Enable client certificates in SecureSocket and SecureServerSocket

sdk/lib/io/secure_socket.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * SecureSocket provides a secure (SSL or TLS) client connection to a server.
  * The certificate provided by the server is checked
  * using the certificate database provided in setCertificateDatabase.
  */
 abstract class SecureSocket implements Socket {
   /**
    * Constructs a new secure client socket and connect it to the given
    * host on the given port. The returned socket is not yet connected
-   * but ready for registration of callbacks.
+   * but ready for registration of callbacks.  If sendClientCertificate is
+   * set to true, the socket will send a client certificate if one is
+   * requested by the server.  If clientCertificate is the nickname of
+   * a certificate in the certificate database, that certificate will be sent.
+   * If clientCertificate is null, which is the usual use case, an
+   * appropriate certificate will be searched for in the database and
+   * sent automatically, based on what the server says it will accept.
    */
-  factory SecureSocket(String host, int port) => new _SecureSocket(host, port);
+  factory SecureSocket(String host,
+                       int port,
+                       {bool sendClientCertificate: false,
+                        String certificateName}) {
+    return new _SecureSocket(host,
+                             port,
+                             certificateName,
+                             is_server: false,
+                             sendClientCertificate: sendClientCertificate);
+  }
 
   /**
    * Install a handler for unverifiable certificates.  The handler can inspect
    * the certificate, and decide (or let the user decide) whether to accept
    * the connection or not.  The callback should return true
    * to continue the SecureSocket connection.
    */
   void set onBadCertificate(bool callback(X509Certificate certificate));
 
+  /**
+   * Get the peerCertificate for a connected secure socket.  For a server
+   * socket, this will return the client certificate, or null, if no
+   * client certificate was received.  For a client socket, this
+   * will return the server's certificate.
+   */
+  X509Certificate get peerCertificate;
+
    /**
    * Initializes the NSS library with the path to a certificate database
    * containing root certificates for verifying certificate paths on
    * client connections, and server certificates to provide on server
    * connections.  The password argument should be used when creating
    * secure server sockets, to allow the private key of the server
    * certificate to be fetched.  If useBuiltinRoots is true (the default),
    * then a built-in set of root certificates for trusted certificate
    * authorities is merged with the certificates in the database.
    *
@@ skipping 46 matching lines @@
   static final int CLOSED = 203;
 
   // Buffer identifiers.
   // These must agree with those in the native C++ implementation.
   static final int READ_PLAINTEXT = 0;
   static final int WRITE_PLAINTEXT = 1;
   static final int READ_ENCRYPTED = 2;
   static final int WRITE_ENCRYPTED = 3;
   static final int NUM_BUFFERS = 4;
 
-  int _count = 0;
-  // Constructs a new secure client socket.
-  factory _SecureSocket(String host, int port) =>
-      new _SecureSocket.internal(host, port, false);
-
-  // Constructs a new secure server socket, with the named server certificate.
-  factory _SecureSocket.server(String host,
-                            int port,
-                            Socket socket,
-                            String certificateName) =>
-      new _SecureSocket.internal(host, port, true, socket, certificateName);
-
-  _SecureSocket.internal(String host,
-                      int port,
-                      bool is_server,
-                      [Socket socket,
-                       String certificateName])
-      : _host = host,
-        _port = port,
-        _socket = socket,
-        _certificateName = certificateName,
-        _is_server = is_server,
-        _secureFilter = new _SecureFilter() {
-    if (_socket == null) {
-      _socket = new Socket(host, port);
+  _SecureSocket(String this.host,
+                int requestedPort,
+                String this.certificateName,
+                {bool this.is_server,
+                 Socket this.socket,
+                 bool this.requestClientCertificate: false,
+                 bool this.requireClientCertificate: false,
+                 bool this.sendClientCertificate: false})
+      : secureFilter = new _SecureFilter() {
+    // Throw an ArgumentError if any field is invalid.
+    _verifyFields();
+    if (socket == null) {
+      socket = new Socket(host, requestedPort);
     }
-    _socket.onConnect = _secureConnectHandler;
-    _socket.onData = _secureDataHandler;
-    _socket.onClosed = _secureCloseHandler;
-    _socket.onError = _secureErrorHandler;
-    _secureFilter.init();
-    _secureFilter.registerHandshakeCompleteCallback(_secureHandshakeCompleteHandler);
+    socket.onConnect = _secureConnectHandler;
+    socket.onData = _secureDataHandler;
+    socket.onClosed = _secureCloseHandler;
+    socket.onError = _secureErrorHandler;
+    secureFilter.init();
+    secureFilter.registerHandshakeCompleteCallback(
+        _secureHandshakeCompleteHandler);
   }
 
