Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(72)

Side by Side Diff: net/socket/ssl_server_socket_impl.cc

Issue 1921563003: Renaming _openssl files to _impl (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix nits. Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « net/socket/ssl_server_socket_impl.h ('k') | net/socket/ssl_server_socket_openssl.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/socket/ssl_server_socket_openssl.h" 5 #include "net/socket/ssl_server_socket_impl.h"
6 6
7 #include <openssl/err.h> 7 #include <openssl/err.h>
8 #include <openssl/ssl.h> 8 #include <openssl/ssl.h>
9 #include <utility> 9 #include <utility>
10 10
11 #include "base/callback_helpers.h" 11 #include "base/callback_helpers.h"
12 #include "base/logging.h" 12 #include "base/logging.h"
13 #include "base/strings/string_util.h" 13 #include "base/strings/string_util.h"
14 #include "crypto/openssl_util.h" 14 #include "crypto/openssl_util.h"
15 #include "crypto/rsa_private_key.h" 15 #include "crypto/rsa_private_key.h"
(...skipping 28 matching lines...) Expand all
44 for (size_t i = 0; i < sk_X509_num(chain); ++i) { 44 for (size_t i = 0; i < sk_X509_num(chain); ++i) {
45 X509* x = sk_X509_value(chain, i); 45 X509* x = sk_X509_value(chain, i);
46 if (!x509_util::GetDER(x, &der_cert)) 46 if (!x509_util::GetDER(x, &der_cert))
47 return nullptr; 47 return nullptr;
48 der_chain.push_back(der_cert); 48 der_chain.push_back(der_cert);
49 } 49 }
50 50
51 return X509Certificate::CreateFromDERCertChain(der_chain); 51 return X509Certificate::CreateFromDERCertChain(der_chain);
52 } 52 }
53 53
54 class SSLServerSocketOpenSSL : public SSLServerSocket { 54 class SSLServerSocketImpl : public SSLServerSocket {
55 public: 55 public:
56 // See comments on CreateSSLServerSocket for details of how these 56 // See comments on CreateSSLServerSocket for details of how these
57 // parameters are used. 57 // parameters are used.
58 SSLServerSocketOpenSSL(std::unique_ptr<StreamSocket> socket, SSL* ssl); 58 SSLServerSocketImpl(std::unique_ptr<StreamSocket> socket, SSL* ssl);
59 ~SSLServerSocketOpenSSL() override; 59 ~SSLServerSocketImpl() override;
60 60
61 // SSLServerSocket interface. 61 // SSLServerSocket interface.
62 int Handshake(const CompletionCallback& callback) override; 62 int Handshake(const CompletionCallback& callback) override;
63 63
64 // SSLSocket interface. 64 // SSLSocket interface.
65 int ExportKeyingMaterial(const base::StringPiece& label, 65 int ExportKeyingMaterial(const base::StringPiece& label,
66 bool has_context, 66 bool has_context,
67 const base::StringPiece& context, 67 const base::StringPiece& context,
68 unsigned char* out, 68 unsigned char* out,
69 unsigned int outlen) override; 69 unsigned int outlen) override;
(...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after
161 161
162 // StreamSocket for sending and receiving data. 162 // StreamSocket for sending and receiving data.
163 std::unique_ptr<StreamSocket> transport_socket_; 163 std::unique_ptr<StreamSocket> transport_socket_;
164 164
165 // Certificate for the client. 165 // Certificate for the client.
166 scoped_refptr<X509Certificate> client_cert_; 166 scoped_refptr<X509Certificate> client_cert_;
167 167
168 State next_handshake_state_; 168 State next_handshake_state_;
169 bool completed_handshake_; 169 bool completed_handshake_;
170 170
171 DISALLOW_COPY_AND_ASSIGN(SSLServerSocketOpenSSL); 171 DISALLOW_COPY_AND_ASSIGN(SSLServerSocketImpl);
172 }; 172 };
173 173
174 SSLServerSocketOpenSSL::SSLServerSocketOpenSSL( 174 SSLServerSocketImpl::SSLServerSocketImpl(
175 std::unique_ptr<StreamSocket> transport_socket, 175 std::unique_ptr<StreamSocket> transport_socket,
176 SSL* ssl) 176 SSL* ssl)
177 : transport_send_busy_(false), 177 : transport_send_busy_(false),
178 transport_recv_busy_(false), 178 transport_recv_busy_(false),
179 transport_recv_eof_(false), 179 transport_recv_eof_(false),
180 user_read_buf_len_(0), 180 user_read_buf_len_(0),
181 user_write_buf_len_(0), 181 user_write_buf_len_(0),
182 transport_write_error_(OK), 182 transport_write_error_(OK),
183 ssl_(ssl), 183 ssl_(ssl),
184 transport_bio_(NULL), 184 transport_bio_(NULL),
185 transport_socket_(std::move(transport_socket)), 185 transport_socket_(std::move(transport_socket)),
186 next_handshake_state_(STATE_NONE), 186 next_handshake_state_(STATE_NONE),
187 completed_handshake_(false) {} 187 completed_handshake_(false) {}
188 188
189 SSLServerSocketOpenSSL::~SSLServerSocketOpenSSL() { 189 SSLServerSocketImpl::~SSLServerSocketImpl() {
190 if (ssl_) { 190 if (ssl_) {
191 // Calling SSL_shutdown prevents the session from being marked as 191 // Calling SSL_shutdown prevents the session from being marked as
192 // unresumable. 192 // unresumable.
193 SSL_shutdown(ssl_); 193 SSL_shutdown(ssl_);
194 SSL_free(ssl_); 194 SSL_free(ssl_);
195 ssl_ = NULL; 195 ssl_ = NULL;
196 } 196 }
197 if (transport_bio_) { 197 if (transport_bio_) {
198 BIO_free_all(transport_bio_); 198 BIO_free_all(transport_bio_);
199 transport_bio_ = NULL; 199 transport_bio_ = NULL;
200 } 200 }
201 } 201 }
202 202
203 int SSLServerSocketOpenSSL::Handshake(const CompletionCallback& callback) { 203 int SSLServerSocketImpl::Handshake(const CompletionCallback& callback) {
204 net_log_.BeginEvent(NetLog::TYPE_SSL_SERVER_HANDSHAKE); 204 net_log_.BeginEvent(NetLog::TYPE_SSL_SERVER_HANDSHAKE);
205 205
206 // Set up new ssl object. 206 // Set up new ssl object.
207 int rv = Init(); 207 int rv = Init();
208 if (rv != OK) { 208 if (rv != OK) {
209 LOG(ERROR) << "Failed to initialize OpenSSL: rv=" << rv; 209 LOG(ERROR) << "Failed to initialize OpenSSL: rv=" << rv;
210 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv); 210 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv);
211 return rv; 211 return rv;
212 } 212 }
213 213
214 // Set SSL to server mode. Handshake happens in the loop below. 214 // Set SSL to server mode. Handshake happens in the loop below.
