Enable client certificates in SecureSocket and SecureServerSocket

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 55 matching lines @@
   SetFilter(args, filter);
   filter->Init(dart_this);
   Dart_ExitScope();
 }
 
 
 void FUNCTION_NAME(SecureSocket_Connect)(Dart_NativeArguments args) {
   Dart_EnterScope();
   Dart_Handle host_name_object = ThrowIfError(Dart_GetNativeArgument(args, 1));
   Dart_Handle port_object = ThrowIfError(Dart_GetNativeArgument(args, 2));
-  Dart_Handle is_server_object = ThrowIfError(Dart_GetNativeArgument(args, 3));
+  bool is_server = DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 3));
   Dart_Handle certificate_name_object =
       ThrowIfError(Dart_GetNativeArgument(args, 4));
+  bool request_client_certificate =
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 5));
+  bool require_client_certificate =
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 6));
+  bool send_client_certificate =
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 7));
 
   const char* host_name = NULL;
   // TODO(whesse): Is truncating a Dart string containing \0 what we want?
   ThrowIfError(Dart_StringToCString(host_name_object, &host_name));
 
   int64_t port;
-  if (!DartUtils::GetInt64Value(port_object, &port) ||
-      port < 0 || port > 65535) {
-    Dart_ThrowException(DartUtils::NewDartArgumentError(
-      "Illegal port parameter in _SSLFilter.connect"));
+  if (!DartUtils::GetInt64Value(port_object, &port)) {
+    FATAL("The range of port_object was checked in Dart - it cannot fail here");
   }
 
-  if (!Dart_IsBoolean(is_server_object)) {
-    Dart_ThrowException(DartUtils::NewDartArgumentError(
-      "Illegal is_server parameter in _SSLFilter.connect"));
-  }
-  bool is_server = DartUtils::GetBooleanValue(is_server_object);
-
   const char* certificate_name = NULL;
-  // If this is a server connection, get the certificate to connect with.
-  // TODO(whesse): Use this parameter for a client certificate as well.
-  if (is_server) {
-    if (!Dart_IsString(certificate_name_object)) {
-      Dart_ThrowException(DartUtils::NewDartArgumentError(
-          "Non-String certificate parameter in _SSLFilter.connect"));
-    }
+  if (Dart_IsString(certificate_name_object)) {
     ThrowIfError(Dart_StringToCString(certificate_name_object,
                                       &certificate_name));
   }
+  // If this is a server connection, it must have a certificate to connect with.
+  ASSERT(!is_server || certificate_name != NULL);
 
   GetFilter(args)->Connect(host_name,
-                              static_cast<int>(port),
-                              is_server,
-                              certificate_name);
+                           static_cast<int>(port),
+                           is_server,
+                           certificate_name,
+                           request_client_certificate,
+                           require_client_certificate,
+                           send_client_certificate);
   Dart_ExitScope();
 }
 
 
 void FUNCTION_NAME(SecureSocket_Destroy)(Dart_NativeArguments args) {
   Dart_EnterScope();
   SSLFilter* filter = GetFilter(args);
   SetFilter(args, NULL);
   filter->Destroy();
   delete filter;
@@ skipping 91 matching lines @@
   } else {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "UseBuiltinRoots argument to SetCertificateDatabase is not a bool"));
   }
 
   SSLFilter::InitializeLibrary(certificate_database, password, builtin_roots);
   Dart_ExitScope();
 }
 
