OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
7 | 7 |
8 #include <openssl/base.h> | 8 #include <openssl/base.h> |
9 #include <openssl/ssl.h> | 9 #include <openssl/ssl.h> |
10 #include <stddef.h> | 10 #include <stddef.h> |
11 #include <stdint.h> | 11 #include <stdint.h> |
12 | 12 |
| 13 #include <memory> |
13 #include <string> | 14 #include <string> |
14 #include <vector> | 15 #include <vector> |
15 | 16 |
16 #include "base/compiler_specific.h" | 17 #include "base/compiler_specific.h" |
17 #include "base/containers/mru_cache.h" | 18 #include "base/containers/mru_cache.h" |
18 #include "base/memory/ref_counted.h" | 19 #include "base/memory/ref_counted.h" |
19 #include "base/memory/scoped_ptr.h" | |
20 #include "base/memory/weak_ptr.h" | 20 #include "base/memory/weak_ptr.h" |
21 #include "build/build_config.h" | 21 #include "build/build_config.h" |
22 #include "net/base/completion_callback.h" | 22 #include "net/base/completion_callback.h" |
23 #include "net/base/io_buffer.h" | 23 #include "net/base/io_buffer.h" |
24 #include "net/cert/cert_verifier.h" | 24 #include "net/cert/cert_verifier.h" |
25 #include "net/cert/cert_verify_result.h" | 25 #include "net/cert/cert_verify_result.h" |
26 #include "net/cert/ct_verify_result.h" | 26 #include "net/cert/ct_verify_result.h" |
27 #include "net/socket/client_socket_handle.h" | 27 #include "net/socket/client_socket_handle.h" |
28 #include "net/socket/ssl_client_socket.h" | 28 #include "net/socket/ssl_client_socket.h" |
29 #include "net/ssl/channel_id_service.h" | 29 #include "net/ssl/channel_id_service.h" |
(...skipping 16 matching lines...) Expand all Loading... |
46 | 46 |
47 using SignedEkmMap = base::MRUCache<std::string, std::vector<uint8_t>>; | 47 using SignedEkmMap = base::MRUCache<std::string, std::vector<uint8_t>>; |
48 | 48 |
49 // An SSL client socket implemented with OpenSSL. | 49 // An SSL client socket implemented with OpenSSL. |
50 class SSLClientSocketOpenSSL : public SSLClientSocket { | 50 class SSLClientSocketOpenSSL : public SSLClientSocket { |
51 public: | 51 public: |
52 // Takes ownership of the transport_socket, which may already be connected. | 52 // Takes ownership of the transport_socket, which may already be connected. |
53 // The given hostname will be compared with the name(s) in the server's | 53 // The given hostname will be compared with the name(s) in the server's |
54 // certificate during the SSL handshake. ssl_config specifies the SSL | 54 // certificate during the SSL handshake. ssl_config specifies the SSL |
55 // settings. | 55 // settings. |
56 SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket, | 56 SSLClientSocketOpenSSL(std::unique_ptr<ClientSocketHandle> transport_socket, |
57 const HostPortPair& host_and_port, | 57 const HostPortPair& host_and_port, |
58 const SSLConfig& ssl_config, | 58 const SSLConfig& ssl_config, |
59 const SSLClientSocketContext& context); | 59 const SSLClientSocketContext& context); |
60 ~SSLClientSocketOpenSSL() override; | 60 ~SSLClientSocketOpenSSL() override; |
61 | 61 |
62 const HostPortPair& host_and_port() const { return host_and_port_; } | 62 const HostPortPair& host_and_port() const { return host_and_port_; } |
63 const std::string& ssl_session_cache_shard() const { | 63 const std::string& ssl_session_cache_shard() const { |
64 return ssl_session_cache_shard_; | 64 return ssl_session_cache_shard_; |
65 } | 65 } |
66 | 66 |
(...skipping 205 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