215 SSL_set_accept_state(ssl_); 215 SSL_set_accept_state(ssl_);
216 216
217 GotoState(STATE_HANDSHAKE); 217 GotoState(STATE_HANDSHAKE);
218 rv = DoHandshakeLoop(OK); 218 rv = DoHandshakeLoop(OK);
219 if (rv == ERR_IO_PENDING) { 219 if (rv == ERR_IO_PENDING) {
220 user_handshake_callback_ = callback; 220 user_handshake_callback_ = callback;
221 } else { 221 } else {
222 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv); 222 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv);
223 } 223 }
224 224
225 return rv > OK ? OK : rv; 225 return rv > OK ? OK : rv;
226 } 226 }
227 227
228 int SSLServerSocketOpenSSL::ExportKeyingMaterial( 228 int SSLServerSocketImpl::ExportKeyingMaterial(const base::StringPiece& label,
229 const base::StringPiece& label, 229 bool has_context,
230 bool has_context, 230 const base::StringPiece& context,
231 const base::StringPiece& context, 231 unsigned char* out,
232 unsigned char* out, 232 unsigned int outlen) {
233 unsigned int outlen) {
234 if (!IsConnected()) 233 if (!IsConnected())
235 return ERR_SOCKET_NOT_CONNECTED; 234 return ERR_SOCKET_NOT_CONNECTED;
236 235
237 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 236 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
238 237
239 int rv = SSL_export_keying_material( 238 int rv = SSL_export_keying_material(
240 ssl_, out, outlen, label.data(), label.size(), 239 ssl_, out, outlen, label.data(), label.size(),
241 reinterpret_cast<const unsigned char*>(context.data()), 240 reinterpret_cast<const unsigned char*>(context.data()), context.length(),
242 context.length(), context.length() > 0); 241 context.length() > 0);
243 242
244 if (rv != 1) { 243 if (rv != 1) {
245 int ssl_error = SSL_get_error(ssl_, rv); 244 int ssl_error = SSL_get_error(ssl_, rv);
246 LOG(ERROR) << "Failed to export keying material;" 245 LOG(ERROR) << "Failed to export keying material;"
247 << " returned " << rv 246 << " returned " << rv << ", SSL error code " << ssl_error;
248 << ", SSL error code " << ssl_error;
249 return MapOpenSSLError(ssl_error, err_tracer); 247 return MapOpenSSLError(ssl_error, err_tracer);
250 } 248 }
251 return OK; 249 return OK;
252 } 250 }
253 251
254 int SSLServerSocketOpenSSL::Read(IOBuffer* buf, 252 int SSLServerSocketImpl::Read(IOBuffer* buf,
255 int buf_len, 253 int buf_len,
256 const CompletionCallback& callback) { 254 const CompletionCallback& callback) {
257 DCHECK(user_read_callback_.is_null()); 255 DCHECK(user_read_callback_.is_null());
258 DCHECK(user_handshake_callback_.is_null()); 256 DCHECK(user_handshake_callback_.is_null());
259 DCHECK(!user_read_buf_); 257 DCHECK(!user_read_buf_);
260 DCHECK(!callback.is_null()); 258 DCHECK(!callback.is_null());
261 259
262 user_read_buf_ = buf; 260 user_read_buf_ = buf;
263 user_read_buf_len_ = buf_len; 261 user_read_buf_len_ = buf_len;
264 262
265 DCHECK(completed_handshake_); 263 DCHECK(completed_handshake_);
266 264
267 int rv = DoReadLoop(OK); 265 int rv = DoReadLoop(OK);
268 266
269 if (rv == ERR_IO_PENDING) { 267 if (rv == ERR_IO_PENDING) {
270 user_read_callback_ = callback; 268 user_read_callback_ = callback;
271 } else { 269 } else {
272 user_read_buf_ = NULL; 270 user_read_buf_ = NULL;
273 user_read_buf_len_ = 0; 271 user_read_buf_len_ = 0;
274 } 272 }
275 273
276 return rv; 274 return rv;
277 } 275 }
278 276
279 int SSLServerSocketOpenSSL::Write(IOBuffer* buf, 277 int SSLServerSocketImpl::Write(IOBuffer* buf,
280 int buf_len, 278 int buf_len,
281 const CompletionCallback& callback) { 279 const CompletionCallback& callback) {
282 DCHECK(user_write_callback_.is_null()); 280 DCHECK(user_write_callback_.is_null());
283 DCHECK(!user_write_buf_); 281 DCHECK(!user_write_buf_);
284 DCHECK(!callback.is_null()); 282 DCHECK(!callback.is_null());
285 283
286 user_write_buf_ = buf; 284 user_write_buf_ = buf;
287 user_write_buf_len_ = buf_len; 285 user_write_buf_len_ = buf_len;
288 286
289 int rv = DoWriteLoop(OK); 287 int rv = DoWriteLoop(OK);
290 288
291 if (rv == ERR_IO_PENDING) { 289 if (rv == ERR_IO_PENDING) {
292 user_write_callback_ = callback; 290 user_write_callback_ = callback;
293 } else { 291 } else {
294 user_write_buf_ = NULL; 292 user_write_buf_ = NULL;
295 user_write_buf_len_ = 0; 293 user_write_buf_len_ = 0;
296 } 294 }
297 return rv; 295 return rv;
298 } 296 }
299 297
300 int SSLServerSocketOpenSSL::SetReceiveBufferSize(int32_t size) { 298 int SSLServerSocketImpl::SetReceiveBufferSize(int32_t size) {
301 return transport_socket_->SetReceiveBufferSize(size); 299 return transport_socket_->SetReceiveBufferSize(size);
302 } 300 }
303 301
304 int SSLServerSocketOpenSSL::SetSendBufferSize(int32_t size) { 302 int SSLServerSocketImpl::SetSendBufferSize(int32_t size) {
305 return transport_socket_->SetSendBufferSize(size); 303 return transport_socket_->SetSendBufferSize(size);
306 } 304 }
307 305
308 int SSLServerSocketOpenSSL::Connect(const CompletionCallback& callback) { 306 int SSLServerSocketImpl::Connect(const CompletionCallback& callback) {
309 NOTIMPLEMENTED(); 307 NOTIMPLEMENTED();
310 return ERR_NOT_IMPLEMENTED; 308 return ERR_NOT_IMPLEMENTED;
311 } 309 }
312 310
313 void SSLServerSocketOpenSSL::Disconnect() { 311 void SSLServerSocketImpl::Disconnect() {
314 transport_socket_->Disconnect(); 312 transport_socket_->Disconnect();
315 } 313 }
316 314
317 bool SSLServerSocketOpenSSL::IsConnected() const { 315 bool SSLServerSocketImpl::IsConnected() const {
318 // TODO(wtc): Find out if we should check transport_socket_->IsConnected() 316 // TODO(wtc): Find out if we should check transport_socket_->IsConnected()
319 // as well. 317 // as well.
