Support for client certs in ssl_server_socket.

net/ssl/ssl_server_config.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_SERVER_CONFIG_H_
 #define NET_SSL_SSL_SERVER_CONFIG_H_
 
 #include <stdint.h>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "net/base/net_export.h"
 #include "net/ssl/ssl_config.h"
 
 namespace net {
 
+class ClientCertVerifier;
+
 // A collection of server-side SSL-related configuration settings.
 struct NET_EXPORT SSLServerConfig {
   // Defaults
   SSLServerConfig();
   ~SSLServerConfig();
 
   // The minimum and maximum protocol versions that are enabled.
   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined in ssl_config.h)
   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
   // means no protocol versions are enabled.
@@ skipping 22 matching lines @@
   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
   std::vector<uint16_t> disabled_cipher_suites;
 
   // If true, causes only ECDHE cipher suites to be enabled.
   bool require_ecdhe;
 
   // Requires a client certificate for client authentication from the client.
   // This doesn't currently enforce certificate validity.
   bool require_client_cert;
+
+  // Provides the list of certificates whose names are to be included in the
+  // CertificateRequest handshake message. This member is only useful if
+  // certificates are allowed.

[davidben, 2015/12/14 23:56:51]

Nit: Slightly shorter:

  // A list of certificates whose names are to be included in the
  // CertificateRequest handshake message, if client certificates are
  // required.

[ryanchung, 2015/12/16 22:40:03]

Done.

+  CertificateList client_cert_ca_list;
+
+  // Indicates that a client certificate is required, and provides the

[davidben, 2015/12/14 23:56:51]

This isn't actually true, no? require_client_cert is that. (Could we perhaps
merge the two and have EmbeddedTestServer pass in a dummy CertificateVerifier
that just accepts everything?)

[ryanchung, 2015/12/16 22:40:03]

You're right. The CertVerifyCallback in SSLServerSocketOpenSSL now accepts
everything if a verifier is not provided.

+  // CertificateVerifier that is to be used to verify it during the handshake.
+  // The |client_cert_verifier| continues to be owned by the caller,
+  // and must exist at least until the handshake has completed.

[davidben, 2015/12/14 23:56:51]

and must exist [...] -> and must outlive any sockets using this SSLServerConfig.

Since the socket makes a copy of the SSLServerConfig, even if it doesn't touch
the field before the handshake is done, I think we're much better off with the
simpler API contract.

For instance, if we supported client-initiated renego (we don't, and aren't
going to), this API contract could be wrong.

[ryanchung, 2015/12/16 22:40:03]

Done.

+  // This field is meaningful only if client certificates are required.
+  // NOTES:
+  // 1. If no CertificateVerifier is provided, then a client certificate may
+  // still be allowed (if ssl_server_config.send_client_cert is true),

[davidben, 2015/12/14 23:56:51]

What's send_client_cert?

[ryanchung, 2015/12/16 22:40:02]

Sorry, this is now called require_client_cert.

+  // but in that case verification must be done after the handshake
+  // has completed, by which time the session will have been cached,
+  // and may be subject to resumption.

[davidben, 2015/12/14 23:56:51]

This API doesn't do session caching right now.

[ryanchung, 2015/12/16 22:40:03]

Done.

+  // 2. OpenSSL expects the certificate verification callback to complete
+  // synchronously.

[davidben, 2015/12/14 23:56:51]

This note seems unnecessary. If you want to make it asynchronous, file a bug and
attach a TODO comment somewhere.

[ryanchung, 2015/12/16 22:40:03]

Done. Removed note.

+  // 3. For verifying a client certificate, the CertVerifier::Verify method
+  // will be called with input parameters as follows:
+  //    - cert: the cert to be verified

[davidben, 2015/12/14 23:56:51]

This seems unnecessary.

[ryanchung, 2015/12/16 22:40:03]

Done.

+  ClientCertVerifier* client_cert_verifier;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_SERVER_CONFIG_H_