OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
7 | 7 |
8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
9 | 9 |
10 #include <errno.h> | 10 #include <errno.h> |
(...skipping 870 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
881 do { | 881 do { |
882 rv = BufferSend(); | 882 rv = BufferSend(); |
883 if (rv != ERR_IO_PENDING && rv != 0) | 883 if (rv != ERR_IO_PENDING && rv != 0) |
884 network_moved = true; | 884 network_moved = true; |
885 } while (rv > 0); | 885 } while (rv > 0); |
886 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) | 886 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) |
887 network_moved = true; | 887 network_moved = true; |
888 return network_moved; | 888 return network_moved; |
889 } | 889 } |
890 | 890 |
891 // TODO(vadimt): Remove including "base/threading/thread_local.h" and | 891 // TODO(cbentzel): Remove including "base/threading/thread_local.h" and |
892 // g_first_run_completed once crbug.com/424386 is fixed. | 892 // g_first_run_completed once crbug.com/424386 is fixed. |
893 base::LazyInstance<base::ThreadLocalBoolean>::Leaky g_first_run_completed = | 893 base::LazyInstance<base::ThreadLocalBoolean>::Leaky g_first_run_completed = |
894 LAZY_INSTANCE_INITIALIZER; | 894 LAZY_INSTANCE_INITIALIZER; |
895 | 895 |
896 int SSLClientSocketOpenSSL::DoHandshake() { | 896 int SSLClientSocketOpenSSL::DoHandshake() { |
897 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 897 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
898 int net_error = OK; | 898 int net_error = OK; |
899 | 899 |
900 int rv; | 900 int rv; |
901 | 901 |
902 // TODO(vadimt): Leave only 1 call to SSL_do_handshake once crbug.com/424386 | 902 // TODO(cbentzel): Leave only 1 call to SSL_do_handshake once crbug.com/424386 |
903 // is fixed. | 903 // is fixed. |
904 if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) { | 904 if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) { |
905 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
906 tracked_objects::ScopedTracker tracking_profile1( | |
907 FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 DoHandshake_WithCert")); | |
908 | |
909 rv = SSL_do_handshake(ssl_); | 905 rv = SSL_do_handshake(ssl_); |
910 } else { | 906 } else { |
911 if (g_first_run_completed.Get().Get()) { | 907 if (g_first_run_completed.Get().Get()) { |
912 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | 908 // TODO(cbentzel): Remove ScopedTracker below once crbug.com/424386 is |
913 // fixed. | 909 // fixed. |
914 tracked_objects::ScopedTracker tracking_profile1( | 910 tracked_objects::ScopedTracker tracking_profile( |
915 FROM_HERE_WITH_EXPLICIT_FUNCTION( | 911 FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 SSL_do_handshake()")); |
916 "424386 DoHandshake_WithoutCert Not First")); | |
917 | 912 |
918 rv = SSL_do_handshake(ssl_); | 913 rv = SSL_do_handshake(ssl_); |
919 } else { | 914 } else { |
920 g_first_run_completed.Get().Set(true); | 915 g_first_run_completed.Get().Set(true); |
921 | |
922 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | |
923 // fixed. | |
924 tracked_objects::ScopedTracker tracking_profile1( | |
925 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
926 "424386 DoHandshake_WithoutCert First")); | |
927 | |
928 rv = SSL_do_handshake(ssl_); | 916 rv = SSL_do_handshake(ssl_); |
929 } | 917 } |
930 } | 918 } |
931 | 919 |
932 if (rv == 1) { | 920 if (rv == 1) { |
933 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
934 tracked_objects::ScopedTracker tracking_profile3( | |
935 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
936 "424386 SSLClientSocketOpenSSL::DoHandshake3")); | |
937 | |
938 if (trying_cached_session_ && logging::DEBUG_MODE) { | 921 if (trying_cached_session_ && logging::DEBUG_MODE) { |
939 DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString() | 922 DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString() |
940 << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail"); | 923 << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail"); |
941 } | 924 } |
942 | 925 |
943 if (ssl_config_.version_fallback && | 926 if (ssl_config_.version_fallback && |
944 ssl_config_.version_max < ssl_config_.version_fallback_min) { | 927 ssl_config_.version_max < ssl_config_.version_fallback_min) { |