320 return completed_handshake_; 318 return completed_handshake_;
321 } 319 }
322 320
323 bool SSLServerSocketOpenSSL::IsConnectedAndIdle() const { 321 bool SSLServerSocketImpl::IsConnectedAndIdle() const {
324 return completed_handshake_ && transport_socket_->IsConnectedAndIdle(); 322 return completed_handshake_ && transport_socket_->IsConnectedAndIdle();
325 } 323 }
326 324
327 int SSLServerSocketOpenSSL::GetPeerAddress(IPEndPoint* address) const { 325 int SSLServerSocketImpl::GetPeerAddress(IPEndPoint* address) const {
328 if (!IsConnected()) 326 if (!IsConnected())
329 return ERR_SOCKET_NOT_CONNECTED; 327 return ERR_SOCKET_NOT_CONNECTED;
330 return transport_socket_->GetPeerAddress(address); 328 return transport_socket_->GetPeerAddress(address);
331 } 329 }
332 330
333 int SSLServerSocketOpenSSL::GetLocalAddress(IPEndPoint* address) const { 331 int SSLServerSocketImpl::GetLocalAddress(IPEndPoint* address) const {
334 if (!IsConnected()) 332 if (!IsConnected())
335 return ERR_SOCKET_NOT_CONNECTED; 333 return ERR_SOCKET_NOT_CONNECTED;
336 return transport_socket_->GetLocalAddress(address); 334 return transport_socket_->GetLocalAddress(address);
337 } 335 }
338 336
339 const BoundNetLog& SSLServerSocketOpenSSL::NetLog() const { 337 const BoundNetLog& SSLServerSocketImpl::NetLog() const {
340 return net_log_; 338 return net_log_;
341 } 339 }
342 340
343 void SSLServerSocketOpenSSL::SetSubresourceSpeculation() { 341 void SSLServerSocketImpl::SetSubresourceSpeculation() {
344 transport_socket_->SetSubresourceSpeculation(); 342 transport_socket_->SetSubresourceSpeculation();
345 } 343 }
346 344
347 void SSLServerSocketOpenSSL::SetOmniboxSpeculation() { 345 void SSLServerSocketImpl::SetOmniboxSpeculation() {
348 transport_socket_->SetOmniboxSpeculation(); 346 transport_socket_->SetOmniboxSpeculation();
349 } 347 }
350 348
351 bool SSLServerSocketOpenSSL::WasEverUsed() const { 349 bool SSLServerSocketImpl::WasEverUsed() const {
352 return transport_socket_->WasEverUsed(); 350 return transport_socket_->WasEverUsed();
353 } 351 }
354 352
355 bool SSLServerSocketOpenSSL::WasNpnNegotiated() const { 353 bool SSLServerSocketImpl::WasNpnNegotiated() const {
356 NOTIMPLEMENTED(); 354 NOTIMPLEMENTED();
357 return false; 355 return false;
358 } 356 }
359 357
360 NextProto SSLServerSocketOpenSSL::GetNegotiatedProtocol() const { 358 NextProto SSLServerSocketImpl::GetNegotiatedProtocol() const {
361 // NPN is not supported by this class. 359 // NPN is not supported by this class.
362 return kProtoUnknown; 360 return kProtoUnknown;
363 } 361 }
364 362
365 bool SSLServerSocketOpenSSL::GetSSLInfo(SSLInfo* ssl_info) { 363 bool SSLServerSocketImpl::GetSSLInfo(SSLInfo* ssl_info) {
366 ssl_info->Reset(); 364 ssl_info->Reset();
367 if (!completed_handshake_) 365 if (!completed_handshake_)
368 return false; 366 return false;
369 367
370 ssl_info->cert = client_cert_; 368 ssl_info->cert = client_cert_;
371 369
372 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); 370 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_);
373 CHECK(cipher); 371 CHECK(cipher);
374 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); 372 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL);
375 373
376 SSLConnectionStatusSetCipherSuite( 374 SSLConnectionStatusSetCipherSuite(
377 static_cast<uint16_t>(SSL_CIPHER_get_id(cipher)), 375 static_cast<uint16_t>(SSL_CIPHER_get_id(cipher)),
378 &ssl_info->connection_status); 376 &ssl_info->connection_status);
379 SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_), 377 SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_),
380 &ssl_info->connection_status); 378 &ssl_info->connection_status);
381 379
382 if (!SSL_get_secure_renegotiation_support(ssl_)) 380 if (!SSL_get_secure_renegotiation_support(ssl_))
383 ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION; 381 ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
384 382
385 ssl_info->handshake_type = SSL_session_reused(ssl_) 383 ssl_info->handshake_type = SSL_session_reused(ssl_)
386 ? SSLInfo::HANDSHAKE_RESUME 384 ? SSLInfo::HANDSHAKE_RESUME
387 : SSLInfo::HANDSHAKE_FULL; 385 : SSLInfo::HANDSHAKE_FULL;
388 386
389 return true; 387 return true;
390 } 388 }
391 389
392 void SSLServerSocketOpenSSL::GetConnectionAttempts( 390 void SSLServerSocketImpl::GetConnectionAttempts(ConnectionAttempts* out) const {
393 ConnectionAttempts* out) const {
394 out->clear(); 391 out->clear();
395 } 392 }
396 393
397 int64_t SSLServerSocketOpenSSL::GetTotalReceivedBytes() const { 394 int64_t SSLServerSocketImpl::GetTotalReceivedBytes() const {
398 return transport_socket_->GetTotalReceivedBytes(); 395 return transport_socket_->GetTotalReceivedBytes();
399 } 396 }
400 397
401 void SSLServerSocketOpenSSL::OnSendComplete(int result) { 398 void SSLServerSocketImpl::OnSendComplete(int result) {
402 if (next_handshake_state_ == STATE_HANDSHAKE) { 399 if (next_handshake_state_ == STATE_HANDSHAKE) {
403 // In handshake phase. 400 // In handshake phase.
404 OnHandshakeIOComplete(result); 401 OnHandshakeIOComplete(result);
405 return; 402 return;
406 } 403 }
407 404
408 // TODO(byungchul): This state machine is not correct. Copy the state machine 405 // TODO(byungchul): This state machine is not correct. Copy the state machine
409 // of SSLClientSocketOpenSSL::OnSendComplete() which handles it better. 406 // of SSLClientSocketImpl::OnSendComplete() which handles it better.
410 if (!completed_handshake_) 407 if (!completed_handshake_)
411 return; 408 return;
412 409
413 if (user_write_buf_) { 410 if (user_write_buf_) {
414 int rv = DoWriteLoop(result); 411 int rv = DoWriteLoop(result);
415 if (rv != ERR_IO_PENDING) 412 if (rv != ERR_IO_PENDING)
416 DoWriteCallback(rv); 413 DoWriteCallback(rv);
417 } else { 414 } else {
418 // Ensure that any queued ciphertext is flushed. 415 // Ensure that any queued ciphertext is flushed.
