Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/socket/ssl_client_socket_impl.h" | 5 #include "net/socket/ssl_client_socket_impl.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <openssl/bio.h> | 8 #include <openssl/bio.h> |
| 9 #include <openssl/bytestring.h> | 9 #include <openssl/bytestring.h> |
| 10 #include <openssl/err.h> | 10 #include <openssl/err.h> |
| (...skipping 26 matching lines...) Expand all Loading... | |
| 37 #include "net/base/ip_address.h" | 37 #include "net/base/ip_address.h" |
| 38 #include "net/base/net_errors.h" | 38 #include "net/base/net_errors.h" |
| 39 #include "net/cert/cert_verifier.h" | 39 #include "net/cert/cert_verifier.h" |
| 40 #include "net/cert/ct_ev_whitelist.h" | 40 #include "net/cert/ct_ev_whitelist.h" |
| 41 #include "net/cert/ct_policy_enforcer.h" | 41 #include "net/cert/ct_policy_enforcer.h" |
| 42 #include "net/cert/ct_policy_status.h" | 42 #include "net/cert/ct_policy_status.h" |
| 43 #include "net/cert/ct_verifier.h" | 43 #include "net/cert/ct_verifier.h" |
| 44 #include "net/cert/x509_certificate_net_log_param.h" | 44 #include "net/cert/x509_certificate_net_log_param.h" |
| 45 #include "net/cert/x509_util_openssl.h" | 45 #include "net/cert/x509_util_openssl.h" |
| 46 #include "net/http/transport_security_state.h" | 46 #include "net/http/transport_security_state.h" |
| 47 #include "net/log/net_log_event_type.h" | |
| 47 #include "net/ssl/scoped_openssl_types.h" | 48 #include "net/ssl/scoped_openssl_types.h" |
| 48 #include "net/ssl/ssl_cert_request_info.h" | 49 #include "net/ssl/ssl_cert_request_info.h" |
| 49 #include "net/ssl/ssl_cipher_suite_names.h" | 50 #include "net/ssl/ssl_cipher_suite_names.h" |
| 50 #include "net/ssl/ssl_client_session_cache.h" | 51 #include "net/ssl/ssl_client_session_cache.h" |
| 51 #include "net/ssl/ssl_connection_status_flags.h" | 52 #include "net/ssl/ssl_connection_status_flags.h" |
| 52 #include "net/ssl/ssl_info.h" | 53 #include "net/ssl/ssl_info.h" |
| 53 #include "net/ssl/ssl_private_key.h" | 54 #include "net/ssl/ssl_private_key.h" |
| 54 #include "net/ssl/token_binding.h" | 55 #include "net/ssl/token_binding.h" |
| 55 | 56 |
| 56 #if !defined(OS_NACL) | 57 #if !defined(OS_NACL) |
| (...skipping 555 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 612 | 613 |
| 613 int SSLClientSocketImpl::Connect(const CompletionCallback& callback) { | 614 int SSLClientSocketImpl::Connect(const CompletionCallback& callback) { |
| 614 // Although StreamSocket does allow calling Connect() after Disconnect(), | 615 // Although StreamSocket does allow calling Connect() after Disconnect(), |
| 615 // this has never worked for layered sockets. CHECK to detect any consumers | 616 // this has never worked for layered sockets. CHECK to detect any consumers |
| 616 // reconnecting an SSL socket. | 617 // reconnecting an SSL socket. |
| 617 // | 618 // |
| 618 // TODO(davidben,mmenke): Remove this API feature. See | 619 // TODO(davidben,mmenke): Remove this API feature. See |
| 619 // https://crbug.com/499289. | 620 // https://crbug.com/499289. |
| 620 CHECK(!disconnected_); | 621 CHECK(!disconnected_); |
| 621 | 622 |
| 622 net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT); | 623 net_log_.BeginEvent(NetLogEventType::SSL_CONNECT); |
| 623 | 624 |
| 624 // Set up new ssl object. | 625 // Set up new ssl object. |
| 625 int rv = Init(); | 626 int rv = Init(); |
