Implement Token Binding negotiation TLS extension

net/socket/ssl_client_socket.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/string_util.h"
 #include "crypto/ec_private_key.h"
@@ skipping 132 matching lines @@
   if (negotiated_channel_id) {
     supported = CLIENT_AND_SERVER;
   } else if (channel_id_enabled) {
     if (!channel_id_service)
       supported = CLIENT_NO_CHANNEL_ID_SERVICE;
     else if (!supports_ecc)
       supported = CLIENT_NO_ECC;
     else
       supported = CLIENT_ONLY;
   }
   UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.Support", supported,

[mattm, 2015/09/24 22:13:12]

Add a similar histogram for token binding?

[nharper, 2015/09/28 21:43:38]

Done.

                             CHANNEL_ID_USAGE_MAX);
 }
 
 // static
 bool SSLClientSocket::IsChannelIDEnabled(
     const SSLConfig& ssl_config,
     ChannelIDService* channel_id_service) {
   if (!ssl_config.channel_id_enabled)
     return false;
   if (!channel_id_service) {
     DVLOG(1) << "NULL channel_id_service_, not enabling channel ID.";
     return false;
   }
   if (!crypto::ECPrivateKey::IsSupported()) {
     DVLOG(1) << "Elliptic Curve not supported, not enabling channel ID.";
     return false;
   }
   return true;
 }
 
 // static
+bool SSLClientSocket::IsTokenBindingEnabled(
+    const SSLConfig& ssl_config,
+    ChannelIDService* channel_id_service) {
+  if (ssl_config.token_binding_params.size() != 1 ||
+      ssl_config.token_binding_params[0] != TB_PARAM_ECDSAP256_SHA256) {
+    return false;
+  }
+  return IsChannelIDEnabled(ssl_config, channel_id_service);
+}
+
+// static
 bool SSLClientSocket::HasCipherAdequateForHTTP2(
     const std::vector<uint16>& cipher_suites) {
   for (uint16 cipher : cipher_suites) {
     if (IsSecureTLSCipherSuite(cipher))
       return true;
   }
   return false;
 }
 
 // static
@@ skipping 23 matching lines @@
     wire_protos.push_back(proto.size());
     for (const char ch : proto) {
       wire_protos.push_back(static_cast<uint8_t>(ch));
     }
   }
 
   return wire_protos;
 }
 
 }  // namespace net