419 DoTransportIO(); 416 DoTransportIO();
420 } 417 }
421 } 418 }
422 419
423 void SSLServerSocketOpenSSL::OnRecvComplete(int result) { 420 void SSLServerSocketImpl::OnRecvComplete(int result) {
424 if (next_handshake_state_ == STATE_HANDSHAKE) { 421 if (next_handshake_state_ == STATE_HANDSHAKE) {
425 // In handshake phase. 422 // In handshake phase.
426 OnHandshakeIOComplete(result); 423 OnHandshakeIOComplete(result);
427 return; 424 return;
428 } 425 }
429 426
430 // Network layer received some data, check if client requested to read 427 // Network layer received some data, check if client requested to read
431 // decrypted data. 428 // decrypted data.
432 if (!user_read_buf_ || !completed_handshake_) 429 if (!user_read_buf_ || !completed_handshake_)
433 return; 430 return;
434 431
435 int rv = DoReadLoop(result); 432 int rv = DoReadLoop(result);
436 if (rv != ERR_IO_PENDING) 433 if (rv != ERR_IO_PENDING)
437 DoReadCallback(rv); 434 DoReadCallback(rv);
438 } 435 }
439 436
440 void SSLServerSocketOpenSSL::OnHandshakeIOComplete(int result) { 437 void SSLServerSocketImpl::OnHandshakeIOComplete(int result) {
441 int rv = DoHandshakeLoop(result); 438 int rv = DoHandshakeLoop(result);
442 if (rv == ERR_IO_PENDING) 439 if (rv == ERR_IO_PENDING)
443 return; 440 return;
444 441
445 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv); 442 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_SERVER_HANDSHAKE, rv);
446 if (!user_handshake_callback_.is_null()) 443 if (!user_handshake_callback_.is_null())
447 DoHandshakeCallback(rv); 444 DoHandshakeCallback(rv);
448 } 445 }
449 446
450 // Return 0 for EOF, 447 // Return 0 for EOF,
451 // > 0 for bytes transferred immediately, 448 // > 0 for bytes transferred immediately,
452 // < 0 for error (or the non-error ERR_IO_PENDING). 449 // < 0 for error (or the non-error ERR_IO_PENDING).
453 int SSLServerSocketOpenSSL::BufferSend() { 450 int SSLServerSocketImpl::BufferSend() {
454 if (transport_send_busy_) 451 if (transport_send_busy_)
455 return ERR_IO_PENDING; 452 return ERR_IO_PENDING;
456 453
457 if (!send_buffer_) { 454 if (!send_buffer_) {
458 // Get a fresh send buffer out of the send BIO. 455 // Get a fresh send buffer out of the send BIO.
459 size_t max_read = BIO_pending(transport_bio_); 456 size_t max_read = BIO_pending(transport_bio_);
460 if (!max_read) 457 if (!max_read)
461 return 0; // Nothing pending in the OpenSSL write BIO. 458 return 0; // Nothing pending in the OpenSSL write BIO.
462 send_buffer_ = new DrainableIOBuffer(new IOBuffer(max_read), max_read); 459 send_buffer_ = new DrainableIOBuffer(new IOBuffer(max_read), max_read);
463 int read_bytes = BIO_read(transport_bio_, send_buffer_->data(), max_read); 460 int read_bytes = BIO_read(transport_bio_, send_buffer_->data(), max_read);
464 DCHECK_GT(read_bytes, 0); 461 DCHECK_GT(read_bytes, 0);
465 CHECK_EQ(static_cast<int>(max_read), read_bytes); 462 CHECK_EQ(static_cast<int>(max_read), read_bytes);
466 } 463 }
467 464
468 int rv = transport_socket_->Write( 465 int rv = transport_socket_->Write(
469 send_buffer_.get(), send_buffer_->BytesRemaining(), 466 send_buffer_.get(), send_buffer_->BytesRemaining(),
470 base::Bind(&SSLServerSocketOpenSSL::BufferSendComplete, 467 base::Bind(&SSLServerSocketImpl::BufferSendComplete,
471 base::Unretained(this))); 468 base::Unretained(this)));
472 if (rv == ERR_IO_PENDING) { 469 if (rv == ERR_IO_PENDING) {
473 transport_send_busy_ = true; 470 transport_send_busy_ = true;
474 } else { 471 } else {
475 TransportWriteComplete(rv); 472 TransportWriteComplete(rv);
476 } 473 }
477 return rv; 474 return rv;
478 } 475 }
479 476
480 void SSLServerSocketOpenSSL::BufferSendComplete(int result) { 477 void SSLServerSocketImpl::BufferSendComplete(int result) {
481 transport_send_busy_ = false; 478 transport_send_busy_ = false;
482 TransportWriteComplete(result); 479 TransportWriteComplete(result);
483 OnSendComplete(result); 480 OnSendComplete(result);
484 } 481 }
485 482
486 void SSLServerSocketOpenSSL::TransportWriteComplete(int result) { 483 void SSLServerSocketImpl::TransportWriteComplete(int result) {
487 DCHECK(ERR_IO_PENDING != result); 484 DCHECK(ERR_IO_PENDING != result);
488 if (result < 0) { 485 if (result < 0) {
489 // Got a socket write error; close the BIO to indicate this upward. 486 // Got a socket write error; close the BIO to indicate this upward.
490 // 487 //
491 // TODO(davidben): The value of |result| gets lost. Feed the error back into 488 // TODO(davidben): The value of |result| gets lost. Feed the error back into
492 // the BIO so it gets (re-)detected in OnSendComplete. Perhaps with 489 // the BIO so it gets (re-)detected in OnSendComplete. Perhaps with
493 // BIO_set_callback. 490 // BIO_set_callback.
494 DVLOG(1) << "TransportWriteComplete error " << result; 491 DVLOG(1) << "TransportWriteComplete error " << result;
495 (void)BIO_shutdown_wr(SSL_get_wbio(ssl_)); 492 (void)BIO_shutdown_wr(SSL_get_wbio(ssl_));
496 493
497 // Match the fix for http://crbug.com/249848 in NSS by erroring future reads 494 // Match the fix for http://crbug.com/249848 in NSS by erroring future reads
498 // from the socket after a write error. 495 // from the socket after a write error.
499 // 496 //
500 // TODO(davidben): Avoid having read and write ends interact this way. 497 // TODO(davidben): Avoid having read and write ends interact this way.
