| OLD | NEW |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ | 5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ |
| 6 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ | 6 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ |
| 7 #pragma once | 7 #pragma once |
| 8 | 8 |
| 9 #include <certt.h> | 9 #include <certt.h> |
| 10 #include <keyt.h> | 10 #include <keyt.h> |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 46 // will be populated with |host_and_port|. |ssl_config| specifies | 46 // will be populated with |host_and_port|. |ssl_config| specifies |
| 47 // the SSL settings. | 47 // the SSL settings. |
| 48 SSLClientSocketNSS(ClientSocketHandle* transport_socket, | 48 SSLClientSocketNSS(ClientSocketHandle* transport_socket, |
| 49 const HostPortPair& host_and_port, | 49 const HostPortPair& host_and_port, |
| 50 const SSLConfig& ssl_config, | 50 const SSLConfig& ssl_config, |
| 51 SSLHostInfo* ssl_host_info, | 51 SSLHostInfo* ssl_host_info, |
| 52 CertVerifier* cert_verifier, | 52 CertVerifier* cert_verifier, |
| 53 DnsCertProvenanceChecker* dnsrr_resolver); | 53 DnsCertProvenanceChecker* dnsrr_resolver); |
| 54 ~SSLClientSocketNSS(); | 54 ~SSLClientSocketNSS(); |
| 55 | 55 |
| 56 // For tests |
| 57 static void ClearSessionCache(); |
| 58 |
| 56 // SSLClientSocket methods: | 59 // SSLClientSocket methods: |
| 57 virtual void GetSSLInfo(SSLInfo* ssl_info); | 60 virtual void GetSSLInfo(SSLInfo* ssl_info); |
| 58 virtual void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info); | 61 virtual void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info); |
| 59 virtual NextProtoStatus GetNextProto(std::string* proto); | 62 virtual NextProtoStatus GetNextProto(std::string* proto); |
| 60 virtual void UseDNSSEC(DNSSECProvider* provider); | 63 virtual void UseDNSSEC(DNSSECProvider* provider); |
| 61 | 64 |
| 62 // ClientSocket methods: | 65 // ClientSocket methods: |
| 63 virtual int Connect(CompletionCallback* callback); | 66 virtual int Connect(CompletionCallback* callback); |
| 64 virtual void Disconnect(); | 67 virtual void Disconnect(); |
| 65 virtual bool IsConnected() const; | 68 virtual bool IsConnected() const; |
| 66 virtual bool IsConnectedAndIdle() const; | 69 virtual bool IsConnectedAndIdle() const; |
| 67 virtual int GetPeerAddress(AddressList* address) const; | 70 virtual int GetPeerAddress(AddressList* address) const; |
| 68 virtual const BoundNetLog& NetLog() const; | 71 virtual const BoundNetLog& NetLog() const; |
| 69 virtual void SetSubresourceSpeculation(); | 72 virtual void SetSubresourceSpeculation(); |
| 70 virtual void SetOmniboxSpeculation(); | 73 virtual void SetOmniboxSpeculation(); |
| 71 virtual bool WasEverUsed() const; | 74 virtual bool WasEverUsed() const; |
| 72 virtual bool UsingTCPFastOpen() const; | 75 virtual bool UsingTCPFastOpen() const; |
| 73 | 76 |
| 74 // Socket methods: | 77 // Socket methods: |
| 75 virtual int Read(IOBuffer* buf, int buf_len, CompletionCallback* callback); | 78 virtual int Read(IOBuffer* buf, int buf_len, CompletionCallback* callback); |
| 76 virtual int Write(IOBuffer* buf, int buf_len, CompletionCallback* callback); | 79 virtual int Write(IOBuffer* buf, int buf_len, CompletionCallback* callback); |
| 77 virtual bool SetReceiveBufferSize(int32 size); | 80 virtual bool SetReceiveBufferSize(int32 size); |