945 return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION; | 928 return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION; |
946 } | 929 } |
947 | 930 |
(...skipping 27 matching lines...) Expand all Loading... |
975 | 958 |
976 const uint8_t* sct_list; | 959 const uint8_t* sct_list; |
977 size_t sct_list_len; | 960 size_t sct_list_len; |
978 SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len); | 961 SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len); |
979 set_signed_cert_timestamps_received(sct_list_len != 0); | 962 set_signed_cert_timestamps_received(sct_list_len != 0); |
980 | 963 |
981 // Verify the certificate. | 964 // Verify the certificate. |
982 UpdateServerCert(); | 965 UpdateServerCert(); |
983 GotoState(STATE_VERIFY_CERT); | 966 GotoState(STATE_VERIFY_CERT); |
984 } else { | 967 } else { |
985 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
986 tracked_objects::ScopedTracker tracking_profile4( | |
987 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
988 "424386 SSLClientSocketOpenSSL::DoHandshake4")); | |
989 | |
990 if (client_auth_cert_needed_) | 968 if (client_auth_cert_needed_) |
991 return ERR_SSL_CLIENT_AUTH_CERT_NEEDED; | 969 return ERR_SSL_CLIENT_AUTH_CERT_NEEDED; |
992 | 970 |
993 int ssl_error = SSL_get_error(ssl_, rv); | 971 int ssl_error = SSL_get_error(ssl_, rv); |
994 | 972 |
995 if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) { | 973 if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) { |
996 // The server supports channel ID. Stop to look one up before returning to | 974 // The server supports channel ID. Stop to look one up before returning to |
997 // the handshake. | 975 // the handshake. |
998 channel_id_xtn_negotiated_ = true; | 976 channel_id_xtn_negotiated_ = true; |
999 GotoState(STATE_CHANNEL_ID_LOOKUP); | 977 GotoState(STATE_CHANNEL_ID_LOOKUP); |
(...skipping 183 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1183 | 1161 |
1184 void SSLClientSocketOpenSSL::DoConnectCallback(int rv) { | 1162 void SSLClientSocketOpenSSL::DoConnectCallback(int rv) { |
1185 if (!user_connect_callback_.is_null()) { | 1163 if (!user_connect_callback_.is_null()) { |
1186 CompletionCallback c = user_connect_callback_; | 1164 CompletionCallback c = user_connect_callback_; |
1187 user_connect_callback_.Reset(); | 1165 user_connect_callback_.Reset(); |
1188 c.Run(rv > OK ? OK : rv); | 1166 c.Run(rv > OK ? OK : rv); |
1189 } | 1167 } |
1190 } | 1168 } |
1191 | 1169 |
1192 void SSLClientSocketOpenSSL::UpdateServerCert() { | 1170 void SSLClientSocketOpenSSL::UpdateServerCert() { |
1193 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1194 tracked_objects::ScopedTracker tracking_profile( | |
1195 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1196 "424386 SSLClientSocketOpenSSL::UpdateServerCert")); | |
1197 | |
1198 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); | 1171 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); |
1199 | |
1200 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1201 tracked_objects::ScopedTracker tracking_profile1( | |
1202 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1203 "424386 SSLClientSocketOpenSSL::UpdateServerCert1")); | |
1204 server_cert_ = server_cert_chain_->AsOSChain(); | 1172 server_cert_ = server_cert_chain_->AsOSChain(); |
1205 | |
1206 if (server_cert_.get()) { | 1173 if (server_cert_.get()) { |
1207 net_log_.AddEvent( | 1174 net_log_.AddEvent( |
1208 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, | 1175 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, |
1209 base::Bind(&NetLogX509CertificateCallback, | 1176 base::Bind(&NetLogX509CertificateCallback, |
1210 base::Unretained(server_cert_.get()))); | 1177 base::Unretained(server_cert_.get()))); |
1211 | 1178 |
1212 // TODO(rsleevi): Plumb an OCSP response into the Mac system library and | 1179 // TODO(rsleevi): Plumb an OCSP response into the Mac system library and |
1213 // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714 | 1180 // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714 |
1214 if (IsOCSPStaplingSupported()) { | 1181 if (IsOCSPStaplingSupported()) { |
1215 #if defined(OS_WIN) | 1182 #if defined(OS_WIN) |