501 transport_write_error_ = result; 498 transport_write_error_ = result;
502 (void)BIO_shutdown_wr(transport_bio_); 499 (void)BIO_shutdown_wr(transport_bio_);
503 send_buffer_ = NULL; 500 send_buffer_ = NULL;
504 } else { 501 } else {
505 DCHECK(send_buffer_); 502 DCHECK(send_buffer_);
506 send_buffer_->DidConsume(result); 503 send_buffer_->DidConsume(result);
507 DCHECK_GE(send_buffer_->BytesRemaining(), 0); 504 DCHECK_GE(send_buffer_->BytesRemaining(), 0);
508 if (send_buffer_->BytesRemaining() <= 0) 505 if (send_buffer_->BytesRemaining() <= 0)
509 send_buffer_ = NULL; 506 send_buffer_ = NULL;
510 } 507 }
511 } 508 }
512 509
513 int SSLServerSocketOpenSSL::BufferRecv() { 510 int SSLServerSocketImpl::BufferRecv() {
514 if (transport_recv_busy_) 511 if (transport_recv_busy_)
515 return ERR_IO_PENDING; 512 return ERR_IO_PENDING;
516 513
517 // Determine how much was requested from |transport_bio_| that was not 514 // Determine how much was requested from |transport_bio_| that was not
518 // actually available. 515 // actually available.
519 size_t requested = BIO_ctrl_get_read_request(transport_bio_); 516 size_t requested = BIO_ctrl_get_read_request(transport_bio_);
520 if (requested == 0) { 517 if (requested == 0) {
521 // This is not a perfect match of error codes, as no operation is 518 // This is not a perfect match of error codes, as no operation is
522 // actually pending. However, returning 0 would be interpreted as 519 // actually pending. However, returning 0 would be interpreted as
523 // a possible sign of EOF, which is also an inappropriate match. 520 // a possible sign of EOF, which is also an inappropriate match.
524 return ERR_IO_PENDING; 521 return ERR_IO_PENDING;
525 } 522 }
526 523
527 // Known Issue: While only reading |requested| data is the more correct 524 // Known Issue: While only reading |requested| data is the more correct
528 // implementation, it has the downside of resulting in frequent reads: 525 // implementation, it has the downside of resulting in frequent reads:
529 // One read for the SSL record header (~5 bytes) and one read for the SSL 526 // One read for the SSL record header (~5 bytes) and one read for the SSL
530 // record body. Rather than issuing these reads to the underlying socket 527 // record body. Rather than issuing these reads to the underlying socket
531 // (and constantly allocating new IOBuffers), a single Read() request to 528 // (and constantly allocating new IOBuffers), a single Read() request to
532 // fill |transport_bio_| is issued. As long as an SSL client socket cannot 529 // fill |transport_bio_| is issued. As long as an SSL client socket cannot
533 // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL 530 // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL
534 // traffic, this over-subscribed Read()ing will not cause issues. 531 // traffic, this over-subscribed Read()ing will not cause issues.
535 size_t max_write = BIO_ctrl_get_write_guarantee(transport_bio_); 532 size_t max_write = BIO_ctrl_get_write_guarantee(transport_bio_);
536 if (!max_write) 533 if (!max_write)
537 return ERR_IO_PENDING; 534 return ERR_IO_PENDING;
538 535
539 recv_buffer_ = new IOBuffer(max_write); 536 recv_buffer_ = new IOBuffer(max_write);
540 int rv = transport_socket_->Read( 537 int rv = transport_socket_->Read(
541 recv_buffer_.get(), max_write, 538 recv_buffer_.get(), max_write,
542 base::Bind(&SSLServerSocketOpenSSL::BufferRecvComplete, 539 base::Bind(&SSLServerSocketImpl::BufferRecvComplete,
543 base::Unretained(this))); 540 base::Unretained(this)));
544 if (rv == ERR_IO_PENDING) { 541 if (rv == ERR_IO_PENDING) {
545 transport_recv_busy_ = true; 542 transport_recv_busy_ = true;
546 } else { 543 } else {
547 rv = TransportReadComplete(rv); 544 rv = TransportReadComplete(rv);
548 } 545 }
549 return rv; 546 return rv;
550 } 547 }
551 548
552 void SSLServerSocketOpenSSL::BufferRecvComplete(int result) { 549 void SSLServerSocketImpl::BufferRecvComplete(int result) {
553 result = TransportReadComplete(result); 550 result = TransportReadComplete(result);
554 OnRecvComplete(result); 551 OnRecvComplete(result);
555 } 552 }
556 553
557 int SSLServerSocketOpenSSL::TransportReadComplete(int result) { 554 int SSLServerSocketImpl::TransportReadComplete(int result) {
558 DCHECK(ERR_IO_PENDING != result); 555 DCHECK(ERR_IO_PENDING != result);
559 if (result <= 0) { 556 if (result <= 0) {
560 DVLOG(1) << "TransportReadComplete result " << result; 557 DVLOG(1) << "TransportReadComplete result " << result;
561 // Received 0 (end of file) or an error. Either way, bubble it up to the 558 // Received 0 (end of file) or an error. Either way, bubble it up to the
562 // SSL layer via the BIO. TODO(joth): consider stashing the error code, to 559 // SSL layer via the BIO. TODO(joth): consider stashing the error code, to
563 // relay up to the SSL socket client (i.e. via DoReadCallback). 560 // relay up to the SSL socket client (i.e. via DoReadCallback).
564 if (result == 0) 561 if (result == 0)
565 transport_recv_eof_ = true; 562 transport_recv_eof_ = true;
566 (void)BIO_shutdown_wr(transport_bio_); 563 (void)BIO_shutdown_wr(transport_bio_);
567 } else if (transport_write_error_ < 0) { 564 } else if (transport_write_error_ < 0) {
568 // Mirror transport write errors as read failures; transport_bio_ has been 565 // Mirror transport write errors as read failures; transport_bio_ has been
569 // shut down by TransportWriteComplete, so the BIO_write will fail, failing 566 // shut down by TransportWriteComplete, so the BIO_write will fail, failing
570 // the CHECK. http://crbug.com/335557. 567 // the CHECK. http://crbug.com/335557.
571 result = transport_write_error_; 568 result = transport_write_error_;
572 } else { 569 } else {
573 DCHECK(recv_buffer_); 570 DCHECK(recv_buffer_);
574 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); 571 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result);
575 // A write into a memory BIO should always succeed. 572 // A write into a memory BIO should always succeed.
576 DCHECK_EQ(result, ret); 573 DCHECK_EQ(result, ret);
577 } 574 }
578 recv_buffer_ = NULL; 575 recv_buffer_ = NULL;
579 transport_recv_busy_ = false; 576 transport_recv_busy_ = false;
580 return result; 577 return result;
581 } 578 }
582 579
583 // Do as much network I/O as possible between the buffer and the 580 // Do as much network I/O as possible between the buffer and the
584 // transport socket. Return true if some I/O performed, false 581 // transport socket. Return true if some I/O performed, false
585 // otherwise (error or ERR_IO_PENDING). 582 // otherwise (error or ERR_IO_PENDING).