| 78 virtual bool SetSendBufferSize(int32 size); | 81 virtual bool SetSendBufferSize(int32 size); |
| 79 | 82 |
| 80 // For tests | 83 private: |
| 81 static void ClearSessionCache(); | 84 enum State { |
| 85 STATE_NONE, |
| 86 STATE_SNAP_START_LOAD_INFO, |
| 87 STATE_SNAP_START_WAIT_FOR_WRITE, |
| 88 STATE_HANDSHAKE, |
| 89 STATE_VERIFY_DNSSEC, |
| 90 STATE_VERIFY_DNSSEC_COMPLETE, |
| 91 STATE_VERIFY_CERT, |
| 92 STATE_VERIFY_CERT_COMPLETE, |
| 93 }; |
| 82 | 94 |
| 83 private: | 95 int Init(); |
| 96 |
| 84 // Initializes NSS SSL options. Returns a net error code. | 97 // Initializes NSS SSL options. Returns a net error code. |
| 85 int InitializeSSLOptions(); | 98 int InitializeSSLOptions(); |
| 86 | 99 |
| 87 // Initializes the socket peer name in SSL. Returns a net error code. | 100 // Initializes the socket peer name in SSL. Returns a net error code. |
| 88 int InitializeSSLPeerName(); | 101 int InitializeSSLPeerName(); |
| 89 | 102 |
| 90 #if defined(OS_MACOSX) || defined(OS_WIN) | 103 #if defined(OS_MACOSX) || defined(OS_WIN) |
| 91 // Creates an OS certificate from a DER-encoded certificate. | 104 // Creates an OS certificate from a DER-encoded certificate. |
| 92 static X509Certificate::OSCertHandle CreateOSCert(const SECItem& der_cert); | 105 static X509Certificate::OSCertHandle CreateOSCert(const SECItem& der_cert); |
| 93 #endif | 106 #endif |
| (...skipping 14 matching lines...) Expand all Loading... |
| 108 int DoSnapStartWaitForWrite(); | 121 int DoSnapStartWaitForWrite(); |
| 109 int DoHandshake(); | 122 int DoHandshake(); |
| 110 | 123 |
| 111 int DoVerifyDNSSEC(int result); | 124 int DoVerifyDNSSEC(int result); |
| 112 int DoVerifyDNSSECComplete(int result); | 125 int DoVerifyDNSSECComplete(int result); |
| 113 int DoVerifyCert(int result); | 126 int DoVerifyCert(int result); |
| 114 int DoVerifyCertComplete(int result); | 127 int DoVerifyCertComplete(int result); |
| 115 int DoPayloadRead(); | 128 int DoPayloadRead(); |
| 116 int DoPayloadWrite(); | 129 int DoPayloadWrite(); |
| 117 void LogConnectionTypeMetrics() const; | 130 void LogConnectionTypeMetrics() const; |
| 118 int Init(); | |
| 119 void SaveSnapStartInfo(); | 131 void SaveSnapStartInfo(); |
| 120 bool LoadSnapStartInfo(); | 132 bool LoadSnapStartInfo(); |
| 121 bool IsNPNProtocolMispredicted(); | 133 bool IsNPNProtocolMispredicted(); |
| 122 void UncorkAfterTimeout(); | 134 void UncorkAfterTimeout(); |
| 123 | 135 |
| 124 bool DoTransportIO(); | 136 bool DoTransportIO(); |
| 125 int BufferSend(void); | 137 int BufferSend(void); |
| 138 void BufferSendComplete(int result); |
| 126 int BufferRecv(void); | 139 int BufferRecv(void); |
| 127 void BufferSendComplete(int result); | |
| 128 void BufferRecvComplete(int result); | 140 void BufferRecvComplete(int result); |
| 129 | 141 |
| 130 // NSS calls this when checking certificates. We pass 'this' as the first | 142 // NSS calls this when checking certificates. We pass 'this' as the first |
| 131 // argument. | 143 // argument. |
| 132 static SECStatus OwnAuthCertHandler(void* arg, PRFileDesc* socket, | 144 static SECStatus OwnAuthCertHandler(void* arg, PRFileDesc* socket, |
| 133 PRBool checksig, PRBool is_server); | 145 PRBool checksig, PRBool is_server); |