1216 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is | |
1217 // fixed. | |
1218 tracked_objects::ScopedTracker tracking_profile2( | |
1219 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1220 "424386 SSLClientSocketOpenSSL::UpdateServerCert2")); | |
1221 | |
1222 const uint8_t* ocsp_response_raw; | 1183 const uint8_t* ocsp_response_raw; |
1223 size_t ocsp_response_len; | 1184 size_t ocsp_response_len; |
1224 SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); | 1185 SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); |
1225 | 1186 |
1226 CRYPT_DATA_BLOB ocsp_response_blob; | 1187 CRYPT_DATA_BLOB ocsp_response_blob; |
1227 ocsp_response_blob.cbData = ocsp_response_len; | 1188 ocsp_response_blob.cbData = ocsp_response_len; |
1228 ocsp_response_blob.pbData = const_cast<BYTE*>(ocsp_response_raw); | 1189 ocsp_response_blob.pbData = const_cast<BYTE*>(ocsp_response_raw); |
1229 BOOL ok = CertSetCertificateContextProperty( | 1190 BOOL ok = CertSetCertificateContextProperty( |
1230 server_cert_->os_cert_handle(), | 1191 server_cert_->os_cert_handle(), |
1231 CERT_OCSP_RESPONSE_PROP_ID, | 1192 CERT_OCSP_RESPONSE_PROP_ID, |
(...skipping 424 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1656 bytes_read = result; | 1617 bytes_read = result; |
1657 } | 1618 } |
1658 DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read); | 1619 DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read); |
1659 int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read); | 1620 int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read); |
1660 DCHECK_EQ(1, ret); | 1621 DCHECK_EQ(1, ret); |
1661 transport_recv_busy_ = false; | 1622 transport_recv_busy_ = false; |
1662 return result; | 1623 return result; |
1663 } | 1624 } |
1664 | 1625 |
1665 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { | 1626 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { |
1666 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1667 tracked_objects::ScopedTracker tracking_profile( | |
1668 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1669 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback")); | |
1670 | |
1671 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; | 1627 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; |
1672 DCHECK(ssl == ssl_); | 1628 DCHECK(ssl == ssl_); |
1673 | 1629 |
1674 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); | 1630 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); |
1675 | 1631 |
1676 // Clear any currently configured certificates. | 1632 // Clear any currently configured certificates. |
1677 SSL_certs_clear(ssl_); | 1633 SSL_certs_clear(ssl_); |
1678 | 1634 |
1679 #if defined(OS_IOS) | 1635 #if defined(OS_IOS) |
1680 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). | 1636 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1758 } | 1714 } |
1759 #endif // defined(OS_IOS) | 1715 #endif // defined(OS_IOS) |
1760 | 1716 |
1761 // Send no client certificate. | 1717 // Send no client certificate. |
1762 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1718 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, |
1763 NetLog::IntegerCallback("cert_count", 0)); | 1719 NetLog::IntegerCallback("cert_count", 0)); |
1764 return 1; | 1720 return 1; |
1765 } | 1721 } |
1766 | 1722 |
1767 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { | 1723 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { |
1768 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1769 tracked_objects::ScopedTracker tracking_profile( | |
1770 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1771 "424386 SSLClientSocketOpenSSL::CertVerifyCallback")); | |
1772 | |
1773 if (!completed_connect_) { | 1724 if (!completed_connect_) { |
1774 // If the first handshake hasn't completed then we accept any certificates | 1725 // If the first handshake hasn't completed then we accept any certificates |
1775 // because we verify after the handshake. | 1726 // because we verify after the handshake. |
1776 return 1; | 1727 return 1; |
1777 } | 1728 } |
1778 | 1729 |
1779 // Disallow the server certificate to change in a renegotiation. | 1730 // Disallow the server certificate to change in a renegotiation. |
1780 if (server_cert_chain_->empty()) { | 1731 if (server_cert_chain_->empty()) { |
