Revert of Allow the DTLS fingerprint verification to occur after the handshake.

webrtc/base/sslstreamadapter_unittest.cc

 /*
  *  Copyright 2011 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 307 matching lines @@
 
     if (sig & rtc::SE_READ) {
       ReadData(stream);
     }
 
     if ((stream == client_ssl_.get()) && (sig & rtc::SE_WRITE)) {
       WriteData();
     }
   }
 
-  void SetPeerIdentitiesByDigest(bool correct, bool expect_success) {
-    unsigned char server_digest[20];
-    size_t server_digest_len;
-    unsigned char client_digest[20];
-    size_t client_digest_len;
+  void SetPeerIdentitiesByDigest(bool correct) {
+    unsigned char digest[20];
+    size_t digest_len;
     bool rv;
-    rtc::SSLPeerCertificateDigestError err;
-    rtc::SSLPeerCertificateDigestError expected_err =
-        expect_success
-            ? rtc::SSLPeerCertificateDigestError::NONE
-            : rtc::SSLPeerCertificateDigestError::VERIFICATION_FAILED;
 
     LOG(LS_INFO) << "Setting peer identities by digest";
 
-    rv = server_identity_->certificate().ComputeDigest(
-        rtc::DIGEST_SHA_1, server_digest, 20, &server_digest_len);
+    rv = server_identity_->certificate().ComputeDigest(rtc::DIGEST_SHA_1,
+                                                       digest, 20,
+                                                       &digest_len);
     ASSERT_TRUE(rv);
-    rv = client_identity_->certificate().ComputeDigest(
-        rtc::DIGEST_SHA_1, client_digest, 20, &client_digest_len);
+    if (!correct) {
+      LOG(LS_INFO) << "Setting bogus digest for server cert";
+      digest[0]++;
+    }
+    rv = client_ssl_->SetPeerCertificateDigest(rtc::DIGEST_SHA_1, digest,
+                                               digest_len);
     ASSERT_TRUE(rv);
 
-    if (!correct) {
-      LOG(LS_INFO) << "Setting bogus digest for server cert";
-      server_digest[0]++;
-    }
-    err = client_ssl_->SetPeerCertificateDigest(
-        rtc::DIGEST_SHA_1, server_digest, server_digest_len);
-    EXPECT_EQ(expected_err, err);
 
+    rv = client_identity_->certificate().ComputeDigest(rtc::DIGEST_SHA_1,
+                                                       digest, 20, &digest_len);
+    ASSERT_TRUE(rv);
     if (!correct) {
       LOG(LS_INFO) << "Setting bogus digest for client cert";
-      client_digest[0]++;
+      digest[0]++;
     }
-    err = server_ssl_->SetPeerCertificateDigest(
-        rtc::DIGEST_SHA_1, client_digest, client_digest_len);
-    EXPECT_EQ(expected_err, err);
+    rv = server_ssl_->SetPeerCertificateDigest(rtc::DIGEST_SHA_1, digest,
+                                               digest_len);
+    ASSERT_TRUE(rv);
 
     identities_set_ = true;
   }
 
   void SetupProtocolVersions(rtc::SSLProtocolVersion server_version,
                              rtc::SSLProtocolVersion client_version) {
     server_ssl_->SetMaxProtocolVersion(server_version);
     client_ssl_->SetMaxProtocolVersion(client_version);
   }
 
   void TestHandshake(bool expect_success = true) {
     server_ssl_->SetMode(dtls_ ? rtc::SSL_MODE_DTLS :
                          rtc::SSL_MODE_TLS);
     client_ssl_->SetMode(dtls_ ? rtc::SSL_MODE_DTLS :
                          rtc::SSL_MODE_TLS);
 
     if (!dtls_) {
       // Make sure we simulate a reliable network for TLS.
       // This is just a check to make sure that people don't write wrong
       // tests.
       ASSERT((mtu_ == 1460) && (loss_ == 0) && (lose_first_packet_ == 0));
     }
 
     if (!identities_set_)
-      SetPeerIdentitiesByDigest(true, true);
+      SetPeerIdentitiesByDigest(true);
 
     // Start the handshake
     int rv;
 
     server_ssl_->SetServerRole();
     rv = server_ssl_->StartSSL();
     ASSERT_EQ(0, rv);
 
     rv = client_ssl_->StartSSL();
     ASSERT_EQ(0, rv);
 
     // Now run the handshake
     if (expect_success) {
       EXPECT_TRUE_WAIT((client_ssl_->GetState() == rtc::SS_OPEN)
                        && (server_ssl_->GetState() == rtc::SS_OPEN),
                        handshake_wait_);
     } else {
       EXPECT_TRUE_WAIT(client_ssl_->GetState() == rtc::SS_CLOSED,
                        handshake_wait_);
     }
   }
 