| 134 // NSS calls this when client authentication is requested. | 146 // NSS calls this when client authentication is requested. |
| 135 #if defined(NSS_PLATFORM_CLIENT_AUTH) | 147 #if defined(NSS_PLATFORM_CLIENT_AUTH) |
| 136 static SECStatus PlatformClientAuthHandler(void* arg, | 148 static SECStatus PlatformClientAuthHandler(void* arg, |
| 137 PRFileDesc* socket, | 149 PRFileDesc* socket, |
| (...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 217 bool predicted_cert_chain_correct_; | 229 bool predicted_cert_chain_correct_; |
| 218 | 230 |
| 219 // True if the peer name has been initialized. | 231 // True if the peer name has been initialized. |
| 220 bool peername_initialized_; | 232 bool peername_initialized_; |
| 221 | 233 |
| 222 // This pointer is owned by the caller of UseDNSSEC. | 234 // This pointer is owned by the caller of UseDNSSEC. |
| 223 DNSSECProvider* dnssec_provider_; | 235 DNSSECProvider* dnssec_provider_; |
| 224 // The time when we started waiting for DNSSEC records. | 236 // The time when we started waiting for DNSSEC records. |
| 225 base::Time dnssec_wait_start_time_; | 237 base::Time dnssec_wait_start_time_; |
| 226 | 238 |
| 227 enum State { | |
| 228 STATE_NONE, | |
| 229 STATE_SNAP_START_LOAD_INFO, | |
| 230 STATE_SNAP_START_WAIT_FOR_WRITE, | |
| 231 STATE_HANDSHAKE, | |
| 232 STATE_VERIFY_DNSSEC, | |
| 233 STATE_VERIFY_DNSSEC_COMPLETE, | |
| 234 STATE_VERIFY_CERT, | |
| 235 STATE_VERIFY_CERT_COMPLETE, | |
| 236 }; | |
| 237 State next_handshake_state_; | 239 State next_handshake_state_; |
| 238 | 240 |
| 239 // The NSS SSL state machine | 241 // The NSS SSL state machine |
| 240 PRFileDesc* nss_fd_; | 242 PRFileDesc* nss_fd_; |
| 241 | 243 |
| 242 // Buffers for the network end of the SSL state machine | 244 // Buffers for the network end of the SSL state machine |
| 243 memio_Private* nss_bufs_; | 245 memio_Private* nss_bufs_; |
| 244 | 246 |
| 245 BoundNetLog net_log_; | 247 BoundNetLog net_log_; |
| 246 | 248 |
| 247 // When performing Snap Start we need to predict the NPN protocol which the | 249 // When performing Snap Start we need to predict the NPN protocol which the |
| 248 // server is going to speak before we actually perform the handshake. Thus | 250 // server is going to speak before we actually perform the handshake. Thus |
| 249 // the last NPN protocol used is serialised in |ssl_host_info_| | 251 // the last NPN protocol used is serialised in |ssl_host_info_| |
| 250 // and kept in these fields: | 252 // and kept in these fields: |
| 251 SSLClientSocket::NextProtoStatus predicted_npn_status_; | 253 SSLClientSocket::NextProtoStatus predicted_npn_status_; |
| 252 std::string predicted_npn_proto_; | 254 std::string predicted_npn_proto_; |
| 253 bool predicted_npn_proto_used_; | 255 bool predicted_npn_proto_used_; |
| 254 | 256 |
| 255 base::TimeTicks start_cert_verification_time_; | 257 base::TimeTicks start_cert_verification_time_; |
| 256 | 258 |
| 257 scoped_ptr<SSLHostInfo> ssl_host_info_; | 259 scoped_ptr<SSLHostInfo> ssl_host_info_; |
| 258 DnsCertProvenanceChecker* const dns_cert_checker_; | 260 DnsCertProvenanceChecker* const dns_cert_checker_; |
| 259 }; | 261 }; |
| 260 | 262 |
| 261 } // namespace net | 263 } // namespace net |
| 262 | 264 |
| 263 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ | 265 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_ |
| OLD | NEW |