Implement the backend of SSL client authentication for...

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/string_util.h"
@@ skipping 175 matching lines @@
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
 
 int HttpNetworkTransaction::RestartWithCertificate(
     X509Certificate* client_cert,
     CompletionCallback* callback) {
   ssl_config_.client_cert = client_cert;
+  if (client_cert) {
+    session_->ssl_client_auth_cache()->Add(GetHostAndPort(request_->url),
+                                           client_cert);
+  }
   ssl_config_.send_client_cert = true;
   next_state_ = STATE_INIT_CONNECTION;
   // Reset the other member variables.
   // Note: this is necessary only with SSL renegotiation.
   ResetStateForRestart();
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
@@ skipping 421 matching lines @@
   return connection_.socket()->Connect(&io_callback_);
 }
 
 int HttpNetworkTransaction::DoSSLConnectComplete(int result) {
   if (IsCertificateError(result))
     result = HandleCertificateError(result);
 
   if (result == OK) {
     next_state_ = STATE_WRITE_HEADERS;
   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
-    HandleCertificateRequest();
+    result = HandleCertificateRequest(result);
   } else {
     result = HandleSSLHandshakeError(result);
   }
   return result;
 }
 
 int HttpNetworkTransaction::DoWriteHeaders() {
   next_state_ = STATE_WRITE_HEADERS_COMPLETE;
 
   // This is constructed lazily (instead of within our Start method), so that
@@ skipping 134 matching lines @@
   // due to SSL renegotiation.
   if (using_ssl_) {
     if (IsCertificateError(result)) {
       // We don't handle a certificate error during SSL renegotiation, so we
       // have to return an error that's not in the certificate error range
       // (-2xx).
       LOG(ERROR) << "Got a server certificate with error " << result
                  << " during SSL renegotiation";
       result = ERR_CERT_ERROR_IN_SSL_RENEGOTIATION;
     } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
-      HandleCertificateRequest();
+      result = HandleCertificateRequest(result);
+      if (result == OK)
+        return result;
     }
   }
 
   if (result < 0)
     return HandleIOError(result);
 
   if (result == 0 && ShouldResendRequest()) {
     ResetConnectionAndRequestForResend();
     return result;
   }
@@ skipping 445 matching lines @@
 
     // Add the bad certificate to the set of allowed certificates in the
     // SSL info object. This data structure will be consulted after calling
     // RestartIgnoringLastError(). And the user will be asked interactively
     // before RestartIgnoringLastError() is ever called.
     ssl_config_.allowed_bad_certs_.insert(response_.ssl_info.cert);
   }
   return error;
 }
 
-void HttpNetworkTransaction::HandleCertificateRequest() {
+int HttpNetworkTransaction::HandleCertificateRequest(int error) {
+  // Assert that the socket did not send a client certificate.
+  // Note: If we got a reused socket, it was created with some other
+  // transaction's ssl_config_, so we need to disable this assertion.  We can
+  // get a certificate request on a reused socket when the server requested
+  // renegotiation (rehandshake).
+  // TODO(wtc): add a GetSSLParams method to SSLClientSocket so we can query
+  // the SSL parameters it was created with and get rid of the reused_socket_
+  // test.
+  DCHECK(reused_socket_ || !ssl_config_.send_client_cert);
+
   response_.cert_request_info = new SSLCertRequestInfo;
   SSLClientSocket* ssl_socket =
       reinterpret_cast<SSLClientSocket*>(connection_.socket());
   ssl_socket->GetSSLCertRequestInfo(response_.cert_request_info);
 
   // Close the connection while the user is selecting a certificate to send
   // to the server.
   connection_.socket()->Disconnect();
   connection_.Reset();
+
+  // If the user selected one of the certificate in client_certs for this
+  // server before, use it automatically.
+  X509Certificate* client_cert = session_->ssl_client_auth_cache()->
+      Lookup(GetHostAndPort(request_->url));
+  if (client_cert) {
+    const std::vector<scoped_refptr<X509Certificate> >& client_certs =
+        response_.cert_request_info->client_certs;
+    for (size_t i = 0; i < client_certs.size(); ++i) {
+      if (memcmp(&client_cert->fingerprint(),

[eroman, 2009/06/19 21:42:24]

I suggesting moving this into operator==.

struct Fingerprint {
  unsigned char data[20];

  bool operator==(const Fingerprint& other) const {
    return memcmp(...) == 0;
  }
};

+                 &client_certs[i]->fingerprint(),
+                 sizeof(X509Certificate::Fingerprint)) == 0) {
+        ssl_config_.client_cert = client_cert;
+        ssl_config_.send_client_cert = true;
+        next_state_ = STATE_INIT_CONNECTION;
+        // Reset the other member variables.
+        // Note: this is necessary only with SSL renegotiation.
+        ResetStateForRestart();
+        return OK;
+      }
+    }
+  }
+  return error;
 }
 
 int HttpNetworkTransaction::HandleSSLHandshakeError(int error) {
+  if (ssl_config_.send_client_cert &&
+     (error == ERR_SSL_PROTOCOL_ERROR ||
+      error == ERR_BAD_SSL_CLIENT_AUTH_CERT)) {
+    session_->ssl_client_auth_cache()->Remove(GetHostAndPort(request_->url));
+  }
+
   switch (error) {
     case ERR_SSL_PROTOCOL_ERROR:
     case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
       if (ssl_config_.tls1_enabled) {
         // This could be a TLS-intolerant server or an SSL 3.0 server that
         // chose a TLS-only cipher suite.  Turn off TLS 1.0 and retry.
         ssl_config_.tls1_enabled = false;
         connection_.socket()->Disconnect();
         connection_.Reset();
         next_state_ = STATE_INIT_CONNECTION;
@@ skipping 381 matching lines @@
     host_and_port = proxy_info_.proxy_server().host_and_port();
   } else {
     DCHECK(target == HttpAuth::AUTH_SERVER);
     host_and_port = GetHostAndPort(request_->url);
   }
   auth_info->host_and_port = ASCIIToWide(host_and_port);
   response_.auth_challenge = auth_info;
 }
 
 }  // namespace net