Support for client certs in ssl_server_socket.

net/ssl/openssl_ssl_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/openssl_ssl_util.h"
 
 #include <errno.h>
 
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/values.h"
 #include "crypto/openssl_util.h"
 #include "net/base/net_errors.h"
+#include "net/ssl/ssl_connection_status_flags.h"
 
 namespace net {
 
 SslSetClearMask::SslSetClearMask()
     : set_mask(0),
       clear_mask(0) {
 }
 
 void SslSetClearMask::ConfigureFlag(long flag, bool state) {
   (state ? set_mask : clear_mask) |= flag;
@@ skipping 203 matching lines @@
 }
 
 NetLog::ParametersCallback CreateNetLogOpenSSLErrorCallback(
     int net_error,
     int ssl_error,
     const OpenSSLErrorInfo& error_info) {
   return base::Bind(&NetLogOpenSSLErrorCallback,
                     net_error, ssl_error, error_info);
 }
 
+void FreeX509Stack(STACK_OF(X509) * ptr) {
+  sk_X509_pop_free(ptr, X509_free);
+}
+
+void FreeX509NameStack(STACK_OF(X509_NAME) * ptr) {
+  sk_X509_NAME_pop_free(ptr, X509_NAME_free);
+}
+
+// Used for encoding the |connection_status| field of an SSLInfo object.
+int EncodeSSLConnectionStatus(int cipher_suite, int compression, int version) {
+  return (cipher_suite & SSL_CONNECTION_CIPHERSUITE_MASK) |
+         ((compression & SSL_CONNECTION_COMPRESSION_MASK)
+          << SSL_CONNECTION_COMPRESSION_SHIFT) |
+         ((version & SSL_CONNECTION_VERSION_MASK)
+          << SSL_CONNECTION_VERSION_SHIFT);
+}
+
+// Returns the net SSL version number (see ssl_connection_status_flags.h) for
+// this SSL connection.
+int GetNetSSLVersion(SSL* ssl) {

[svaldez, 2015/12/14 22:05:41]

Can we not use TLS1_1_VERSION, TLS1_2_VERSION in the switch?

[ryanchung, 2015/12/14 22:31:15]

Done.

+  switch (SSL_version(ssl)) {
+    case TLS1_VERSION:
+      return SSL_CONNECTION_VERSION_TLS1;
+    case 0x0302:
+      return SSL_CONNECTION_VERSION_TLS1_1;
+    case 0x0303:
+      return SSL_CONNECTION_VERSION_TLS1_2;
+    default:
+      NOTREACHED();
+      return SSL_CONNECTION_VERSION_UNKNOWN;
+  }
+}
+
+ScopedX509 OSCertHandleToOpenSSL(X509Certificate::OSCertHandle os_handle) {
+#if defined(USE_OPENSSL_CERTS)
+  return ScopedX509(X509Certificate::DupOSCertHandle(os_handle));
+#else   // !defined(USE_OPENSSL_CERTS)

[svaldez, 2015/12/14 22:05:41]

nit: #else  //... (2 spaces)

[ryanchung, 2015/12/14 22:31:15]

Done. Every time I run git cl format, it adds the 3rd space in for some reason.

+  std::string der_encoded;
+  if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded))
+    return ScopedX509();
+  const uint8_t* bytes = reinterpret_cast<const uint8_t*>(der_encoded.data());
+  return ScopedX509(d2i_X509(NULL, &bytes, der_encoded.size()));
+#endif  // defined(USE_OPENSSL_CERTS)
+}
+
+ScopedX509Stack OSCertHandlesToOpenSSL(
+    const X509Certificate::OSCertHandles& os_handles) {
+  ScopedX509Stack stack(sk_X509_new_null());
+  for (size_t i = 0; i < os_handles.size(); i++) {
+    ScopedX509 x509 = OSCertHandleToOpenSSL(os_handles[i]);
+    if (!x509)
+      return ScopedX509Stack();
+    sk_X509_push(stack.get(), x509.release());
+  }
+  return stack.Pass();
+}
+
 }  // namespace net