586 bool SSLServerSocketOpenSSL::DoTransportIO() { 583 bool SSLServerSocketImpl::DoTransportIO() {
587 bool network_moved = false; 584 bool network_moved = false;
588 int rv; 585 int rv;
589 // Read and write as much data as possible. The loop is necessary because 586 // Read and write as much data as possible. The loop is necessary because
590 // Write() may return synchronously. 587 // Write() may return synchronously.
591 do { 588 do {
592 rv = BufferSend(); 589 rv = BufferSend();
593 if (rv != ERR_IO_PENDING && rv != 0) 590 if (rv != ERR_IO_PENDING && rv != 0)
594 network_moved = true; 591 network_moved = true;
595 } while (rv > 0); 592 } while (rv > 0);
596 if (!transport_recv_eof_ && BufferRecv() != ERR_IO_PENDING) 593 if (!transport_recv_eof_ && BufferRecv() != ERR_IO_PENDING)
597 network_moved = true; 594 network_moved = true;
598 return network_moved; 595 return network_moved;
599 } 596 }
600 597
601 int SSLServerSocketOpenSSL::DoPayloadRead() { 598 int SSLServerSocketImpl::DoPayloadRead() {
602 DCHECK(user_read_buf_); 599 DCHECK(user_read_buf_);
603 DCHECK_GT(user_read_buf_len_, 0); 600 DCHECK_GT(user_read_buf_len_, 0);
604 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 601 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
605 int rv = SSL_read(ssl_, user_read_buf_->data(), user_read_buf_len_); 602 int rv = SSL_read(ssl_, user_read_buf_->data(), user_read_buf_len_);
606 if (rv >= 0) 603 if (rv >= 0)
607 return rv; 604 return rv;
608 int ssl_error = SSL_get_error(ssl_, rv); 605 int ssl_error = SSL_get_error(ssl_, rv);
609 OpenSSLErrorInfo error_info; 606 OpenSSLErrorInfo error_info;
610 int net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, 607 int net_error =
611 &error_info); 608 MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
612 if (net_error != ERR_IO_PENDING) { 609 if (net_error != ERR_IO_PENDING) {
613 net_log_.AddEvent( 610 net_log_.AddEvent(
614 NetLog::TYPE_SSL_READ_ERROR, 611 NetLog::TYPE_SSL_READ_ERROR,
615 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); 612 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
616 } 613 }
617 return net_error; 614 return net_error;
618 } 615 }
619 616
620 int SSLServerSocketOpenSSL::DoPayloadWrite() { 617 int SSLServerSocketImpl::DoPayloadWrite() {
621 DCHECK(user_write_buf_); 618 DCHECK(user_write_buf_);
622 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 619 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
623 int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_); 620 int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_);
624 if (rv >= 0) 621 if (rv >= 0)
625 return rv; 622 return rv;
626 int ssl_error = SSL_get_error(ssl_, rv); 623 int ssl_error = SSL_get_error(ssl_, rv);
627 OpenSSLErrorInfo error_info; 624 OpenSSLErrorInfo error_info;
628 int net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, 625 int net_error =
629 &error_info); 626 MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
630 if (net_error != ERR_IO_PENDING) { 627 if (net_error != ERR_IO_PENDING) {
631 net_log_.AddEvent( 628 net_log_.AddEvent(
632 NetLog::TYPE_SSL_WRITE_ERROR, 629 NetLog::TYPE_SSL_WRITE_ERROR,
633 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); 630 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
634 } 631 }
635 return net_error; 632 return net_error;
636 } 633 }
637 634
638 int SSLServerSocketOpenSSL::DoHandshakeLoop(int last_io_result) { 635 int SSLServerSocketImpl::DoHandshakeLoop(int last_io_result) {
639 int rv = last_io_result; 636 int rv = last_io_result;
640 do { 637 do {
641 // Default to STATE_NONE for next state. 638 // Default to STATE_NONE for next state.
642 // (This is a quirk carried over from the windows 639 // (This is a quirk carried over from the windows
643 // implementation. It makes reading the logs a bit harder.) 640 // implementation. It makes reading the logs a bit harder.)
644 // State handlers can and often do call GotoState just 641 // State handlers can and often do call GotoState just
645 // to stay in the current state. 642 // to stay in the current state.
646 State state = next_handshake_state_; 643 State state = next_handshake_state_;
647 GotoState(STATE_NONE); 644 GotoState(STATE_NONE);
648 switch (state) { 645 switch (state) {
(...skipping 12 matching lines...) Expand all
661 if (network_moved && next_handshake_state_ == STATE_HANDSHAKE) { 658 if (network_moved && next_handshake_state_ == STATE_HANDSHAKE) {
662 // In general we exit the loop if rv is ERR_IO_PENDING. In this 659 // In general we exit the loop if rv is ERR_IO_PENDING. In this
663 // special case we keep looping even if rv is ERR_IO_PENDING because 660 // special case we keep looping even if rv is ERR_IO_PENDING because
664 // the transport IO may allow DoHandshake to make progress. 661 // the transport IO may allow DoHandshake to make progress.
665 rv = OK; // This causes us to stay in the loop. 662 rv = OK; // This causes us to stay in the loop.
666 } 663 }
667 } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE); 664 } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE);
668 return rv; 665 return rv;
669 } 666 }
670 667
671 int SSLServerSocketOpenSSL::DoReadLoop(int result) { 668 int SSLServerSocketImpl::DoReadLoop(int result) {
672 DCHECK(completed_handshake_); 669 DCHECK(completed_handshake_);
673 DCHECK(next_handshake_state_ == STATE_NONE); 670 DCHECK(next_handshake_state_ == STATE_NONE);
674 671
675 if (result < 0) 672 if (result < 0)
676 return result; 673 return result;
677 674
678 bool network_moved; 675 bool network_moved;
679 int rv; 676 int rv;
680 do { 677 do {
681 rv = DoPayloadRead(); 678 rv = DoPayloadRead();
682 network_moved = DoTransportIO(); 679 network_moved = DoTransportIO();
683 } while (rv == ERR_IO_PENDING && network_moved); 680 } while (rv == ERR_IO_PENDING && network_moved);
684 return rv; 681 return rv;
685 } 682 }
686 683
687 int SSLServerSocketOpenSSL::DoWriteLoop(int result) { 684 int SSLServerSocketImpl::DoWriteLoop(int result) {
688 DCHECK(completed_handshake_); 685 DCHECK(completed_handshake_);
689 DCHECK_EQ(next_handshake_state_, STATE_NONE); 686 DCHECK_EQ(next_handshake_state_, STATE_NONE);
690 687
691 if (result < 0) 688 if (result < 0)
692 return result; 689 return result;
693 690
694 bool network_moved; 691 bool network_moved;
695 int rv; 692 int rv;
696 do { 693 do {
697 rv = DoPayloadWrite(); 694 rv = DoPayloadWrite();
698 network_moved = DoTransportIO(); 695 network_moved = DoTransportIO();
699 } while (rv == ERR_IO_PENDING && network_moved); 696 } while (rv == ERR_IO_PENDING && network_moved);
700 return rv; 697 return rv;
701 } 698 }
702 699
703 int SSLServerSocketOpenSSL::DoHandshake() { 700 int SSLServerSocketImpl::DoHandshake() {
704 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 701 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
705 int net_error = OK; 702 int net_error = OK;
706 int rv = SSL_do_handshake(ssl_); 703 int rv = SSL_do_handshake(ssl_);
707 704
708 if (rv == 1) { 705 if (rv == 1) {
709 completed_handshake_ = true; 706 completed_handshake_ = true;
710 // The results of SSL_get_peer_certificate() must be explicitly freed. 707 // The results of SSL_get_peer_certificate() must be explicitly freed.
