| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
| 6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
| 7 | 7 |
| 8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
| 9 | 9 |
| 10 #include <errno.h> | 10 #include <errno.h> |
| (...skipping 870 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 881 do { | 881 do { |
| 882 rv = BufferSend(); | 882 rv = BufferSend(); |
| 883 if (rv != ERR_IO_PENDING && rv != 0) | 883 if (rv != ERR_IO_PENDING && rv != 0) |
| 884 network_moved = true; | 884 network_moved = true; |
| 885 } while (rv > 0); | 885 } while (rv > 0); |
| 886 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) | 886 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) |
| 887 network_moved = true; | 887 network_moved = true; |
| 888 return network_moved; | 888 return network_moved; |
| 889 } | 889 } |
| 890 | 890 |
| 891 // TODO(vadimt): Remove including "base/threading/thread_local.h" and | 891 // TODO(cbentzel): Remove including "base/threading/thread_local.h" and |
| 892 // g_first_run_completed once crbug.com/424386 is fixed. | 892 // g_first_run_completed once crbug.com/424386 is fixed. |
| 893 base::LazyInstance<base::ThreadLocalBoolean>::Leaky g_first_run_completed = | 893 base::LazyInstance<base::ThreadLocalBoolean>::Leaky g_first_run_completed = |
| 894 LAZY_INSTANCE_INITIALIZER; | 894 LAZY_INSTANCE_INITIALIZER; |
| 895 | 895 |
| 896 int SSLClientSocketOpenSSL::DoHandshake() { | 896 int SSLClientSocketOpenSSL::DoHandshake() { |
| 897 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 897 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 898 int net_error = OK; | 898 int net_error = OK; |
| 899 | 899 |
| 900 int rv; | 900 int rv; |
| 901 | 901 |
| 902 // TODO(vadimt): Leave only 1 call to SSL_do_handshake once crbug.com/424386 | 902 // TODO(cbentzel): Leave only 1 call to SSL_do_handshake once crbug.com/424386 |
| 903 // is fixed. | 903 // is fixed. |
| 904 if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) { | 904 if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) { |
| 905 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 906 tracked_objects::ScopedTracker tracking_profile1( | |
| 907 FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 DoHandshake_WithCert")); | |
| 908 | |
| 909 rv = SSL_do_handshake(ssl_); | 905 rv = SSL_do_handshake(ssl_); |
| 910 } else { | 906 } else { |
| 911 if (g_first_run_completed.Get().Get()) { | 907 if (g_first_run_completed.Get().Get()) { |
| 912 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | 908 // TODO(cbentzel): Remove ScopedTracker below once crbug.com/424386 is |
| 913 // fixed. | 909 // fixed. |
| 914 tracked_objects::ScopedTracker tracking_profile1( | 910 tracked_objects::ScopedTracker tracking_profile( |
| 915 FROM_HERE_WITH_EXPLICIT_FUNCTION( | 911 FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 SSL_do_handshake()")); |
| 916 "424386 DoHandshake_WithoutCert Not First")); | |
| 917 | 912 |
| 918 rv = SSL_do_handshake(ssl_); | 913 rv = SSL_do_handshake(ssl_); |
| 919 } else { | 914 } else { |
| 920 g_first_run_completed.Get().Set(true); | 915 g_first_run_completed.Get().Set(true); |
| 921 | |
| 922 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | |
| 923 // fixed. | |
| 924 tracked_objects::ScopedTracker tracking_profile1( | |
| 925 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 926 "424386 DoHandshake_WithoutCert First")); | |
| 927 | |
| 928 rv = SSL_do_handshake(ssl_); | 916 rv = SSL_do_handshake(ssl_); |
| 929 } | 917 } |
| 930 } | 918 } |
| 931 | 919 |
| 932 if (rv == 1) { | 920 if (rv == 1) { |
| 933 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 934 tracked_objects::ScopedTracker tracking_profile3( | |
| 935 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 936 "424386 SSLClientSocketOpenSSL::DoHandshake3")); | |
| 937 | |
| 938 if (trying_cached_session_ && logging::DEBUG_MODE) { | 921 if (trying_cached_session_ && logging::DEBUG_MODE) { |
| 939 DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString() | 922 DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString() |
| 940 << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail"); | 923 << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail"); |
| 941 } | 924 } |
| 942 | 925 |
| 943 if (ssl_config_.version_fallback && | 926 if (ssl_config_.version_fallback && |
| 944 ssl_config_.version_max < ssl_config_.version_fallback_min) { | 927 ssl_config_.version_max < ssl_config_.version_fallback_min) { |