 
-static bool CallBadCertificateCallback(Dart_Handle callback,
-                                       const char* subject_name,
-                                       const char* issuer_name,
-                                       int64_t start_validity,
-                                       int64_t end_validity) {
-  if (callback == NULL || Dart_IsNull(callback)) return false;
+void FUNCTION_NAME(SecureSocket_PeerCertificate)
+    (Dart_NativeArguments args) {
   Dart_EnterScope();
-  Dart_Handle subject_name_object = DartUtils::NewString(subject_name);
-  Dart_Handle issuer_name_object = DartUtils::NewString(issuer_name);
-  Dart_Handle start_validity_int = Dart_NewInteger(start_validity);
-  Dart_Handle end_validity_int = Dart_NewInteger(end_validity);
+  Dart_SetReturnValue(args, GetFilter(args)->PeerCertificate());
+  Dart_ExitScope();
+}
+
+
+static Dart_Handle X509FromCertificate(CERTCertificate* certificate) {
+  PRTime start_validity;
+  PRTime end_validity;
+  SECStatus status =
+      CERT_GetCertTimes(certificate, &start_validity, &end_validity);
+  if (status != SECSuccess) {
+    ThrowPRException("Cannot get validity times from certificate");
+  }
+  int64_t start_epoch_ms = start_validity / PR_USEC_PER_MSEC;
+  int64_t end_epoch_ms = end_validity / PR_USEC_PER_MSEC;
+  Dart_Handle subject_name_object =
+      DartUtils::NewString(certificate->subjectName);
+  Dart_Handle issuer_name_object =
+      DartUtils::NewString(certificate->issuerName);
+  Dart_Handle start_epoch_ms_int = Dart_NewInteger(start_epoch_ms);
+  Dart_Handle end_epoch_ms_int = Dart_NewInteger(end_epoch_ms);
 
   Dart_Handle date_class =
       DartUtils::GetDartClass(DartUtils::kCoreLibURL, "Date");
   Dart_Handle from_milliseconds =
       DartUtils::NewString("fromMillisecondsSinceEpoch");
 
   Dart_Handle start_validity_date =
-      Dart_New(date_class, from_milliseconds, 1, &start_validity_int);
+      Dart_New(date_class, from_milliseconds, 1, &start_epoch_ms_int);
   Dart_Handle end_validity_date =
-      Dart_New(date_class, from_milliseconds, 1, &end_validity_int);
+      Dart_New(date_class, from_milliseconds, 1, &end_epoch_ms_int);
 
   Dart_Handle x509_class =
       DartUtils::GetDartClass(DartUtils::kIOLibURL, "X509Certificate");
   Dart_Handle arguments[] = { subject_name_object,
                               issuer_name_object,
                               start_validity_date,
                               end_validity_date };
-  Dart_Handle certificate = Dart_New(x509_class, Dart_Null(), 4, arguments);
-
-  Dart_Handle result =
-      ThrowIfError(Dart_InvokeClosure(callback, 1, &certificate));
-  bool c_result = Dart_IsBoolean(result) && DartUtils::GetBooleanValue(result);
-  Dart_ExitScope();
-  return c_result;
+  return Dart_New(x509_class, Dart_Null(), 4, arguments);
 }
 
 
 void SSLFilter::Init(Dart_Handle dart_this) {
   string_start_ = ThrowIfError(
       Dart_NewPersistentHandle(DartUtils::NewString("start")));
   string_length_ = ThrowIfError(
       Dart_NewPersistentHandle(DartUtils::NewString("length")));
 
   InitializeBuffers(dart_this);
@@ skipping 65 matching lines @@
     }
     if (!use_builtin_root_certificates) {
       init_flags |= NSS_INIT_NOMODDB;
     }
     SECStatus status = NSS_Initialize(certificate_database,
                                       "",
                                       "",
                                       SECMOD_DB,
                                       init_flags);
     if (status != SECSuccess) {
-      ThrowPRException("Unsuccessful NSS_Init call.");
+      ThrowPRException("Failed NSS_Init call.");
     }
 
     status = NSS_SetDomesticPolicy();
     if (status != SECSuccess) {
-      ThrowPRException("Unsuccessful NSS_SetDomesticPolicy call.");
+      ThrowPRException("Failed NSS_SetDomesticPolicy call.");
     }
     // Enable TLS, as well as SSL3 and SSL2.
     status = SSL_OptionSetDefault(SSL_ENABLE_TLS, PR_TRUE);
     if (status != SECSuccess) {
-      ThrowPRException("Unsuccessful SSL_OptionSetDefault enable TLS call.");
+      ThrowPRException("Failed SSL_OptionSetDefault enable TLS call.");
     }
     status = SSL_ConfigServerSessionIDCache(0, 0, 0, NULL);
     if (status != SECSuccess) {
-      ThrowPRException("Unsuccessful SSL_ConfigServerSessionIDCache call.");
+      ThrowPRException("Failed SSL_ConfigServerSessionIDCache call.");
     }
 
