| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
| 6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
| 7 | 7 |
| 8 #include <openssl/base.h> | 8 #include <openssl/base.h> |
| 9 #include <openssl/ssl.h> | 9 #include <openssl/ssl.h> |
| 10 #include <stddef.h> | 10 #include <stddef.h> |
| 11 #include <stdint.h> | 11 #include <stdint.h> |
| 12 | 12 |
| 13 #include <memory> |
| 13 #include <string> | 14 #include <string> |
| 14 #include <vector> | 15 #include <vector> |
| 15 | 16 |
| 16 #include "base/compiler_specific.h" | 17 #include "base/compiler_specific.h" |
| 17 #include "base/containers/mru_cache.h" | 18 #include "base/containers/mru_cache.h" |
| 18 #include "base/memory/ref_counted.h" | 19 #include "base/memory/ref_counted.h" |
| 19 #include "base/memory/scoped_ptr.h" | |
| 20 #include "base/memory/weak_ptr.h" | 20 #include "base/memory/weak_ptr.h" |
| 21 #include "build/build_config.h" | 21 #include "build/build_config.h" |
| 22 #include "net/base/completion_callback.h" | 22 #include "net/base/completion_callback.h" |
| 23 #include "net/base/io_buffer.h" | 23 #include "net/base/io_buffer.h" |
| 24 #include "net/cert/cert_verifier.h" | 24 #include "net/cert/cert_verifier.h" |
| 25 #include "net/cert/cert_verify_result.h" | 25 #include "net/cert/cert_verify_result.h" |
| 26 #include "net/cert/ct_verify_result.h" | 26 #include "net/cert/ct_verify_result.h" |
| 27 #include "net/socket/client_socket_handle.h" | 27 #include "net/socket/client_socket_handle.h" |
| 28 #include "net/socket/ssl_client_socket.h" | 28 #include "net/socket/ssl_client_socket.h" |
| 29 #include "net/ssl/channel_id_service.h" | 29 #include "net/ssl/channel_id_service.h" |
| (...skipping 16 matching lines...) Expand all Loading... |
| 46 | 46 |
| 47 using SignedEkmMap = base::MRUCache<std::string, std::vector<uint8_t>>; | 47 using SignedEkmMap = base::MRUCache<std::string, std::vector<uint8_t>>; |
| 48 | 48 |
| 49 // An SSL client socket implemented with OpenSSL. | 49 // An SSL client socket implemented with OpenSSL. |
| 50 class SSLClientSocketOpenSSL : public SSLClientSocket { | 50 class SSLClientSocketOpenSSL : public SSLClientSocket { |
| 51 public: | 51 public: |
| 52 // Takes ownership of the transport_socket, which may already be connected. | 52 // Takes ownership of the transport_socket, which may already be connected. |
| 53 // The given hostname will be compared with the name(s) in the server's | 53 // The given hostname will be compared with the name(s) in the server's |
| 54 // certificate during the SSL handshake. ssl_config specifies the SSL | 54 // certificate during the SSL handshake. ssl_config specifies the SSL |
| 55 // settings. | 55 // settings. |
| 56 SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket, | 56 SSLClientSocketOpenSSL(std::unique_ptr<ClientSocketHandle> transport_socket, |
| 57 const HostPortPair& host_and_port, | 57 const HostPortPair& host_and_port, |
| 58 const SSLConfig& ssl_config, | 58 const SSLConfig& ssl_config, |
| 59 const SSLClientSocketContext& context); | 59 const SSLClientSocketContext& context); |
| 60 ~SSLClientSocketOpenSSL() override; | 60 ~SSLClientSocketOpenSSL() override; |
| 61 | 61 |
| 62 const HostPortPair& host_and_port() const { return host_and_port_; } | 62 const HostPortPair& host_and_port() const { return host_and_port_; } |
| 63 const std::string& ssl_session_cache_shard() const { | 63 const std::string& ssl_session_cache_shard() const { |
| 64 return ssl_session_cache_shard_; | 64 return ssl_session_cache_shard_; |
| 65 } | 65 } |
| 66 | 66 |