| 945 return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION; | 928 return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION; |
| 946 } | 929 } |
| 947 | 930 |
| (...skipping 27 matching lines...) Expand all Loading... |
| 975 | 958 |
| 976 const uint8_t* sct_list; | 959 const uint8_t* sct_list; |
| 977 size_t sct_list_len; | 960 size_t sct_list_len; |
| 978 SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len); | 961 SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len); |
| 979 set_signed_cert_timestamps_received(sct_list_len != 0); | 962 set_signed_cert_timestamps_received(sct_list_len != 0); |
| 980 | 963 |
| 981 // Verify the certificate. | 964 // Verify the certificate. |
| 982 UpdateServerCert(); | 965 UpdateServerCert(); |
| 983 GotoState(STATE_VERIFY_CERT); | 966 GotoState(STATE_VERIFY_CERT); |
| 984 } else { | 967 } else { |
| 985 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 986 tracked_objects::ScopedTracker tracking_profile4( | |
| 987 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 988 "424386 SSLClientSocketOpenSSL::DoHandshake4")); | |
| 989 | |
| 990 if (client_auth_cert_needed_) | 968 if (client_auth_cert_needed_) |
| 991 return ERR_SSL_CLIENT_AUTH_CERT_NEEDED; | 969 return ERR_SSL_CLIENT_AUTH_CERT_NEEDED; |
| 992 | 970 |
| 993 int ssl_error = SSL_get_error(ssl_, rv); | 971 int ssl_error = SSL_get_error(ssl_, rv); |
| 994 | 972 |
| 995 if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) { | 973 if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) { |
| 996 // The server supports channel ID. Stop to look one up before returning to | 974 // The server supports channel ID. Stop to look one up before returning to |
| 997 // the handshake. | 975 // the handshake. |
| 998 channel_id_xtn_negotiated_ = true; | 976 channel_id_xtn_negotiated_ = true; |
| 999 GotoState(STATE_CHANNEL_ID_LOOKUP); | 977 GotoState(STATE_CHANNEL_ID_LOOKUP); |
| (...skipping 183 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1183 | 1161 |
| 1184 void SSLClientSocketOpenSSL::DoConnectCallback(int rv) { | 1162 void SSLClientSocketOpenSSL::DoConnectCallback(int rv) { |
| 1185 if (!user_connect_callback_.is_null()) { | 1163 if (!user_connect_callback_.is_null()) { |
| 1186 CompletionCallback c = user_connect_callback_; | 1164 CompletionCallback c = user_connect_callback_; |
| 1187 user_connect_callback_.Reset(); | 1165 user_connect_callback_.Reset(); |
| 1188 c.Run(rv > OK ? OK : rv); | 1166 c.Run(rv > OK ? OK : rv); |
| 1189 } | 1167 } |
| 1190 } | 1168 } |
| 1191 | 1169 |
| 1192 void SSLClientSocketOpenSSL::UpdateServerCert() { | 1170 void SSLClientSocketOpenSSL::UpdateServerCert() { |
| 1193 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1194 tracked_objects::ScopedTracker tracking_profile( | |
| 1195 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1196 "424386 SSLClientSocketOpenSSL::UpdateServerCert")); | |
| 1197 | |
| 1198 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); | 1171 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); |
| 1199 | |
| 1200 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1201 tracked_objects::ScopedTracker tracking_profile1( | |
| 1202 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1203 "424386 SSLClientSocketOpenSSL::UpdateServerCert1")); | |
| 1204 server_cert_ = server_cert_chain_->AsOSChain(); | 1172 server_cert_ = server_cert_chain_->AsOSChain(); |
| 1205 | |
| 1206 if (server_cert_.get()) { | 1173 if (server_cert_.get()) { |
| 1207 net_log_.AddEvent( | 1174 net_log_.AddEvent( |
| 1208 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, | 1175 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, |
| 1209 base::Bind(&NetLogX509CertificateCallback, | 1176 base::Bind(&NetLogX509CertificateCallback, |
| 1210 base::Unretained(server_cert_.get()))); | 1177 base::Unretained(server_cert_.get()))); |
| 1211 | 1178 |
| 1212 // TODO(rsleevi): Plumb an OCSP response into the Mac system library and | 1179 // TODO(rsleevi): Plumb an OCSP response into the Mac system library and |
| 1213 // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714 | 1180 // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714 |
| 1214 if (IsOCSPStaplingSupported()) { | 1181 if (IsOCSPStaplingSupported()) { |
| 1215 #if defined(OS_WIN) | 1182 #if defined(OS_WIN) |
| 1216 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | |
| 1217 // fixed. | |
| 1218 tracked_objects::ScopedTracker tracking_profile2( | |
| 1219 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1220 "424386 SSLClientSocketOpenSSL::UpdateServerCert2")); | |
| 1221 | |
| 1222 const uint8_t* ocsp_response_raw; | 1183 const uint8_t* ocsp_response_raw; |
| 1223 size_t ocsp_response_len; | 1184 size_t ocsp_response_len; |
| 1224 SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); | 1185 SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); |
| 1225 | 1186 |
| 1226 CRYPT_DATA_BLOB ocsp_response_blob; | 1187 CRYPT_DATA_BLOB ocsp_response_blob; |
| 1227 ocsp_response_blob.cbData = ocsp_response_len; | 1188 ocsp_response_blob.cbData = ocsp_response_len; |
| 1228 ocsp_response_blob.pbData = const_cast<BYTE*>(ocsp_response_raw); | 1189 ocsp_response_blob.pbData = const_cast<BYTE*>(ocsp_response_raw); |
| 1229 BOOL ok = CertSetCertificateContextProperty( | 1190 BOOL ok = CertSetCertificateContextProperty( |
| 1230 server_cert_->os_cert_handle(), | 1191 server_cert_->os_cert_handle(), |
| 1231 CERT_OCSP_RESPONSE_PROP_ID, | 1192 CERT_OCSP_RESPONSE_PROP_ID, |
| (...skipping 424 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1656 bytes_read = result; | 1617 bytes_read = result; |
| 1657 } | 1618 } |
| 1658 DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read); | 1619 DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read); |
| 1659 int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read); | 1620 int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read); |
| 1660 DCHECK_EQ(1, ret); | 1621 DCHECK_EQ(1, ret); |
| 1661 transport_recv_busy_ = false; | 1622 transport_recv_busy_ = false; |
| 1662 return result; | 1623 return result; |
| 1663 } | 1624 } |
| 1664 | 1625 |
| 1665 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { | 1626 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { |
| 1666 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1667 tracked_objects::ScopedTracker tracking_profile( | |
| 1668 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1669 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback")); | |
| 1670 | |
| 1671 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; | 1627 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; |
| 1672 DCHECK(ssl == ssl_); | 1628 DCHECK(ssl == ssl_); |
| 1673 | 1629 |
| 1674 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); | 1630 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); |
| 1675 | 1631 |
| 1676 // Clear any currently configured certificates. | 1632 // Clear any currently configured certificates. |
| 1677 SSL_certs_clear(ssl_); | 1633 SSL_certs_clear(ssl_); |
| 1678 | 1634 |
| 1679 #if defined(OS_IOS) | 1635 #if defined(OS_IOS) |
| 1680 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). | 1636 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). |
| (...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1758 } | 1714 } |
| 1759 #endif // defined(OS_IOS) | 1715 #endif // defined(OS_IOS) |
| 1760 | 1716 |
| 1761 // Send no client certificate. | 1717 // Send no client certificate. |
| 1762 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1718 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, |
| 1763 NetLog::IntegerCallback("cert_count", 0)); | 1719 NetLog::IntegerCallback("cert_count", 0)); |
| 1764 return 1; | 1720 return 1; |
| 1765 } | 1721 } |
| 1766 | 1722 |
| 1767 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { | 1723 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { |
| 1768 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1769 tracked_objects::ScopedTracker tracking_profile( | |
| 1770 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1771 "424386 SSLClientSocketOpenSSL::CertVerifyCallback")); | |
| 1772 | |
| 1773 if (!completed_connect_) { | 1724 if (!completed_connect_) { |
| 1774 // If the first handshake hasn't completed then we accept any certificates | 1725 // If the first handshake hasn't completed then we accept any certificates |
| 1775 // because we verify after the handshake. | 1726 // because we verify after the handshake. |
| 1776 return 1; | 1727 return 1; |
| 1777 } | 1728 } |
| 1778 | 1729 |
| 1779 // Disallow the server certificate to change in a renegotiation. | 1730 // Disallow the server certificate to change in a renegotiation. |
| 1780 if (server_cert_chain_->empty()) { | 1731 if (server_cert_chain_->empty()) { |