-  int get port => _socket.port;
+  void _verifyFields() {
+    if (host is! String) throw new ArgumentError(
+        "SecureSocket constructor: host is not a String");
+    assert(is_server is bool);
+    assert(socket == null || socket is Socket);
+    if (certificateName != null && certificateName is! String) {
+      throw new ArgumentError(
+          "SecureSocket constructor: certificateName is not null or a String");
+    }
+    if (certificateName == null && is_server) {
+      throw new ArgumentError(
+          "SecureSocket constructor: certificateName is null on a server");
+    }
+    if (requestClientCertificate is! bool) throw new ArgumentError(

[Mads Ager (google), 2012/12/11 07:45:27]

Please use curly braces when using multiple lines for an if statement:

if (requestClientCertificate is! bool) {
  throw new ArgumentError(
      "SecureSocket constructor: ...");
}

Please update all three of these.

[Bill Hesse, 2012/12/11 09:20:54]

Done.

+        "SecureSocket constructor: requestClientCertificate is not a bool");
+    if (requireClientCertificate is! bool) throw new ArgumentError(
+        "SecureSocket constructor: requireClientCertificate is not a bool");
+    if (sendClientCertificate is! bool) throw new ArgumentError(
+        "SecureSocket constructor: sendClientCertificate is not a bool");
+  }
 
-  String get remoteHost => _socket.remoteHost;
+  int get port => socket.port;
 
-  int get remotePort => _socket.remotePort;
+  String get remoteHost => socket.remoteHost;
+
+  int get remotePort => socket.remotePort;
 
   void set onClosed(void callback()) {
     if (_inputStream != null && callback != null) {
       throw new StreamException(
            "Cannot set close handler when input stream is used");
     }
     _onClosed = callback;
   }
 
   void set _onClosed(void callback()) {
@@ skipping 32 matching lines @@
     if (_outputStream != null && callback != null) {
       throw new StreamException(
           "Cannot set write handler when output stream is used");
     }
     _onWrite = callback;
   }
 
   void set _onWrite(void callback()) {
     _socketWriteHandler = callback;
     // Reset the one-shot onWrite handler.
-    _socket.onWrite = _secureWriteHandler;
+    socket.onWrite = _secureWriteHandler;
   }
 
   void set onBadCertificate(bool callback(X509Certificate certificate)) {
     if (callback is! Function && callback != null) {
       throw new SocketIOException(
           "Callback provided to onBadCertificate is not a function or null");
     }
-    _secureFilter.registerBadCertificateCallback(callback);
+    secureFilter.registerBadCertificateCallback(callback);
   }
 
   InputStream get inputStream {
     if (_inputStream == null) {
       if (_socketDataHandler != null || _socketCloseHandler != null) {
         throw new StreamException(
             "Cannot get input stream when socket handlers are used");
       }
       _inputStream = new _SocketInputStream(this);
     }
@@ skipping 14 matching lines @@
   int available() {
     throw new UnimplementedError("SecureSocket.available not implemented yet");
   }
 
   void close([bool halfClose = false]) {
     if (_status == CLOSED) return;
     if (halfClose) {
       _closedWrite = true;
       _writeEncryptedData();
       if (_filterWriteEmpty) {
-        _socket.close(true);
+        socket.close(true);
         _socketClosedWrite = true;
         if (_closedRead) {
           close(false);
         }
       }
     } else {
       _closedWrite = true;
       _closedRead = true;
-      _socket.close(false);
+      socket.close(false);
       _socketClosedWrite = true;
       _socketClosedRead = true;
-      _secureFilter.destroy();
-      _secureFilter = null;
+      secureFilter.destroy();
+      secureFilter = null;
       if (scheduledDataEvent != null) {
         scheduledDataEvent.cancel();
       }
       _status = CLOSED;
     }
   }
 
   void _closeWrite() => close(true);
 