| (...skipping 205 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 272 // Used by TransportReadComplete() to signify an error reading from the | 272 // Used by TransportReadComplete() to signify an error reading from the |
| 273 // transport socket. A value of OK indicates the socket is still | 273 // transport socket. A value of OK indicates the socket is still |
| 274 // readable. EOFs are mapped to ERR_CONNECTION_CLOSED. | 274 // readable. EOFs are mapped to ERR_CONNECTION_CLOSED. |
| 275 int transport_read_error_; | 275 int transport_read_error_; |
| 276 | 276 |
| 277 // Used by TransportWriteComplete() and TransportReadComplete() to signify an | 277 // Used by TransportWriteComplete() and TransportReadComplete() to signify an |
| 278 // error writing to the transport socket. A value of OK indicates no error. | 278 // error writing to the transport socket. A value of OK indicates no error. |
| 279 int transport_write_error_; | 279 int transport_write_error_; |
| 280 | 280 |
| 281 // Set when Connect finishes. | 281 // Set when Connect finishes. |
| 282 scoped_ptr<PeerCertificateChain> server_cert_chain_; | 282 std::unique_ptr<PeerCertificateChain> server_cert_chain_; |
| 283 scoped_refptr<X509Certificate> server_cert_; | 283 scoped_refptr<X509Certificate> server_cert_; |
| 284 CertVerifyResult server_cert_verify_result_; | 284 CertVerifyResult server_cert_verify_result_; |
| 285 bool completed_connect_; | 285 bool completed_connect_; |
| 286 | 286 |
| 287 // Set when Read() or Write() successfully reads or writes data to or from the | 287 // Set when Read() or Write() successfully reads or writes data to or from the |
| 288 // network. | 288 // network. |
| 289 bool was_ever_used_; | 289 bool was_ever_used_; |
| 290 | 290 |
| 291 // List of DER-encoded X.509 DistinguishedName of certificate authorities | 291 // List of DER-encoded X.509 DistinguishedName of certificate authorities |
| 292 // allowed by the server. | 292 // allowed by the server. |
| 293 std::vector<std::string> cert_authorities_; | 293 std::vector<std::string> cert_authorities_; |
| 294 // List of SSLClientCertType values for client certificates allowed by the | 294 // List of SSLClientCertType values for client certificates allowed by the |
| 295 // server. | 295 // server. |
| 296 std::vector<SSLClientCertType> cert_key_types_; | 296 std::vector<SSLClientCertType> cert_key_types_; |
| 297 | 297 |
| 298 CertVerifier* const cert_verifier_; | 298 CertVerifier* const cert_verifier_; |
| 299 scoped_ptr<CertVerifier::Request> cert_verifier_request_; | 299 std::unique_ptr<CertVerifier::Request> cert_verifier_request_; |
| 300 base::TimeTicks start_cert_verification_time_; | 300 base::TimeTicks start_cert_verification_time_; |
| 301 | 301 |
| 302 // Certificate Transparency: Verifier and result holder. | 302 // Certificate Transparency: Verifier and result holder. |
| 303 ct::CTVerifyResult ct_verify_result_; | 303 ct::CTVerifyResult ct_verify_result_; |
| 304 CTVerifier* cert_transparency_verifier_; | 304 CTVerifier* cert_transparency_verifier_; |
| 305 | 305 |
| 306 // The service for retrieving Channel ID keys. May be NULL. | 306 // The service for retrieving Channel ID keys. May be NULL. |
| 307 ChannelIDService* channel_id_service_; | 307 ChannelIDService* channel_id_service_; |
| 308 bool tb_was_negotiated_; | 308 bool tb_was_negotiated_; |
| 309 TokenBindingParam tb_negotiated_param_; | 309 TokenBindingParam tb_negotiated_param_; |
| 310 SignedEkmMap tb_signed_ekm_map_; | 310 SignedEkmMap tb_signed_ekm_map_; |
| 311 | 311 |
| 312 // OpenSSL stuff | 312 // OpenSSL stuff |
| 313 SSL* ssl_; | 313 SSL* ssl_; |
| 314 BIO* transport_bio_; | 314 BIO* transport_bio_; |