272 // Used by TransportReadComplete() to signify an error reading from the | 272 // Used by TransportReadComplete() to signify an error reading from the |
273 // transport socket. A value of OK indicates the socket is still | 273 // transport socket. A value of OK indicates the socket is still |
274 // readable. EOFs are mapped to ERR_CONNECTION_CLOSED. | 274 // readable. EOFs are mapped to ERR_CONNECTION_CLOSED. |
275 int transport_read_error_; | 275 int transport_read_error_; |
276 | 276 |
277 // Used by TransportWriteComplete() and TransportReadComplete() to signify an | 277 // Used by TransportWriteComplete() and TransportReadComplete() to signify an |
278 // error writing to the transport socket. A value of OK indicates no error. | 278 // error writing to the transport socket. A value of OK indicates no error. |
279 int transport_write_error_; | 279 int transport_write_error_; |
280 | 280 |
281 // Set when Connect finishes. | 281 // Set when Connect finishes. |
282 scoped_ptr<PeerCertificateChain> server_cert_chain_; | 282 std::unique_ptr<PeerCertificateChain> server_cert_chain_; |
283 scoped_refptr<X509Certificate> server_cert_; | 283 scoped_refptr<X509Certificate> server_cert_; |
284 CertVerifyResult server_cert_verify_result_; | 284 CertVerifyResult server_cert_verify_result_; |
285 bool completed_connect_; | 285 bool completed_connect_; |
286 | 286 |
287 // Set when Read() or Write() successfully reads or writes data to or from the | 287 // Set when Read() or Write() successfully reads or writes data to or from the |
288 // network. | 288 // network. |
289 bool was_ever_used_; | 289 bool was_ever_used_; |
290 | 290 |
291 // List of DER-encoded X.509 DistinguishedName of certificate authorities | 291 // List of DER-encoded X.509 DistinguishedName of certificate authorities |
292 // allowed by the server. | 292 // allowed by the server. |
293 std::vector<std::string> cert_authorities_; | 293 std::vector<std::string> cert_authorities_; |
294 // List of SSLClientCertType values for client certificates allowed by the | 294 // List of SSLClientCertType values for client certificates allowed by the |
295 // server. | 295 // server. |
296 std::vector<SSLClientCertType> cert_key_types_; | 296 std::vector<SSLClientCertType> cert_key_types_; |
297 | 297 |
298 CertVerifier* const cert_verifier_; | 298 CertVerifier* const cert_verifier_; |
299 scoped_ptr<CertVerifier::Request> cert_verifier_request_; | 299 std::unique_ptr<CertVerifier::Request> cert_verifier_request_; |
300 base::TimeTicks start_cert_verification_time_; | 300 base::TimeTicks start_cert_verification_time_; |
301 | 301 |
302 // Certificate Transparency: Verifier and result holder. | 302 // Certificate Transparency: Verifier and result holder. |
303 ct::CTVerifyResult ct_verify_result_; | 303 ct::CTVerifyResult ct_verify_result_; |
304 CTVerifier* cert_transparency_verifier_; | 304 CTVerifier* cert_transparency_verifier_; |
305 | 305 |
306 // The service for retrieving Channel ID keys. May be NULL. | 306 // The service for retrieving Channel ID keys. May be NULL. |
307 ChannelIDService* channel_id_service_; | 307 ChannelIDService* channel_id_service_; |
308 bool tb_was_negotiated_; | 308 bool tb_was_negotiated_; |
309 TokenBindingParam tb_negotiated_param_; | 309 TokenBindingParam tb_negotiated_param_; |
310 SignedEkmMap tb_signed_ekm_map_; | 310 SignedEkmMap tb_signed_ekm_map_; |
311 | 311 |
312 // OpenSSL stuff | 312 // OpenSSL stuff |
313 SSL* ssl_; | 313 SSL* ssl_; |
314 BIO* transport_bio_; | 314 BIO* transport_bio_; |
315 | 315 |