   List<int> read([int len]) {
     if (_closedRead) {
       throw new SocketIOException("Reading from a closed socket");
     }
     if (_status != CONNECTED) {
       return new List<int>(0);
     }
-    var buffer = _secureFilter.buffers[READ_PLAINTEXT];
+    var buffer = secureFilter.buffers[READ_PLAINTEXT];
     _readEncryptedData();
     int toRead = buffer.length;
     if (len != null) {
       if (len is! int || len < 0) {
         throw new ArgumentError(
             "Invalid len parameter in SecureSocket.read (len: $len)");
       }
       if (len < toRead) {
         toRead = len;
       }
@@ skipping 10 matching lines @@
     }
     if (offset < 0 || bytes < 0 || offset + bytes > data.length) {
       throw new ArgumentError(
           "Invalid offset or bytes in SecureSocket.readList");
     }
     if (_status != CONNECTED && _status != CLOSED) {
       return 0;
     }
 
     int bytesRead = 0;
-    var buffer = _secureFilter.buffers[READ_PLAINTEXT];
+    var buffer = secureFilter.buffers[READ_PLAINTEXT];
     // TODO(whesse): Currently this fails if the if is turned into a while loop.
     // Fix it so that it can loop and read more than one buffer's worth of data.
     if (bytes > bytesRead) {
       _readEncryptedData();
       if (buffer.length > 0) {
         int toRead = min(bytes - bytesRead, buffer.length);
         data.setRange(offset, toRead, buffer.data, buffer.start);
         buffer.advanceStart(toRead);
         bytesRead += toRead;
         offset += toRead;
       }
     }
 
     _setHandlersAfterRead();
     return bytesRead;
   }
 
   // Write the data to the socket, and flush it as much as possible
   // until it would block.  If the write would block, _writeEncryptedData sets
   // up handlers to flush the pipeline when possible.
   int writeList(List<int> data, int offset, int bytes) {
     if (_closedWrite) {
       throw new SocketIOException("Writing to a closed socket");
     }
     if (_status != CONNECTED) return 0;
-    var buffer = _secureFilter.buffers[WRITE_PLAINTEXT];
+    var buffer = secureFilter.buffers[WRITE_PLAINTEXT];
     if (bytes > buffer.free) {
       bytes = buffer.free;
     }
     if (bytes > 0) {
       buffer.data.setRange(buffer.start + buffer.length, bytes, data, offset);
       buffer.length += bytes;
     }
     _writeEncryptedData();  // Tries to flush all pipeline stages.
     return bytes;
   }
 
+  X509Certificate get peerCertificate => secureFilter.peerCertificate;
+
   void _secureConnectHandler() {
     _connectPending = true;
-    _secureFilter.connect(_host, _port, _is_server, _certificateName);
+    secureFilter.connect(host,
+                         port,
+                         is_server,
+                         certificateName,
+                         requestClientCertificate || requireClientCertificate,
+                         requireClientCertificate,
+                         sendClientCertificate);
     _status = HANDSHAKE;
     _secureHandshake();
   }
 
   void _secureWriteHandler() {
     _writeEncryptedData();
     if (_filterWriteEmpty && _closedWrite && !_socketClosedWrite) {
       close(true);
     }
     if (_status == HANDSHAKE) {
       _secureHandshake();
     } else if (_status == CONNECTED &&
                _socketWriteHandler != null &&
-               _secureFilter.buffers[WRITE_PLAINTEXT].free > 0) {
+               secureFilter.buffers[WRITE_PLAINTEXT].free > 0) {
       // We must be able to set onWrite from the onWrite callback.
       var handler = _socketWriteHandler;
       // Reset the one-shot handler.
       _socketWriteHandler = null;
       handler();
     }
   }
 