711 ScopedX509 cert(SSL_get_peer_certificate(ssl_)); 708 ScopedX509 cert(SSL_get_peer_certificate(ssl_));
712 if (cert) { 709 if (cert) {
713 // The caller does not take ownership of SSL_get_peer_cert_chain's 710 // The caller does not take ownership of SSL_get_peer_cert_chain's
(...skipping 12 matching lines...) Expand all
726 // net_errors assumes (correctly for client sockets, but erroneously for 723 // net_errors assumes (correctly for client sockets, but erroneously for
727 // server sockets) that peer cert verification failure can only occur if 724 // server sockets) that peer cert verification failure can only occur if
728 // the cert changed during a renego. crbug.com/570351 725 // the cert changed during a renego. crbug.com/570351
729 if (net_error == ERR_SSL_SERVER_CERT_CHANGED) 726 if (net_error == ERR_SSL_SERVER_CERT_CHANGED)
730 net_error = ERR_BAD_SSL_CLIENT_AUTH_CERT; 727 net_error = ERR_BAD_SSL_CLIENT_AUTH_CERT;
731 728
732 // If not done, stay in this state 729 // If not done, stay in this state
733 if (net_error == ERR_IO_PENDING) { 730 if (net_error == ERR_IO_PENDING) {
734 GotoState(STATE_HANDSHAKE); 731 GotoState(STATE_HANDSHAKE);
735 } else { 732 } else {
736 LOG(ERROR) << "handshake failed; returned " << rv 733 LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code "
737 << ", SSL error code " << ssl_error 734 << ssl_error << ", net_error " << net_error;
738 << ", net_error " << net_error;
739 net_log_.AddEvent( 735 net_log_.AddEvent(
740 NetLog::TYPE_SSL_HANDSHAKE_ERROR, 736 NetLog::TYPE_SSL_HANDSHAKE_ERROR,
741 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); 737 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
742 } 738 }
743 } 739 }
744 return net_error; 740 return net_error;
745 } 741 }
746 742
747 void SSLServerSocketOpenSSL::DoHandshakeCallback(int rv) { 743 void SSLServerSocketImpl::DoHandshakeCallback(int rv) {
748 DCHECK_NE(rv, ERR_IO_PENDING); 744 DCHECK_NE(rv, ERR_IO_PENDING);
749 base::ResetAndReturn(&user_handshake_callback_).Run(rv > OK ? OK : rv); 745 base::ResetAndReturn(&user_handshake_callback_).Run(rv > OK ? OK : rv);
750 } 746 }
751 747
752 void SSLServerSocketOpenSSL::DoReadCallback(int rv) { 748 void SSLServerSocketImpl::DoReadCallback(int rv) {
753 DCHECK(rv != ERR_IO_PENDING); 749 DCHECK(rv != ERR_IO_PENDING);
754 DCHECK(!user_read_callback_.is_null()); 750 DCHECK(!user_read_callback_.is_null());
755 751
756 user_read_buf_ = NULL; 752 user_read_buf_ = NULL;
757 user_read_buf_len_ = 0; 753 user_read_buf_len_ = 0;
758 base::ResetAndReturn(&user_read_callback_).Run(rv); 754 base::ResetAndReturn(&user_read_callback_).Run(rv);
759 } 755 }
760 756
761 void SSLServerSocketOpenSSL::DoWriteCallback(int rv) { 757 void SSLServerSocketImpl::DoWriteCallback(int rv) {
762 DCHECK(rv != ERR_IO_PENDING); 758 DCHECK(rv != ERR_IO_PENDING);
763 DCHECK(!user_write_callback_.is_null()); 759 DCHECK(!user_write_callback_.is_null());
764 760
765 user_write_buf_ = NULL; 761 user_write_buf_ = NULL;
766 user_write_buf_len_ = 0; 762 user_write_buf_len_ = 0;
767 base::ResetAndReturn(&user_write_callback_).Run(rv); 763 base::ResetAndReturn(&user_write_callback_).Run(rv);
768 } 764 }
769 765
770 int SSLServerSocketOpenSSL::Init() { 766 int SSLServerSocketImpl::Init() {
771 DCHECK(!transport_bio_); 767 DCHECK(!transport_bio_);
772 768
773 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 769 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
774 770
775 if (!ssl_) 771 if (!ssl_)
776 return ERR_UNEXPECTED; 772 return ERR_UNEXPECTED;
777 773
778 BIO* ssl_bio = NULL; 774 BIO* ssl_bio = NULL;
779 // 0 => use default buffer sizes. 775 // 0 => use default buffer sizes.
780 if (!BIO_new_bio_pair(&ssl_bio, 0, &transport_bio_, 0)) 776 if (!BIO_new_bio_pair(&ssl_bio, 0, &transport_bio_, 0))
781 return ERR_UNEXPECTED; 777 return ERR_UNEXPECTED;
782 DCHECK(ssl_bio); 778 DCHECK(ssl_bio);
783 DCHECK(transport_bio_); 779 DCHECK(transport_bio_);
784 780
785 SSL_set_bio(ssl_, ssl_bio, ssl_bio); 781 SSL_set_bio(ssl_, ssl_bio, ssl_bio);
786 782
787 return OK; 783 return OK;
788 } 784 }
789 785
790 // static 786 // static
791 int SSLServerSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx, 787 int SSLServerSocketImpl::CertVerifyCallback(X509_STORE_CTX* store_ctx,
792 void* arg) { 788 void* arg) {
793 ClientCertVerifier* verifier = reinterpret_cast<ClientCertVerifier*>(arg); 789 ClientCertVerifier* verifier = reinterpret_cast<ClientCertVerifier*>(arg);
794 // If a verifier was not supplied, all certificates are accepted. 790 // If a verifier was not supplied, all certificates are accepted.
