Implement Token Binding negotiation TLS extension

net/socket/ssl_client_socket_openssl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 
 #include <openssl/base.h>
 #include <openssl/ssl.h>
 #include <stdint.h>
@@ skipping 192 matching lines @@
                                                   const EVP_MD* md,
                                                   const uint8_t* in,
                                                   size_t in_len);
   ssl_private_key_result_t PrivateKeySignCompleteCallback(uint8_t* out,
                                                           size_t* out_len,
                                                           size_t max_out);
 
   void OnPrivateKeySignComplete(Error error,
                                 const std::vector<uint8_t>& signature);
 
+  // Token Binding Extension callbacks. RegisterTokenBindingExtensionCallbacks
+  // sets the following static methods as the callbacks for the boringssl custom
+  // extension API. The Add and Parse callbacks are wrappers around the instance
+  // methods; The Free callback is a wrapper around OPENSSL_free.

[davidben, 2015/11/04 00:40:36]

"; The" -> "; the"

Though I'd probably just drop that bit altogether. I don't think readers of the
header file need to know that's what the Free callbacbk is.

[nharper, 2015/11/04 02:28:04]

Done.

+  static bool RegisterTokenBindingExtensionCallbacks(SSL_CTX* ssl_ctx);
+  static int TokenBindingAddCallback(SSL* ssl,
+                                     unsigned int extension_value,
+                                     const uint8_t** out,
+                                     size_t* out_len,
+                                     int* out_alert_value,
+                                     void* add_arg);
+  static void TokenBindingFreeCallback(SSL* ssl,
+                                       unsigned int extension_value,
+                                       const uint8_t* out,
+                                       void* add_arg);
+  static int TokenBindingParseCallback(SSL* ssl,
+                                       unsigned int extension_value,
+                                       const uint8_t* contents,
+                                       size_t contents_len,
+                                       int* out_alert_value,
+                                       void* parse_arg);
+
+  int TokenBindingAdd(const uint8_t** out,
+                      size_t* out_len,
+                      int* out_alert_value);
+  int TokenBindingParse(const uint8_t* contents,
+                        size_t contents_len,
+                        int* out_alert_value);
+
   bool transport_send_busy_;
   bool transport_recv_busy_;
 
   // Buffers which are shared by BoringSSL and SSLClientSocketOpenSSL.
   // GrowableIOBuffer is used to keep ownership and setting offset.
   scoped_refptr<GrowableIOBuffer> send_buffer_;
   scoped_refptr<GrowableIOBuffer> recv_buffer_;
 
   CompletionCallback user_connect_callback_;
   CompletionCallback user_read_callback_;
@@ skipping 51 matching lines @@
   CertVerifier* const cert_verifier_;
   scoped_ptr<CertVerifier::Request> cert_verifier_request_;
   base::TimeTicks start_cert_verification_time_;
 
   // Certificate Transparency: Verifier and result holder.
   ct::CTVerifyResult ct_verify_result_;
   CTVerifier* cert_transparency_verifier_;
 
   // The service for retrieving Channel ID keys.  May be NULL.
   ChannelIDService* channel_id_service_;
+  bool tb_was_negotiated_;
+  TokenBindingParam tb_negotiated_param_;
 
   // OpenSSL stuff
   SSL* ssl_;
   BIO* transport_bio_;
 
   scoped_ptr<ClientSocketHandle> transport_;
   const HostPortPair host_and_port_;
   SSLConfig ssl_config_;
   // ssl_session_cache_shard_ is an opaque string that partitions the SSL
   // session cache. i.e. sessions created with one value will not attempt to
@@ skipping 43 matching lines @@
   // pinning failure. It is a (somewhat) human-readable string.
   std::string pinning_failure_log_;
 
   BoundNetLog net_log_;
   base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_