   void _secureDataHandler() {
     if (_status == HANDSHAKE) {
@@ skipping 61 matching lines @@
         _socketCloseHandler();
       }
       if (_socketClosedWrite) {
         close(false);
       }
     }
   }
 
   void _secureHandshake() {
     _readEncryptedData();
-    _secureFilter.handshake();
+    secureFilter.handshake();
     _writeEncryptedData();
-    if (_secureFilter.buffers[WRITE_ENCRYPTED].length > 0) {
-      _socket.onWrite = _secureWriteHandler;
+    if (secureFilter.buffers[WRITE_ENCRYPTED].length > 0) {
+      socket.onWrite = _secureWriteHandler;
     }
   }
 
   void _secureHandshakeCompleteHandler() {
     _status = CONNECTED;
     if (_connectPending && _socketConnectHandler != null) {
       _connectPending = false;
       _socketConnectHandler();
     }
     if (_socketWriteHandler != null) {
-      _socket.onWrite = _secureWriteHandler;
+      socket.onWrite = _secureWriteHandler;
     }
   }
 
   // True if the underlying socket is closed, the filter has been emptied of
   // all data, and the close event has been fired.
   get _closed => _socketClosed;
 
   void _readEncryptedData() {
     // Read from the socket, and push it through the filter as far as
     // possible.
-    var encrypted = _secureFilter.buffers[READ_ENCRYPTED];
-    var plaintext = _secureFilter.buffers[READ_PLAINTEXT];
+    var encrypted = secureFilter.buffers[READ_ENCRYPTED];
+    var plaintext = secureFilter.buffers[READ_PLAINTEXT];
     bool progress = true;
     while (progress) {
       progress = false;
       // Do not try to read plaintext from the filter while handshaking.
       if ((_status == CONNECTED) && plaintext.free > 0) {
-        int bytes = _secureFilter.processBuffer(READ_PLAINTEXT);
+        int bytes = secureFilter.processBuffer(READ_PLAINTEXT);
         if (bytes > 0) {
           plaintext.length += bytes;
           progress = true;
         }
       }
       if (encrypted.length > 0) {
-        int bytes = _secureFilter.processBuffer(READ_ENCRYPTED);
+        int bytes = secureFilter.processBuffer(READ_ENCRYPTED);
         if (bytes > 0) {
           encrypted.advanceStart(bytes);
           progress = true;
         }
       }
       if (!_socketClosedRead) {
-        int bytes = _socket.readList(encrypted.data,
-                                     encrypted.start + encrypted.length,
-                                     encrypted.free);
+        int bytes = socket.readList(encrypted.data,
+                                    encrypted.start + encrypted.length,
+                                    encrypted.free);
         if (bytes > 0) {
           encrypted.length += bytes;
           progress = true;
         }
       }
     }
     // If there is any data in any stages of the filter, there should
     // be data in the plaintext buffer after this process.
     // TODO(whesse): Verify that this is true, and there can be no
     // partial encrypted block stuck in the secureFilter.
     _filterReadEmpty = (plaintext.length == 0);
   }
 