| 626 if (rv != OK) { | 627 if (rv != OK) { |
| 627 LogConnectEndEvent(rv); | 628 LogConnectEndEvent(rv); |
| 628 return rv; | 629 return rv; |
| 629 } | 630 } |
| 630 | 631 |
| 631 // Set SSL to client mode. Handshake happens in the loop below. | 632 // Set SSL to client mode. Handshake happens in the loop below. |
| 632 SSL_set_connect_state(ssl_); | 633 SSL_set_connect_state(ssl_); |
| (...skipping 528 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1161 net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); | 1162 net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); |
| 1162 if (net_error == ERR_IO_PENDING) { | 1163 if (net_error == ERR_IO_PENDING) { |
| 1163 // If not done, stay in this state | 1164 // If not done, stay in this state |
| 1164 next_handshake_state_ = STATE_HANDSHAKE; | 1165 next_handshake_state_ = STATE_HANDSHAKE; |
| 1165 return ERR_IO_PENDING; | 1166 return ERR_IO_PENDING; |
| 1166 } | 1167 } |
| 1167 | 1168 |
| 1168 LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code " | 1169 LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code " |
| 1169 << ssl_error << ", net_error " << net_error; | 1170 << ssl_error << ", net_error " << net_error; |
| 1170 net_log_.AddEvent( | 1171 net_log_.AddEvent( |
| 1171 NetLog::TYPE_SSL_HANDSHAKE_ERROR, | 1172 NetLogEventType::SSL_HANDSHAKE_ERROR, |
| 1172 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); | 1173 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); |
| 1173 } | 1174 } |
| 1174 | 1175 |
| 1175 next_handshake_state_ = STATE_HANDSHAKE_COMPLETE; | 1176 next_handshake_state_ = STATE_HANDSHAKE_COMPLETE; |
| 1176 return net_error; | 1177 return net_error; |
| 1177 } | 1178 } |
| 1178 | 1179 |
| 1179 int SSLClientSocketImpl::DoHandshakeComplete(int result) { | 1180 int SSLClientSocketImpl::DoHandshakeComplete(int result) { |
| 1180 if (result < 0) | 1181 if (result < 0) |
| 1181 return result; | 1182 return result; |
| (...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1244 | 1245 |
| 1245 // Verify the certificate. | 1246 // Verify the certificate. |
| 1246 UpdateServerCert(); | 1247 UpdateServerCert(); |
| 1247 next_handshake_state_ = STATE_VERIFY_CERT; | 1248 next_handshake_state_ = STATE_VERIFY_CERT; |
| 1248 return OK; | 1249 return OK; |
| 1249 } | 1250 } |
| 1250 | 1251 |
| 1251 int SSLClientSocketImpl::DoChannelIDLookup() { | 1252 int SSLClientSocketImpl::DoChannelIDLookup() { |
| 1252 NetLog::ParametersCallback callback = base::Bind( | 1253 NetLog::ParametersCallback callback = base::Bind( |
| 1253 &NetLogChannelIDLookupCallback, base::Unretained(channel_id_service_)); | 1254 &NetLogChannelIDLookupCallback, base::Unretained(channel_id_service_)); |
| 1254 net_log_.BeginEvent(NetLog::TYPE_SSL_GET_CHANNEL_ID, callback); | 1255 net_log_.BeginEvent(NetLogEventType::SSL_GET_CHANNEL_ID, callback); |
| 1255 next_handshake_state_ = STATE_CHANNEL_ID_LOOKUP_COMPLETE; | 1256 next_handshake_state_ = STATE_CHANNEL_ID_LOOKUP_COMPLETE; |
| 1256 return channel_id_service_->GetOrCreateChannelID( | 1257 return channel_id_service_->GetOrCreateChannelID( |
| 1257 host_and_port_.host(), &channel_id_key_, | 1258 host_and_port_.host(), &channel_id_key_, |
| 1258 base::Bind(&SSLClientSocketImpl::OnHandshakeIOComplete, | 1259 base::Bind(&SSLClientSocketImpl::OnHandshakeIOComplete, |
| 1259 base::Unretained(this)), | 1260 base::Unretained(this)), |