1781 LOG(ERROR) << "Received invalid certificate chain between handshakes"; | 1732 LOG(ERROR) << "Received invalid certificate chain between handshakes"; |
1782 return 0; | 1733 return 0; |
(...skipping 14 matching lines...) Expand all Loading... |
1797 } | 1748 } |
1798 | 1749 |
1799 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the | 1750 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the |
1800 // server supports NPN, selects a protocol from the list that the server | 1751 // server supports NPN, selects a protocol from the list that the server |
1801 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the | 1752 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the |
1802 // callback can assume that |in| is syntactically valid. | 1753 // callback can assume that |in| is syntactically valid. |
1803 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, | 1754 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, |
1804 unsigned char* outlen, | 1755 unsigned char* outlen, |
1805 const unsigned char* in, | 1756 const unsigned char* in, |
1806 unsigned int inlen) { | 1757 unsigned int inlen) { |
1807 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1808 tracked_objects::ScopedTracker tracking_profile( | |
1809 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1810 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback")); | |
1811 | |
1812 if (ssl_config_.next_protos.empty()) { | 1758 if (ssl_config_.next_protos.empty()) { |
1813 *out = reinterpret_cast<uint8*>( | 1759 *out = reinterpret_cast<uint8*>( |
1814 const_cast<char*>(kDefaultSupportedNPNProtocol)); | 1760 const_cast<char*>(kDefaultSupportedNPNProtocol)); |
1815 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; | 1761 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; |
1816 npn_status_ = kNextProtoUnsupported; | 1762 npn_status_ = kNextProtoUnsupported; |
1817 return SSL_TLSEXT_ERR_OK; | 1763 return SSL_TLSEXT_ERR_OK; |
1818 } | 1764 } |
1819 | 1765 |
1820 // Assume there's no overlap between our protocols and the server's list. | 1766 // Assume there's no overlap between our protocols and the server's list. |
1821 npn_status_ = kNextProtoNoOverlap; | 1767 npn_status_ = kNextProtoNoOverlap; |
(...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1882 } | 1828 } |
1883 return retvalue; | 1829 return retvalue; |
1884 } | 1830 } |
1885 | 1831 |
1886 // static | 1832 // static |
1887 long SSLClientSocketOpenSSL::BIOCallback( | 1833 long SSLClientSocketOpenSSL::BIOCallback( |
1888 BIO *bio, | 1834 BIO *bio, |
1889 int cmd, | 1835 int cmd, |
1890 const char *argp, int argi, long argl, | 1836 const char *argp, int argi, long argl, |
1891 long retvalue) { | 1837 long retvalue) { |
1892 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. | |
1893 tracked_objects::ScopedTracker tracking_profile( | |
1894 FROM_HERE_WITH_EXPLICIT_FUNCTION( | |
1895 "424386 SSLClientSocketOpenSSL::BIOCallback")); | |
1896 | |
1897 SSLClientSocketOpenSSL* socket = reinterpret_cast<SSLClientSocketOpenSSL*>( | 1838 SSLClientSocketOpenSSL* socket = reinterpret_cast<SSLClientSocketOpenSSL*>( |
1898 BIO_get_callback_arg(bio)); | 1839 BIO_get_callback_arg(bio)); |
1899 CHECK(socket); | 1840 CHECK(socket); |
1900 return socket->MaybeReplayTransportError( | 1841 return socket->MaybeReplayTransportError( |
1901 bio, cmd, argp, argi, argl, retvalue); | 1842 bio, cmd, argp, argi, argl, retvalue); |
1902 } | 1843 } |
1903 | 1844 |
1904 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const { | 1845 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const { |
1905 for (ct::SCTList::const_iterator iter = | 1846 for (ct::SCTList::const_iterator iter = |
1906 ct_verify_result_.verified_scts.begin(); | 1847 ct_verify_result_.verified_scts.begin(); |
(...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1954 | 1895 |
1955 return result; | 1896 return result; |
1956 } | 1897 } |
1957 | 1898 |
1958 scoped_refptr<X509Certificate> | 1899 scoped_refptr<X509Certificate> |
1959 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1900 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
1960 return server_cert_; | 1901 return server_cert_; |
1961 } | 1902 } |
1962 | 1903 |
1963 } // namespace net | 1904 } // namespace net |
OLD | NEW |