   void _writeEncryptedData() {
     if (_socketClosedWrite) return;
-    var encrypted = _secureFilter.buffers[WRITE_ENCRYPTED];
-    var plaintext = _secureFilter.buffers[WRITE_PLAINTEXT];
+    var encrypted = secureFilter.buffers[WRITE_ENCRYPTED];
+    var plaintext = secureFilter.buffers[WRITE_PLAINTEXT];
     while (true) {
       if (encrypted.length > 0) {
         // Write from the filter to the socket.
-        int bytes = _socket.writeList(encrypted.data,
-                                      encrypted.start,
-                                      encrypted.length);
+        int bytes = socket.writeList(encrypted.data,
+                                     encrypted.start,
+                                     encrypted.length);
         if (bytes == 0) {
           // The socket has blocked while we have data to write.
           // We must be notified when it becomes unblocked.
-          _socket.onWrite = _secureWriteHandler;
+          socket.onWrite = _secureWriteHandler;
           _filterWriteEmpty = false;
           break;
         }
         encrypted.advanceStart(bytes);
       } else {
-        var plaintext = _secureFilter.buffers[WRITE_PLAINTEXT];
+        var plaintext = secureFilter.buffers[WRITE_PLAINTEXT];
         if (plaintext.length > 0) {
-           int plaintext_bytes = _secureFilter.processBuffer(WRITE_PLAINTEXT);
+           int plaintext_bytes = secureFilter.processBuffer(WRITE_PLAINTEXT);
            plaintext.advanceStart(plaintext_bytes);
         }
-        int bytes = _secureFilter.processBuffer(WRITE_ENCRYPTED);
+        int bytes = secureFilter.processBuffer(WRITE_ENCRYPTED);
         if (bytes <= 0) {
           // We know the WRITE_ENCRYPTED buffer is empty, and the
           // filter wrote zero bytes to it, so the filter must be empty.
           // Also, the WRITE_PLAINTEXT buffer must have been empty, or
           // it would have written to the filter.
           // TODO(whesse): Verify that the filter works this way.
           _filterWriteEmpty = true;
           break;
         }
         encrypted.length += bytes;
@@ skipping 30 matching lines @@
         // This can't be an else clause: the value of _filterReadEmpty changes.
         // This must be asynchronous, because we are in a read or readList call.
         new Timer(0, (_) => _secureCloseHandler());
       }
     }
   }
 
   bool get _socketClosed => _closedRead;
 
   // _SecureSocket cannot extend _Socket and use _Socket's factory constructor.
-  Socket _socket;
-  String _host;
-  int _port;
-  bool _is_server;
-  String _certificateName;
+  Socket socket;
+  final String host;
+  final bool is_server;
+  final String certificateName;
+  final bool requestClientCertificate;
+  final bool requireClientCertificate;
+  final bool sendClientCertificate;
 
   var _status = NOT_CONNECTED;
   bool _socketClosedRead = false;  // The network socket is closed for reading.
   bool _socketClosedWrite = false;  // The network socket is closed for writing.
   bool _closedRead = false;  // The secure socket has fired an onClosed event.
   bool _closedWrite = false;  // The secure socket has been closed for writing.
   bool _filterReadEmpty = true;  // There is no buffered data to read.
   bool _filterWriteEmpty = true;  // There is no buffered data to be written.
   _SocketInputStream _inputStream;
   _SocketOutputStream _outputStream;
   bool _connectPending = false;
   Function _socketConnectHandler;
   Function _socketWriteHandler;
   Function _socketDataHandler;
   Function _socketErrorHandler;
   Function _socketCloseHandler;
   Timer scheduledDataEvent;
 
-  _SecureFilter _secureFilter;
+  _SecureFilter secureFilter;
 }
 
 
 class _ExternalBuffer {
   static final int SIZE = 8 * 1024;
   _ExternalBuffer() : start = 0, length = 0;
 
   // TODO(whesse): Consider making this a circular buffer.  Only if it helps.
   void advanceStart(int numBytes) {
     start += numBytes;
@@ skipping 10 matching lines @@
   int length;
 }
 
 
 abstract class _SecureFilter {
   external factory _SecureFilter();
 
   void connect(String hostName,
                int port,
                bool is_server,
-               String certificateName);
+               String certificateName,
+               bool requestClientCertificate,
+               bool requireClientCertificate,
+               bool sendClientCertificate);
   void destroy();
   void handshake();
   void init();
+  X509Certificate get peerCertificate;
   int processBuffer(int bufferIndex);
   void registerBadCertificateCallback(Function callback);
   void registerHandshakeCompleteCallback(Function handshakeCompleteHandler);
 
   List<_ExternalBuffer> get buffers;
 }