795 if (!verifier) 791 if (!verifier)
796 return 1; 792 return 1;
797 STACK_OF(X509)* chain = store_ctx->untrusted; 793 STACK_OF(X509)* chain = store_ctx->untrusted;
798 scoped_refptr<X509Certificate> client_cert( 794 scoped_refptr<X509Certificate> client_cert(
799 CreateX509Certificate(nullptr, chain)); 795 CreateX509Certificate(nullptr, chain));
800 if (!client_cert.get()) { 796 if (!client_cert.get()) {
801 X509_STORE_CTX_set_error(store_ctx, X509_V_ERR_CERT_REJECTED); 797 X509_STORE_CTX_set_error(store_ctx, X509_V_ERR_CERT_REJECTED);
802 return 0; 798 return 0;
(...skipping 14 matching lines...) Expand all
817 return 1; 813 return 1;
818 } 814 }
819 815
820 } // namespace 816 } // namespace
821 817
822 std::unique_ptr<SSLServerContext> CreateSSLServerContext( 818 std::unique_ptr<SSLServerContext> CreateSSLServerContext(
823 X509Certificate* certificate, 819 X509Certificate* certificate,
824 const crypto::RSAPrivateKey& key, 820 const crypto::RSAPrivateKey& key,
825 const SSLServerConfig& ssl_server_config) { 821 const SSLServerConfig& ssl_server_config) {
826 return std::unique_ptr<SSLServerContext>( 822 return std::unique_ptr<SSLServerContext>(
827 new SSLServerContextOpenSSL(certificate, key, ssl_server_config)); 823 new SSLServerContextImpl(certificate, key, ssl_server_config));
828 } 824 }
829 825
830 SSLServerContextOpenSSL::SSLServerContextOpenSSL( 826 SSLServerContextImpl::SSLServerContextImpl(
831 X509Certificate* certificate, 827 X509Certificate* certificate,
832 const crypto::RSAPrivateKey& key, 828 const crypto::RSAPrivateKey& key,
833 const SSLServerConfig& ssl_server_config) 829 const SSLServerConfig& ssl_server_config)
834 : ssl_server_config_(ssl_server_config), 830 : ssl_server_config_(ssl_server_config),
835 cert_(certificate), 831 cert_(certificate),
836 key_(key.Copy()) { 832 key_(key.Copy()) {
837 CHECK(key_); 833 CHECK(key_);
838 crypto::EnsureOpenSSLInit(); 834 crypto::EnsureOpenSSLInit();
839 ssl_ctx_.reset(SSL_CTX_new(TLS_method())); 835 ssl_ctx_.reset(SSL_CTX_new(TLS_method()));
840 SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_SERVER); 836 SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_SERVER);
841 uint8_t session_ctx_id = 0; 837 uint8_t session_ctx_id = 0;
842 SSL_CTX_set_session_id_context(ssl_ctx_.get(), &session_ctx_id, 838 SSL_CTX_set_session_id_context(ssl_ctx_.get(), &session_ctx_id,
843 sizeof(session_ctx_id)); 839 sizeof(session_ctx_id));
844 840
845 int verify_mode = 0; 841 int verify_mode = 0;
846 switch (ssl_server_config_.client_cert_type) { 842 switch (ssl_server_config_.client_cert_type) {
847 case SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT: 843 case SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT:
848 verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; 844 verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
849 // Fall-through 845 // Fall-through
850 case SSLServerConfig::ClientCertType::OPTIONAL_CLIENT_CERT: 846 case SSLServerConfig::ClientCertType::OPTIONAL_CLIENT_CERT:
851 verify_mode |= SSL_VERIFY_PEER; 847 verify_mode |= SSL_VERIFY_PEER;
852 SSL_CTX_set_verify(ssl_ctx_.get(), verify_mode, nullptr); 848 SSL_CTX_set_verify(ssl_ctx_.get(), verify_mode, nullptr);
853 SSL_CTX_set_cert_verify_callback( 849 SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(),
854 ssl_ctx_.get(), SSLServerSocketOpenSSL::CertVerifyCallback, 850 SSLServerSocketImpl::CertVerifyCallback,
855 ssl_server_config_.client_cert_verifier); 851 ssl_server_config_.client_cert_verifier);
856 break; 852 break;
857 case SSLServerConfig::ClientCertType::NO_CLIENT_CERT: 853 case SSLServerConfig::ClientCertType::NO_CLIENT_CERT:
858 break; 854 break;
859 } 855 }
860 856
861 // Set certificate and private key. 857 // Set certificate and private key.
862 DCHECK(cert_->os_cert_handle()); 858 DCHECK(cert_->os_cert_handle());
863 #if defined(USE_OPENSSL_CERTS) 859 #if defined(USE_OPENSSL_CERTS)
864 CHECK(SSL_CTX_use_certificate(ssl_ctx_.get(), cert_->os_cert_handle())); 860 CHECK(SSL_CTX_use_certificate(ssl_ctx_.get(), cert_->os_cert_handle()));
865 #else 861 #else
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after
934 const uint8_t* name = reinterpret_cast<const uint8_t*>(authority.c_str()); 930 const uint8_t* name = reinterpret_cast<const uint8_t*>(authority.c_str());
935 const uint8_t* name_start = name; 931 const uint8_t* name_start = name;
936 ScopedX509_NAME subj(d2i_X509_NAME(nullptr, &name, authority.length())); 932 ScopedX509_NAME subj(d2i_X509_NAME(nullptr, &name, authority.length()));
937 CHECK(subj && name == name_start + authority.length()); 933 CHECK(subj && name == name_start + authority.length());
938 sk_X509_NAME_push(stack.get(), subj.release()); 934 sk_X509_NAME_push(stack.get(), subj.release());
939 } 935 }
940 SSL_CTX_set_client_CA_list(ssl_ctx_.get(), stack.release()); 936 SSL_CTX_set_client_CA_list(ssl_ctx_.get(), stack.release());
941 } 937 }
942 } 938 }
943 939
944 SSLServerContextOpenSSL::~SSLServerContextOpenSSL() {} 940 SSLServerContextImpl::~SSLServerContextImpl() {}
945 941
946 std::unique_ptr<SSLServerSocket> SSLServerContextOpenSSL::CreateSSLServerSocket( 942 std::unique_ptr<SSLServerSocket> SSLServerContextImpl::CreateSSLServerSocket(
947 std::unique_ptr<StreamSocket> socket) { 943 std::unique_ptr<StreamSocket> socket) {
948 SSL* ssl = SSL_new(ssl_ctx_.get()); 944 SSL* ssl = SSL_new(ssl_ctx_.get());
949 return std::unique_ptr<SSLServerSocket>( 945 return std::unique_ptr<SSLServerSocket>(
950 new SSLServerSocketOpenSSL(std::move(socket), ssl)); 946 new SSLServerSocketImpl(std::move(socket), ssl));
951 } 947 }
952 948
953 void EnableSSLServerSockets() { 949 void EnableSSLServerSockets() {
954 // No-op because CreateSSLServerSocket() calls crypto::EnsureOpenSSLInit(). 950 // No-op because CreateSSLServerSocket() calls crypto::EnsureOpenSSLInit().
955 } 951 }
956 952
957 } // namespace net 953 } // namespace net
OLDNEW
« no previous file with comments | « net/socket/ssl_server_socket_impl.h ('k') | net/socket/ssl_server_socket_openssl.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698