   } else {
     ThrowException("Called SSLFilter::InitializeLibrary more than once");
   }
 }
 
 
 char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
   if (!retry) {
     return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.
   }
   return NULL;
 }
 
 
 SECStatus BadCertificateCallback(void* filter, PRFileDesc* fd) {
-  return static_cast<SSLFilter*>(filter)->HandleBadCertificate(fd);
+  SSLFilter* ssl_filter = static_cast<SSLFilter*>(filter);
+  Dart_Handle callback = ssl_filter->bad_certificate_callback();
+  if (callback == NULL || Dart_IsNull(callback)) return SECFailure;
+
+  Dart_EnterScope();
+  Dart_Handle x509_object = ssl_filter->PeerCertificate();
+  Dart_Handle result =
+      ThrowIfError(Dart_InvokeClosure(callback, 1, &x509_object));
+  bool c_result = Dart_IsBoolean(result) && DartUtils::GetBooleanValue(result);
+  Dart_ExitScope();
+  return c_result ? SECSuccess : SECFailure;
 }
 
 
-SECStatus SSLFilter::HandleBadCertificate(PRFileDesc* fd) {
-  ASSERT(fd == filter_);
-  CERTCertificate* certificate = SSL_PeerCertificate(fd);
-  PRTime start_validity;
-  PRTime end_validity;
-  SECStatus status =
-      CERT_GetCertTimes(certificate, &start_validity, &end_validity);
-  if (status != SECSuccess) {
-    ThrowPRException("Cannot get validity times from certificate");
-  }
-  int64_t start_epoch_ms = start_validity / PR_USEC_PER_MSEC;
-  int64_t end_epoch_ms = end_validity / PR_USEC_PER_MSEC;
-  bool accept = CallBadCertificateCallback(bad_certificate_callback_,
-                                           certificate->subjectName,
-                                           certificate->issuerName,
-                                           start_epoch_ms,
-                                           end_epoch_ms);
+Dart_Handle SSLFilter::PeerCertificate() {
+  CERTCertificate* certificate = SSL_PeerCertificate(filter_);
+  if (certificate == NULL) return Dart_Null();
+  Dart_Handle x509_object = X509FromCertificate(certificate);
   CERT_DestroyCertificate(certificate);
-  return accept ? SECSuccess : SECFailure;
+  return x509_object;
 }
 
 
 void SSLFilter::Connect(const char* host_name,
                         int port,
                         bool is_server,
-                        const char* certificate_name) {
+                        const char* certificate_name,
+                        bool request_client_certificate,
+                        bool require_client_certificate,
+                        bool send_client_certificate) {
   is_server_ = is_server;
   if (in_handshake_) {
     ThrowException("Connect called while already in handshake state.");
   }
 
   filter_ = SSL_ImportFD(NULL, filter_);
   if (filter_ == NULL) {
-    ThrowPRException("Unsuccessful SSL_ImportFD call");
+    ThrowPRException("Failed SSL_ImportFD call");
   }
 