316 scoped_ptr<ClientSocketHandle> transport_; | 316 std::unique_ptr<ClientSocketHandle> transport_; |
317 const HostPortPair host_and_port_; | 317 const HostPortPair host_and_port_; |
318 SSLConfig ssl_config_; | 318 SSLConfig ssl_config_; |
319 // ssl_session_cache_shard_ is an opaque string that partitions the SSL | 319 // ssl_session_cache_shard_ is an opaque string that partitions the SSL |
320 // session cache. i.e. sessions created with one value will not attempt to | 320 // session cache. i.e. sessions created with one value will not attempt to |
321 // resume on the socket with a different value. | 321 // resume on the socket with a different value. |
322 const std::string ssl_session_cache_shard_; | 322 const std::string ssl_session_cache_shard_; |
323 | 323 |
324 enum State { | 324 enum State { |
325 STATE_NONE, | 325 STATE_NONE, |
326 STATE_HANDSHAKE, | 326 STATE_HANDSHAKE, |
327 STATE_HANDSHAKE_COMPLETE, | 327 STATE_HANDSHAKE_COMPLETE, |
328 STATE_CHANNEL_ID_LOOKUP, | 328 STATE_CHANNEL_ID_LOOKUP, |
329 STATE_CHANNEL_ID_LOOKUP_COMPLETE, | 329 STATE_CHANNEL_ID_LOOKUP_COMPLETE, |
330 STATE_VERIFY_CERT, | 330 STATE_VERIFY_CERT, |
331 STATE_VERIFY_CERT_COMPLETE, | 331 STATE_VERIFY_CERT_COMPLETE, |
332 }; | 332 }; |
333 State next_handshake_state_; | 333 State next_handshake_state_; |
334 | 334 |
335 // True if the socket has been disconnected. | 335 // True if the socket has been disconnected. |
336 bool disconnected_; | 336 bool disconnected_; |
337 | 337 |
338 NextProtoStatus npn_status_; | 338 NextProtoStatus npn_status_; |
339 std::string npn_proto_; | 339 std::string npn_proto_; |
340 // Written by the |channel_id_service_|. | 340 // Written by the |channel_id_service_|. |
341 scoped_ptr<crypto::ECPrivateKey> channel_id_key_; | 341 std::unique_ptr<crypto::ECPrivateKey> channel_id_key_; |
342 // True if a channel ID was sent. | 342 // True if a channel ID was sent. |
343 bool channel_id_sent_; | 343 bool channel_id_sent_; |
344 // True if the current session was newly-established, but the certificate had | 344 // True if the current session was newly-established, but the certificate had |
345 // not yet been verified externally, so it cannot be inserted into the cache | 345 // not yet been verified externally, so it cannot be inserted into the cache |
346 // until later. | 346 // until later. |
347 bool session_pending_; | 347 bool session_pending_; |
348 // True if the initial handshake's certificate has been verified. | 348 // True if the initial handshake's certificate has been verified. |
349 bool certificate_verified_; | 349 bool certificate_verified_; |
350 // The request handle for |channel_id_service_|. | 350 // The request handle for |channel_id_service_|. |
351 ChannelIDService::Request channel_id_request_; | 351 ChannelIDService::Request channel_id_request_; |
(...skipping 11 matching lines...) Expand all Loading... |
363 // pinning failure. It is a (somewhat) human-readable string. | 363 // pinning failure. It is a (somewhat) human-readable string. |
364 std::string pinning_failure_log_; | 364 std::string pinning_failure_log_; |
365 | 365 |
366 BoundNetLog net_log_; | 366 BoundNetLog net_log_; |
367 base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_; | 367 base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_; |
368 }; | 368 }; |
369 | 369 |
370 } // namespace net | 370 } // namespace net |
371 | 371 |
372 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | 372 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ |
OLD | NEW |