| OLD | NEW |
| 1 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
| 6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
| 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
| 8 | 8 |
| 9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
| 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 57 #include <secerr.h> | 57 #include <secerr.h> |
| 58 #include <ssl.h> | 58 #include <ssl.h> |
| 59 #include <sslerr.h> | 59 #include <sslerr.h> |
| 60 #include <pk11pub.h> | 60 #include <pk11pub.h> |
| 61 | 61 |
| 62 #include "base/compiler_specific.h" | 62 #include "base/compiler_specific.h" |
| 63 #include "base/logging.h" | 63 #include "base/logging.h" |
| 64 #include "base/nss_util.h" | 64 #include "base/nss_util.h" |
| 65 #include "base/singleton.h" | 65 #include "base/singleton.h" |
| 66 #include "base/string_util.h" | 66 #include "base/string_util.h" |
| 67 #include "net/base/address_list.h" |
| 67 #include "net/base/cert_verifier.h" | 68 #include "net/base/cert_verifier.h" |
| 68 #include "net/base/io_buffer.h" | 69 #include "net/base/io_buffer.h" |
| 69 #include "net/base/load_log.h" | 70 #include "net/base/load_log.h" |
| 70 #include "net/base/net_errors.h" | 71 #include "net/base/net_errors.h" |
| 71 #include "net/base/ssl_cert_request_info.h" | 72 #include "net/base/ssl_cert_request_info.h" |
| 72 #include "net/base/ssl_info.h" | 73 #include "net/base/ssl_info.h" |
| 74 #include "net/base/sys_addrinfo.h" |
| 73 #include "net/ocsp/nss_ocsp.h" | 75 #include "net/ocsp/nss_ocsp.h" |
| 74 | 76 |
| 75 static const int kRecvBufferSize = 4096; | 77 static const int kRecvBufferSize = 4096; |
| 76 | 78 |
| 77 namespace net { | 79 namespace net { |
| 78 | 80 |
| 79 // State machines are easier to debug if you log state transitions. | 81 // State machines are easier to debug if you log state transitions. |
| 80 // Enable these if you want to see what's going on. | 82 // Enable these if you want to see what's going on. |
| 81 #if 1 | 83 #if 1 |
| 82 #define EnterFunction(x) | 84 #define EnterFunction(x) |
| (...skipping 223 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 306 | 308 |
| 307 int SSLClientSocketNSS::InitializeSSLOptions() { | 309 int SSLClientSocketNSS::InitializeSSLOptions() { |
| 308 // Transport connected, now hook it up to nss | 310 // Transport connected, now hook it up to nss |
| 309 // TODO(port): specify rx and tx buffer sizes separately | 311 // TODO(port): specify rx and tx buffer sizes separately |
| 310 nss_fd_ = memio_CreateIOLayer(kRecvBufferSize); | 312 nss_fd_ = memio_CreateIOLayer(kRecvBufferSize); |
| 311 if (nss_fd_ == NULL) { | 313 if (nss_fd_ == NULL) { |
| 312 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR error code. | 314 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR error code. |
| 313 } | 315 } |
| 314 | 316 |
| 315 // Tell NSS who we're connected to | 317 // Tell NSS who we're connected to |
| 316 PRNetAddr peername; | 318 AddressList peer_address; |
| 317 socklen_t len = sizeof(PRNetAddr); | 319 int err = transport_->GetPeerAddress(&peer_address); |
| 318 int err = transport_->GetPeerName((struct sockaddr *)&peername, &len); | 320 if (err != OK) |
| 319 if (err) { | 321 return err; |
| 320 DLOG(ERROR) << "GetPeerName failed"; | 322 const struct addrinfo* ai = peer_address.head(); |
| 321 // TODO(wtc): Change GetPeerName to return a network error code. | 323 memio_SetPeerName(nss_fd_, ai->ai_addr, ai->ai_addrlen); |
| 322 return ERR_UNEXPECTED; | |
| 323 } | |
| 324 memio_SetPeerName(nss_fd_, &peername); | |
| 325 | 324 |
| 326 // Grab pointer to buffers | 325 // Grab pointer to buffers |
| 327 nss_bufs_ = memio_GetSecret(nss_fd_); | 326 nss_bufs_ = memio_GetSecret(nss_fd_); |
| 328 | 327 |
| 329 /* Create SSL state machine */ | 328 /* Create SSL state machine */ |
| 330 /* Push SSL onto our fake I/O socket */ | 329 /* Push SSL onto our fake I/O socket */ |
| 331 nss_fd_ = SSL_ImportFD(NULL, nss_fd_); | 330 nss_fd_ = SSL_ImportFD(NULL, nss_fd_); |
| 332 if (nss_fd_ == NULL) { | 331 if (nss_fd_ == NULL) { |
| 333 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR/NSS error code. | 332 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR/NSS error code. |
| 334 } | 333 } |
| (...skipping 87 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 422 rv = SSL_HandshakeCallback(nss_fd_, HandshakeCallback, this); | 421 rv = SSL_HandshakeCallback(nss_fd_, HandshakeCallback, this); |