| 1781 LOG(ERROR) << "Received invalid certificate chain between handshakes"; | 1732 LOG(ERROR) << "Received invalid certificate chain between handshakes"; |
| 1782 return 0; | 1733 return 0; |
| (...skipping 14 matching lines...) Expand all Loading... |
| 1797 } | 1748 } |
| 1798 | 1749 |
| 1799 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the | 1750 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the |
| 1800 // server supports NPN, selects a protocol from the list that the server | 1751 // server supports NPN, selects a protocol from the list that the server |
| 1801 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the | 1752 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the |
| 1802 // callback can assume that |in| is syntactically valid. | 1753 // callback can assume that |in| is syntactically valid. |
| 1803 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, | 1754 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, |
| 1804 unsigned char* outlen, | 1755 unsigned char* outlen, |
| 1805 const unsigned char* in, | 1756 const unsigned char* in, |
| 1806 unsigned int inlen) { | 1757 unsigned int inlen) { |
| 1807 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1808 tracked_objects::ScopedTracker tracking_profile( | |
| 1809 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1810 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback")); | |
| 1811 | |
| 1812 if (ssl_config_.next_protos.empty()) { | 1758 if (ssl_config_.next_protos.empty()) { |
| 1813 *out = reinterpret_cast<uint8*>( | 1759 *out = reinterpret_cast<uint8*>( |
| 1814 const_cast<char*>(kDefaultSupportedNPNProtocol)); | 1760 const_cast<char*>(kDefaultSupportedNPNProtocol)); |
| 1815 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; | 1761 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; |
| 1816 npn_status_ = kNextProtoUnsupported; | 1762 npn_status_ = kNextProtoUnsupported; |
| 1817 return SSL_TLSEXT_ERR_OK; | 1763 return SSL_TLSEXT_ERR_OK; |
| 1818 } | 1764 } |
| 1819 | 1765 |
| 1820 // Assume there's no overlap between our protocols and the server's list. | 1766 // Assume there's no overlap between our protocols and the server's list. |
| 1821 npn_status_ = kNextProtoNoOverlap; | 1767 npn_status_ = kNextProtoNoOverlap; |
| (...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1882 } | 1828 } |
| 1883 return retvalue; | 1829 return retvalue; |
| 1884 } | 1830 } |
| 1885 | 1831 |
| 1886 // static | 1832 // static |
| 1887 long SSLClientSocketOpenSSL::BIOCallback( | 1833 long SSLClientSocketOpenSSL::BIOCallback( |
| 1888 BIO *bio, | 1834 BIO *bio, |
| 1889 int cmd, | 1835 int cmd, |
| 1890 const char *argp, int argi, long argl, | 1836 const char *argp, int argi, long argl, |
| 1891 long retvalue) { | 1837 long retvalue) { |
| 1892 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
| 1893 tracked_objects::ScopedTracker tracking_profile( | |
| 1894 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
| 1895 "424386 SSLClientSocketOpenSSL::BIOCallback")); | |
| 1896 | |
| 1897 SSLClientSocketOpenSSL* socket = reinterpret_cast<SSLClientSocketOpenSSL*>( | 1838 SSLClientSocketOpenSSL* socket = reinterpret_cast<SSLClientSocketOpenSSL*>( |
| 1898 BIO_get_callback_arg(bio)); | 1839 BIO_get_callback_arg(bio)); |
| 1899 CHECK(socket); | 1840 CHECK(socket); |
| 1900 return socket->MaybeReplayTransportError( | 1841 return socket->MaybeReplayTransportError( |
| 1901 bio, cmd, argp, argi, argl, retvalue); | 1842 bio, cmd, argp, argi, argl, retvalue); |
| 1902 } | 1843 } |
| 1903 | 1844 |
| 1904 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const { | 1845 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const { |
| 1905 for (ct::SCTList::const_iterator iter = | 1846 for (ct::SCTList::const_iterator iter = |
| 1906 ct_verify_result_.verified_scts.begin(); | 1847 ct_verify_result_.verified_scts.begin(); |
| (...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1954 | 1895 |
| 1955 return result; | 1896 return result; |
| 1956 } | 1897 } |
| 1957 | 1898 |
| 1958 scoped_refptr<X509Certificate> | 1899 scoped_refptr<X509Certificate> |
| 1959 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1900 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
| 1960 return server_cert_; | 1901 return server_cert_; |
| 1961 } | 1902 } |
| 1962 | 1903 |
| 1963 } // namespace net | 1904 } // namespace net |
| OLD | NEW |