.get(), MakeMockKey());
  48. cached_cert = nullptr;
  49. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  50. EXPECT_EQ(cert1.get(), cached_cert.get());
  51. cached_cert = nullptr;
  52. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  53. EXPECT_EQ(cert2, cached_cert);
  54. // Overwrite the client certificate for server1.
  55. cache.Add(server1, cert3.get(), MakeMockKey());
  56. cached_cert = nullptr;
  57. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  58. EXPECT_EQ(cert3, cached_cert);
  59. cached_cert = nullptr;
  60. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  61. EXPECT_EQ(cert2, cached_cert);
  62. // Remove client certificate of server1.
  63. cache.Remove(server1);
  64. cached_cert = nullptr;
  65. EXPECT_FALSE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  66. cached_cert = nullptr;
  67. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  68. EXPECT_EQ(cert2, cached_cert);
  69. // Remove non-existent client certificate.
  70. cache.Remove(server1);
  71. cached_cert = nullptr;
  72. EXPECT_FALSE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  73. cached_cert = nullptr;
  74. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  75. EXPECT_EQ(cert2, cached_cert);
  76. }
  77. // Check that if the server differs only by port number, it is considered
  78. // a separate server.
  79. TEST(SSLClientAuthCacheTest, LookupWithPort) {
  80. SSLClientAuthCache cache;
  81. HostPortPair server1("foo", 443);
  82. scoped_refptr<X509Certificate> cert1(
  83. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem"));
  84. ASSERT_TRUE(cert1);
  85. HostPortPair server2("foo", 8443);
  86. scoped_refptr<X509Certificate> cert2(
  87. ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem"));
  88. ASSERT_TRUE(cert2);
  89. cache.Add(server1, cert1.get(), MakeMockKey());
  90. cache.Add(server2, cert2.get(), MakeMockKey());
  91. scoped_refptr<X509Certificate> cached_cert;
  92. scoped_refptr<SSLPrivateKey> cached_pkey;
  93. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  94. EXPECT_EQ(cert1.get(), cached_cert.get());
  95. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  96. EXPECT_EQ(cert2.get(), cached_cert.get());
  97. }
  98. // Check that the a nullptr certificate, indicating the user has declined to
  99. // send a certificate, is properly cached.
  100. TEST(SSLClientAuthCacheTest, LookupNullPreference) {
  101. SSLClientAuthCache cache;
  102. HostPortPair server1("foo", 443);
  103. scoped_refptr<X509Certificate> cert1(
  104. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem"));
  105. ASSERT_TRUE(cert1);
  106. cache.Add(server1, nullptr, MakeMockKey());
  107. scoped_refptr<X509Certificate> cached_cert(cert1);
  108. scoped_refptr<SSLPrivateKey> cached_pkey;
  109. // Make sure that |cached_cert| is updated to nullptr, indicating the user
  110. // declined to send a certificate to |server1|.
  111. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  112. EXPECT_EQ(nullptr, cached_cert.get());
  113. // Remove the existing cached certificate.
  114. cache.Remove(server1);
  115. cached_cert = nullptr;
  116. EXPECT_FALSE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  117. // Add a new preference for a specific certificate.
  118. cache.Add(server1, cert1.get(), MakeMockKey());
  119. cached_cert = nullptr;
  120. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  121. EXPECT_EQ(cert1, cached_cert);
  122. // Replace the specific preference with a nullptr certificate.
  123. cache.Add(server1, nullptr, MakeMockKey());
  124. cached_cert = nullptr;
  125. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  126. EXPECT_EQ(nullptr, cached_cert.get());
  127. }
  128. // Check that the Clear() method removes all cache entries.
  129. TEST(SSLClientAuthCacheTest, Clear) {
  130. SSLClientAuthCache cache;
  131. HostPortPair server1("foo", 443);
  132. scoped_refptr<X509Certificate> cert1(
  133. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem"));
  134. ASSERT_TRUE(cert1);
  135. cache.Add(server1, cert1.get(), MakeMockKey());
  136. HostPortPair server2("foo2", 443);
  137. cache.Add(server2, nullptr, MakeMockKey());
  138. scoped_refptr<X509Certificate> cached_cert;
  139. scoped_refptr<SSLPrivateKey> cached_pkey;
  140. // Demonstrate the set up is correct.
  141. EXPECT_TRUE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  142. EXPECT_EQ(cert1, cached_cert);
  143. EXPECT_TRUE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  144. EXPECT_EQ(nullptr, cached_cert.get());
  145. cache.Clear();
  146. // Check that we no longer have entries for either server.
  147. EXPECT_FALSE(cache.Lookup(server1, &cached_cert, &cached_pkey));
  148. EXPECT_FALSE(cache.Lookup(server2, &cached_cert, &cached_pkey));
  149. }
  150. } // namespace net