Support for client certs in ssl_server_socket.

net/socket/ssl_server_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_server_socket_nss.h"
 
 #include <utility>
 
 #if defined(OS_WIN)
 #include <winsock2.h>
@@ skipping 65 matching lines @@
     g_nss_ssl_server_init_singleton = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
 void EnableSSLServerSockets() {
   g_nss_ssl_server_init_singleton.Get();
 }
 
 scoped_ptr<SSLServerSocket> CreateSSLServerSocket(
     scoped_ptr<StreamSocket> socket,
-    X509Certificate* cert,
+    X509Certificate* certificate,
     const crypto::RSAPrivateKey& key,
-    const SSLServerConfig& ssl_config) {
+    const SSLServerConfig& ssl_server_config) {
   DCHECK(g_nss_server_sockets_init) << "EnableSSLServerSockets() has not been"
                                     << " called yet!";
 
-  return scoped_ptr<SSLServerSocket>(
-      new SSLServerSocketNSS(std::move(socket), cert, key, ssl_config));
+  return scoped_ptr<SSLServerSocket>(new SSLServerSocketNSS(
+      std::move(socket), certificate, key, ssl_server_config));
 }
 
 SSLServerSocketNSS::SSLServerSocketNSS(
     scoped_ptr<StreamSocket> transport_socket,
     scoped_refptr<X509Certificate> cert,
     const crypto::RSAPrivateKey& key,
-    const SSLServerConfig& ssl_config)
+    const SSLServerConfig& ssl_server_config)
     : transport_send_busy_(false),
       transport_recv_busy_(false),
       user_read_buf_len_(0),
       user_write_buf_len_(0),
       nss_fd_(NULL),
       nss_bufs_(NULL),
       transport_socket_(std::move(transport_socket)),
-      ssl_config_(ssl_config),
+      ssl_server_config_(ssl_server_config),
       cert_(cert),
       key_(key.Copy()),
       next_handshake_state_(STATE_NONE),
       completed_handshake_(false) {
   CHECK(key_);
 }
 
 SSLServerSocketNSS::~SSLServerSocketNSS() {
   if (nss_fd_ != NULL) {
     PR_Close(nss_fd_);
@@ skipping 211 matching lines @@
   /* Push SSL onto our fake I/O socket */
   nss_fd_ = SSL_ImportFD(NULL, nss_fd_);
   if (nss_fd_ == NULL) {
     LogFailedNSSFunction(net_log_, "SSL_ImportFD", "");
     return ERR_OUT_OF_MEMORY;  // TODO(port): map NSPR/NSS error code.
   }
   // TODO(port): set more ssl options!  Check errors!
 
   int rv;
 
-  if (ssl_config_.require_client_cert) {
+  if (ssl_server_config_.client_cert_type ==
+      SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT) {
     rv = SSL_OptionSet(nss_fd_, SSL_REQUEST_CERTIFICATE, PR_TRUE);
     if (rv != SECSuccess) {
       LogFailedNSSFunction(net_log_, "SSL_OptionSet",
                            "SSL_REQUEST_CERTIFICATE");
       return ERR_UNEXPECTED;
     }
   }
 
   rv = SSL_OptionSet(nss_fd_, SSL_SECURITY, PR_TRUE);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_SECURITY");
     return ERR_UNEXPECTED;
   }
 
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_SSL2, PR_FALSE);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_ENABLE_SSL2");
     return ERR_UNEXPECTED;
   }
 
   SSLVersionRange version_range;
-  version_range.min = ssl_config_.version_min;
-  version_range.max = ssl_config_.version_max;
+  version_range.min = ssl_server_config_.version_min;
+  version_range.max = ssl_server_config_.version_max;
   rv = SSL_VersionRangeSet(nss_fd_, &version_range);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(net_log_, "SSL_VersionRangeSet", "");
     return ERR_NO_SSL_VERSIONS_ENABLED;
   }
 
-  if (ssl_config_.require_ecdhe) {
+  if (ssl_server_config_.require_ecdhe) {
     const PRUint16* const ssl_ciphers = SSL_GetImplementedCiphers();
     const PRUint16 num_ciphers = SSL_GetNumImplementedCiphers();
 
     // Iterate over the cipher suites and disable those that don't use ECDHE.
     for (unsigned i = 0; i < num_ciphers; i++) {
       SSLCipherSuiteInfo info;
       if (SSL_GetCipherSuiteInfo(ssl_ciphers[i], &info, sizeof(info)) ==
           SECSuccess) {
         if (strcmp(info.keaTypeName, "ECDHE") != 0) {
           SSL_CipherPrefSet(nss_fd_, ssl_ciphers[i], PR_FALSE);
         }
       }
     }
   }
 
   for (std::vector<uint16_t>::const_iterator it =
-           ssl_config_.disabled_cipher_suites.begin();
-       it != ssl_config_.disabled_cipher_suites.end(); ++it) {
+           ssl_server_config_.disabled_cipher_suites.begin();
+       it != ssl_server_config_.disabled_cipher_suites.end(); ++it) {
     // This will fail if the specified cipher is not implemented by NSS, but
     // the failure is harmless.
     SSL_CipherPrefSet(nss_fd_, *it, PR_FALSE);
   }
 
   // Server socket doesn't need session tickets.
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_SESSION_TICKETS, PR_FALSE);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(
         net_log_, "SSL_OptionSet", "SSL_ENABLE_SESSION_TICKETS");
@@ skipping 448 matching lines @@
   // initializes the NSS base library.
   EnsureNSSSSLInit();
   if (!NSS_IsInitialized())
     return ERR_UNEXPECTED;
 
   EnableSSLServerSockets();
   return OK;
 }
 
 }  // namespace net