   SECStatus status;
   if (is_server) {
     PK11_SetPasswordFunc(PasswordCallback);
     CERTCertDBHandle* certificate_database = CERT_GetDefaultCertDB();
     if (certificate_database == NULL) {
       ThrowPRException("Certificate database cannot be loaded");
     }
+    // TODO(whesse): Switch to a function that looks up certs by nickname,
+    // so that server and client uses of certificateName agree.
     CERTCertificate* certificate = CERT_FindCertByNameString(
         certificate_database,
         const_cast<char*>(certificate_name));
     if (certificate == NULL) {
       ThrowPRException("Cannot find server certificate by name");
     }
     SECKEYPrivateKey* key = PK11_FindKeyByAnyCert(
         certificate,
         static_cast<void*>(const_cast<char*>(password_)));
     if (key == NULL) {
       CERT_DestroyCertificate(certificate);
       if (PR_GetError() == -8177) {
         ThrowPRException("Certificate database password incorrect");
       } else {
-        ThrowPRException("Unsuccessful PK11_FindKeyByAnyCert call."
+        ThrowPRException("Failed PK11_FindKeyByAnyCert call."
                          " Cannot find private key for certificate");
       }
     }
     // kt_rsa (key type RSA) is an enum constant from the NSS libraries.
     // TODO(whesse): Allow different key types.
     status = SSL_ConfigSecureServer(filter_, certificate, key, kt_rsa);
     CERT_DestroyCertificate(certificate);
     SECKEY_DestroyPrivateKey(key);
     if (status != SECSuccess) {
-      ThrowPRException("Unsuccessful SSL_ConfigSecureServer call");
+      ThrowPRException("Failed SSL_ConfigSecureServer call");
+    }
+
+    if (request_client_certificate) {
+      status = SSL_OptionSet(filter_, SSL_REQUEST_CERTIFICATE, PR_TRUE);
+      if (status != SECSuccess) {
+        ThrowPRException("Failed SSL_OptionSet(REQUEST_CERTIFICATE) call");
+      }
+      PRBool require_cert = require_client_certificate ? PR_TRUE : PR_FALSE;
+      status = SSL_OptionSet(filter_, SSL_REQUIRE_CERTIFICATE, require_cert);
+      if (status != SECSuccess) {
+        ThrowPRException("Failed SSL_OptionSet(REQUIRE_CERTIFICATE) call");
+      }
     }
   } else {  // Client.
     if (SSL_SetURL(filter_, host_name) == -1) {
-      ThrowPRException("Unsuccessful SetURL call");
+      ThrowPRException("Failed SetURL call");
     }
 
     // This disables the SSL session cache for client connections.
     // This resolves issue 7208, but degrades performance.
     // TODO(7230): Reenable session cache, without breaking client connections.
     status = SSL_OptionSet(filter_, SSL_NO_CACHE, PR_TRUE);
     if (status != SECSuccess) {
       ThrowPRException("Failed SSL_OptionSet(NO_CACHE) call");
     }
+
+    if (send_client_certificate) {
+      status = SSL_GetClientAuthDataHook(
+          filter_,
+          NSS_GetClientAuthData,
+          static_cast<void*>(const_cast<char*>(certificate_name)));
+      if (status != SECSuccess) {
+        ThrowPRException("Failed SSL_GetClientAuthDataHook call");
+      }
+    }
   }
 
   // Install bad certificate callback, and pass 'this' to it if it is called.
   status = SSL_BadCertHook(filter_,
                            BadCertificateCallback,
                            static_cast<void*>(this));
 
   PRBool as_server = is_server ? PR_TRUE : PR_FALSE;
   status = SSL_ResetHandshake(filter_, as_server);
   if (status != SECSuccess) {
-    ThrowPRException("Unsuccessful SSL_ResetHandshake call");
+    ThrowPRException("Failed SSL_ResetHandshake call");
   }
 
   // SetPeerAddress
   PRNetAddr host_address;
   char host_entry_buffer[PR_NETDB_BUF_SIZE];
   PRHostEnt host_entry;
   PRStatus rv = PR_GetHostByName(host_name, host_entry_buffer,
                                  PR_NETDB_BUF_SIZE, &host_entry);
   if (rv != PR_SUCCESS) {
-    ThrowPRException("Unsuccessful PR_GetHostByName call");
+    ThrowPRException("Failed PR_GetHostByName call");
   }
 
   int index = PR_EnumerateHostEnt(0, &host_entry, port, &host_address);
   if (index == -1 || index == 0) {
-    ThrowPRException("Unsuccessful PR_EnumerateHostEnt call");
+    ThrowPRException("Failed PR_EnumerateHostEnt call");
   }
   memio_SetPeerName(filter_, &host_address);
 }
 
 
 void SSLFilter::Handshake() {
   SECStatus status = SSL_ForceHandshake(filter_);
   if (status == SECSuccess) {
     if (in_handshake_) {
       ThrowIfError(Dart_InvokeClosure(handshake_complete_, 0, NULL));
@@ skipping 123 matching lines @@
         if (PR_WOULD_BLOCK_ERROR != pr_error) {
           ThrowPRException("Error reading plaintext from SSLFilter");
         }
         bytes_processed = 0;
       }
       break;
     }
   }
   return bytes_processed;
 }