| 423 if (rv != SECSuccess) | 422 if (rv != SECSuccess) |
| 424 return ERR_UNEXPECTED; | 423 return ERR_UNEXPECTED; |
| 425 | 424 |
| 426 // Tell SSL the hostname we're trying to connect to. | 425 // Tell SSL the hostname we're trying to connect to. |
| 427 SSL_SetURL(nss_fd_, hostname_.c_str()); | 426 SSL_SetURL(nss_fd_, hostname_.c_str()); |
| 428 | 427 |
| 429 // Set the peer ID for session reuse. This is necessary when we create an | 428 // Set the peer ID for session reuse. This is necessary when we create an |
| 430 // SSL tunnel through a proxy -- GetPeerName returns the proxy's address | 429 // SSL tunnel through a proxy -- GetPeerName returns the proxy's address |
| 431 // rather than the destination server's address in that case. | 430 // rather than the destination server's address in that case. |
| 432 // TODO(wtc): port in peername is not the server's port when a proxy is used. | 431 // TODO(wtc): port in |peer_address| is not the server's port when a proxy is |
| 432 // used. |
| 433 std::string peer_id = StringPrintf("%s:%d", hostname_.c_str(), | 433 std::string peer_id = StringPrintf("%s:%d", hostname_.c_str(), |
| 434 PR_ntohs(PR_NetAddrInetPort(&peername))); | 434 peer_address.GetPort()); |
| 435 rv = SSL_SetSockPeerID(nss_fd_, const_cast<char*>(peer_id.c_str())); | 435 rv = SSL_SetSockPeerID(nss_fd_, const_cast<char*>(peer_id.c_str())); |
| 436 if (rv != SECSuccess) | 436 if (rv != SECSuccess) |
| 437 LOG(INFO) << "SSL_SetSockPeerID failed: peer_id=" << peer_id; | 437 LOG(INFO) << "SSL_SetSockPeerID failed: peer_id=" << peer_id; |
| 438 | 438 |
| 439 // Tell SSL we're a client; needed if not letting NSPR do socket I/O | 439 // Tell SSL we're a client; needed if not letting NSPR do socket I/O |
| 440 SSL_ResetHandshake(nss_fd_, 0); | 440 SSL_ResetHandshake(nss_fd_, 0); |
| 441 | 441 |
| 442 return OK; | 442 return OK; |
| 443 } | 443 } |
| 444 | 444 |
| (...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 508 // alert message from the server, and return false in that case. Although | 508 // alert message from the server, and return false in that case. Although |
| 509 // the close_notify alert message means EOF in the SSL layer, it is just | 509 // the close_notify alert message means EOF in the SSL layer, it is just |
| 510 // bytes to the transport layer below, so transport_->IsConnectedAndIdle() | 510 // bytes to the transport layer below, so transport_->IsConnectedAndIdle() |
| 511 // returns the desired false when we receive close_notify. | 511 // returns the desired false when we receive close_notify. |
| 512 EnterFunction(""); | 512 EnterFunction(""); |
| 513 bool ret = completed_handshake_ && transport_->IsConnectedAndIdle(); | 513 bool ret = completed_handshake_ && transport_->IsConnectedAndIdle(); |
| 514 LeaveFunction(""); | 514 LeaveFunction(""); |
| 515 return ret; | 515 return ret; |
| 516 } | 516 } |
| 517 | 517 |
| 518 int SSLClientSocketNSS::GetPeerName(struct sockaddr* name, socklen_t* namelen) { | 518 int SSLClientSocketNSS::GetPeerAddress(AddressList* address) const { |
| 519 return transport_->GetPeerName(name, namelen); | 519 return transport_->GetPeerAddress(address); |
| 520 } | 520 } |
| 521 | 521 |
| 522 int SSLClientSocketNSS::Read(IOBuffer* buf, int buf_len, | 522 int SSLClientSocketNSS::Read(IOBuffer* buf, int buf_len, |
| 523 CompletionCallback* callback) { | 523 CompletionCallback* callback) { |
| 524 EnterFunction(buf_len); | 524 EnterFunction(buf_len); |
| 525 DCHECK(completed_handshake_); | 525 DCHECK(completed_handshake_); |
| 526 DCHECK(next_handshake_state_ == STATE_NONE); | 526 DCHECK(next_handshake_state_ == STATE_NONE); |
| 527 DCHECK(!user_read_callback_); | 527 DCHECK(!user_read_callback_); |
| 528 DCHECK(!user_connect_callback_); | 528 DCHECK(!user_connect_callback_); |
| 529 DCHECK(!user_read_buf_); | 529 DCHECK(!user_read_buf_); |
| (...skipping 775 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1305 } | 1305 } |
| 1306 PRErrorCode prerr = PR_GetError(); | 1306 PRErrorCode prerr = PR_GetError(); |
| 1307 if (prerr == PR_WOULD_BLOCK_ERROR) { | 1307 if (prerr == PR_WOULD_BLOCK_ERROR) { |
| 1308 return ERR_IO_PENDING; | 1308 return ERR_IO_PENDING; |
| 1309 } | 1309 } |
| 1310 LeaveFunction(""); | 1310 LeaveFunction(""); |
| 1311 return MapNSPRError(prerr); | 1311 return MapNSPRError(prerr); |
| 1312 } | 1312 } |
| 1313 | 1313 |
| 1314 } // namespace net | 1314 } // namespace net |
| OLD | NEW |