-  // This tests that the handshake can complete before the identity is
-  // verified, and the identity will be verified after the fact.
-  void TestHandshakeWithDelayedIdentity(bool valid_identity) {
-    server_ssl_->SetMode(dtls_ ? rtc::SSL_MODE_DTLS : rtc::SSL_MODE_TLS);
-    client_ssl_->SetMode(dtls_ ? rtc::SSL_MODE_DTLS : rtc::SSL_MODE_TLS);
-
-    if (!dtls_) {
-      // Make sure we simulate a reliable network for TLS.
-      // This is just a check to make sure that people don't write wrong
-      // tests.
-      ASSERT((mtu_ == 1460) && (loss_ == 0) && (lose_first_packet_ == 0));
-    }
-
-    // Start the handshake
-    int rv;
-
-    server_ssl_->SetServerRole();
-    rv = server_ssl_->StartSSL();
-    ASSERT_EQ(0, rv);
-
-    rv = client_ssl_->StartSSL();
-    ASSERT_EQ(0, rv);
-
-    // Now run the handshake.
-    EXPECT_TRUE_WAIT(
-        client_ssl_->IsTlsConnected() && server_ssl_->IsTlsConnected(),
-        handshake_wait_);
-
-    // Until the identity has been verified, the state should still be
-    // SS_OPENING and writes should return SR_BLOCK.
-    EXPECT_EQ(rtc::SS_OPENING, client_ssl_->GetState());
-    EXPECT_EQ(rtc::SS_OPENING, server_ssl_->GetState());
-    unsigned char packet[1];
-    size_t sent;
-    EXPECT_EQ(rtc::SR_BLOCK, client_ssl_->Write(&packet, 1, &sent, 0));
-    EXPECT_EQ(rtc::SR_BLOCK, server_ssl_->Write(&packet, 1, &sent, 0));
-
-    // If we set an invalid identity at this point, SetPeerCertificateDigest
-    // should return false.
-    SetPeerIdentitiesByDigest(valid_identity, valid_identity);
-    // State should then transition to SS_OPEN or SS_CLOSED based on validation
-    // of the identity.
-    if (valid_identity) {
-      EXPECT_EQ(rtc::SS_OPEN, client_ssl_->GetState());
-      EXPECT_EQ(rtc::SS_OPEN, server_ssl_->GetState());
-    } else {
-      EXPECT_EQ(rtc::SS_CLOSED, client_ssl_->GetState());
-      EXPECT_EQ(rtc::SS_CLOSED, server_ssl_->GetState());
-    }
-  }
-
   rtc::StreamResult DataWritten(SSLDummyStreamBase *from, const void *data,
                                 size_t data_len, size_t *written,
                                 int *error) {
     // Randomly drop loss_ percent of packets
     if (rtc::CreateRandomId() % 100 < static_cast<uint32_t>(loss_)) {
       LOG(LS_INFO) << "Randomly dropping packet, size=" << data_len;
       *written = data_len;
       return rtc::SR_SUCCESS;
     }
     if (dtls_ && (data_len > mtu_)) {
@@ skipping 427 matching lines @@
   rv = client_ssl_->Write(block, sizeof(block), &dummy, NULL);
   ASSERT_EQ(rtc::SR_ERROR, rv);
 
   // But after closed read gives you EOS.
   rv = client_ssl_->Read(block, sizeof(block), &dummy, NULL);
   ASSERT_EQ(rtc::SR_EOS, rv);
 };
 
 // Test a handshake with a bogus peer digest
 TEST_P(SSLStreamAdapterTestTLS, TestTLSBogusDigest) {
-  SetPeerIdentitiesByDigest(false, true);
+  SetPeerIdentitiesByDigest(false);
   TestHandshake(false);
 };
 
-TEST_P(SSLStreamAdapterTestTLS, TestTLSDelayedIdentity) {
-  TestHandshakeWithDelayedIdentity(true);
-};
-
-TEST_P(SSLStreamAdapterTestTLS, TestTLSDelayedIdentityWithBogusDigest) {
-  TestHandshakeWithDelayedIdentity(false);
-};
-
 // Test moving a bunch of data
 
 // Basic tests: DTLS
 // Test that we can make a handshake work
 TEST_P(SSLStreamAdapterTestDTLS, TestDTLSConnect) {
   MAYBE_SKIP_TEST(HaveDtls);
   TestHandshake();
 };
 
 // Test that we can make a handshake work if the first packet in
@@ skipping 38 matching lines @@
 };
 
 TEST_P(SSLStreamAdapterTestDTLS, TestDTLSTransferWithDamage) {
   MAYBE_SKIP_TEST(HaveDtls);
   SetDamage();  // Must be called first because first packet
                 // write happens at end of handshake.
   TestHandshake();
   TestTransfer(100);
 };
 
-TEST_P(SSLStreamAdapterTestDTLS, TestDTLSDelayedIdentity) {
-  TestHandshakeWithDelayedIdentity(true);
-};
-
-TEST_P(SSLStreamAdapterTestDTLS, TestDTLSDelayedIdentityWithBogusDigest) {
-  TestHandshakeWithDelayedIdentity(false);
-};
-
 // Test DTLS-SRTP with all high ciphers
 TEST_P(SSLStreamAdapterTestDTLS, TestDTLSSrtpHigh) {
   MAYBE_SKIP_TEST(HaveDtlsSrtp);
   std::vector<int> high;
   high.push_back(rtc::SRTP_AES128_CM_SHA1_80);
   SetDtlsSrtpCryptoSuites(high, true);
   SetDtlsSrtpCryptoSuites(high, false);
   TestHandshake();
 
   int client_cipher;
@@ skipping 334 matching lines @@
                    rtc::KeyParams::ECDSA(rtc::EC_NIST_P256))));
 INSTANTIATE_TEST_CASE_P(
     SSLStreamAdapterTestsDTLS,
     SSLStreamAdapterTestDTLS,
     Combine(Values(rtc::KeyParams::RSA(1024, 65537),
                    rtc::KeyParams::RSA(1152, 65537),
                    rtc::KeyParams::ECDSA(rtc::EC_NIST_P256)),
             Values(rtc::KeyParams::RSA(1024, 65537),
                    rtc::KeyParams::RSA(1152, 65537),
                    rtc::KeyParams::ECDSA(rtc::EC_NIST_P256))));