| 315 | 315 |
| 316 scoped_ptr<ClientSocketHandle> transport_; | 316 std::unique_ptr<ClientSocketHandle> transport_; |
| 317 const HostPortPair host_and_port_; | 317 const HostPortPair host_and_port_; |
| 318 SSLConfig ssl_config_; | 318 SSLConfig ssl_config_; |
| 319 // ssl_session_cache_shard_ is an opaque string that partitions the SSL | 319 // ssl_session_cache_shard_ is an opaque string that partitions the SSL |
| 320 // session cache. i.e. sessions created with one value will not attempt to | 320 // session cache. i.e. sessions created with one value will not attempt to |
| 321 // resume on the socket with a different value. | 321 // resume on the socket with a different value. |
| 322 const std::string ssl_session_cache_shard_; | 322 const std::string ssl_session_cache_shard_; |
| 323 | 323 |
| 324 enum State { | 324 enum State { |
| 325 STATE_NONE, | 325 STATE_NONE, |
| 326 STATE_HANDSHAKE, | 326 STATE_HANDSHAKE, |
| 327 STATE_HANDSHAKE_COMPLETE, | 327 STATE_HANDSHAKE_COMPLETE, |
| 328 STATE_CHANNEL_ID_LOOKUP, | 328 STATE_CHANNEL_ID_LOOKUP, |
| 329 STATE_CHANNEL_ID_LOOKUP_COMPLETE, | 329 STATE_CHANNEL_ID_LOOKUP_COMPLETE, |
| 330 STATE_VERIFY_CERT, | 330 STATE_VERIFY_CERT, |
| 331 STATE_VERIFY_CERT_COMPLETE, | 331 STATE_VERIFY_CERT_COMPLETE, |
| 332 }; | 332 }; |
| 333 State next_handshake_state_; | 333 State next_handshake_state_; |
| 334 | 334 |
| 335 // True if the socket has been disconnected. | 335 // True if the socket has been disconnected. |
| 336 bool disconnected_; | 336 bool disconnected_; |
| 337 | 337 |
| 338 NextProtoStatus npn_status_; | 338 NextProtoStatus npn_status_; |
| 339 std::string npn_proto_; | 339 std::string npn_proto_; |
| 340 // Written by the |channel_id_service_|. | 340 // Written by the |channel_id_service_|. |
| 341 scoped_ptr<crypto::ECPrivateKey> channel_id_key_; | 341 std::unique_ptr<crypto::ECPrivateKey> channel_id_key_; |
| 342 // True if a channel ID was sent. | 342 // True if a channel ID was sent. |
| 343 bool channel_id_sent_; | 343 bool channel_id_sent_; |
| 344 // True if the current session was newly-established, but the certificate had | 344 // True if the current session was newly-established, but the certificate had |
| 345 // not yet been verified externally, so it cannot be inserted into the cache | 345 // not yet been verified externally, so it cannot be inserted into the cache |
| 346 // until later. | 346 // until later. |
| 347 bool session_pending_; | 347 bool session_pending_; |
| 348 // True if the initial handshake's certificate has been verified. | 348 // True if the initial handshake's certificate has been verified. |
| 349 bool certificate_verified_; | 349 bool certificate_verified_; |
| 350 // The request handle for |channel_id_service_|. | 350 // The request handle for |channel_id_service_|. |
| 351 ChannelIDService::Request channel_id_request_; | 351 ChannelIDService::Request channel_id_request_; |
| (...skipping 11 matching lines...) Expand all Loading... |
| 363 // pinning failure. It is a (somewhat) human-readable string. | 363 // pinning failure. It is a (somewhat) human-readable string. |
| 364 std::string pinning_failure_log_; | 364 std::string pinning_failure_log_; |
| 365 | 365 |
| 366 BoundNetLog net_log_; | 366 BoundNetLog net_log_; |
| 367 base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_; | 367 base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_; |
| 368 }; | 368 }; |
| 369 | 369 |
| 370 } // namespace net | 370 } // namespace net |
| 371 | 371 |
| 372 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 372 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
| OLD | NEW |