| 1260 &channel_id_request_); | 1261 &channel_id_request_); |
| 1261 } | 1262 } |
| 1262 | 1263 |
| 1263 int SSLClientSocketImpl::DoChannelIDLookupComplete(int result) { | 1264 int SSLClientSocketImpl::DoChannelIDLookupComplete(int result) { |
| 1264 net_log_.EndEvent(NetLog::TYPE_SSL_GET_CHANNEL_ID, | 1265 net_log_.EndEvent(NetLogEventType::SSL_GET_CHANNEL_ID, |
| 1265 base::Bind(&NetLogChannelIDLookupCompleteCallback, | 1266 base::Bind(&NetLogChannelIDLookupCompleteCallback, |
| 1266 channel_id_key_.get(), result)); | 1267 channel_id_key_.get(), result)); |
| 1267 if (result < 0) | 1268 if (result < 0) |
| 1268 return result; | 1269 return result; |
| 1269 | 1270 |
| 1270 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key | 1271 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key |
| 1271 // type. | 1272 // type. |
| 1272 DCHECK(channel_id_key_); | 1273 DCHECK(channel_id_key_); |
| 1273 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 1274 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 1274 int rv = SSL_set1_tls_channel_id(ssl_, channel_id_key_->key()); | 1275 int rv = SSL_set1_tls_channel_id(ssl_, channel_id_key_->key()); |
| (...skipping 114 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1389 CompletionCallback c = user_connect_callback_; | 1390 CompletionCallback c = user_connect_callback_; |
| 1390 user_connect_callback_.Reset(); | 1391 user_connect_callback_.Reset(); |
| 1391 c.Run(rv > OK ? OK : rv); | 1392 c.Run(rv > OK ? OK : rv); |
| 1392 } | 1393 } |
| 1393 } | 1394 } |
| 1394 | 1395 |
| 1395 void SSLClientSocketImpl::UpdateServerCert() { | 1396 void SSLClientSocketImpl::UpdateServerCert() { |
| 1396 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); | 1397 server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); |
| 1397 server_cert_ = server_cert_chain_->AsOSChain(); | 1398 server_cert_ = server_cert_chain_->AsOSChain(); |
| 1398 if (server_cert_.get()) { | 1399 if (server_cert_.get()) { |
| 1399 net_log_.AddEvent(NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, | 1400 net_log_.AddEvent(NetLogEventType::SSL_CERTIFICATES_RECEIVED, |
| 1400 base::Bind(&NetLogX509CertificateCallback, | 1401 base::Bind(&NetLogX509CertificateCallback, |
| 1401 base::Unretained(server_cert_.get()))); | 1402 base::Unretained(server_cert_.get()))); |
| 1402 } | 1403 } |
| 1403 } | 1404 } |
| 1404 | 1405 |
| 1405 void SSLClientSocketImpl::OnHandshakeIOComplete(int result) { | 1406 void SSLClientSocketImpl::OnHandshakeIOComplete(int result) { |
| 1406 int rv = DoHandshakeLoop(result); | 1407 int rv = DoHandshakeLoop(result); |
| 1407 if (rv != ERR_IO_PENDING) { | 1408 if (rv != ERR_IO_PENDING) { |
| 1408 LogConnectEndEvent(rv); | 1409 LogConnectEndEvent(rv); |
| 1409 DoConnectCallback(rv); | 1410 DoConnectCallback(rv); |
| (...skipping 106 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1516 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 1517 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 1517 | 1518 |
| 1518 DCHECK_LT(0, user_read_buf_len_); | 1519 DCHECK_LT(0, user_read_buf_len_); |
| 1519 DCHECK(user_read_buf_.get()); | 1520 DCHECK(user_read_buf_.get()); |
| 1520 | 1521 |
| 1521 int rv; | 1522 int rv; |
| 1522 if (pending_read_error_ != kNoPendingResult) { | 1523 if (pending_read_error_ != kNoPendingResult) { |
| 1523 rv = pending_read_error_; | 1524 rv = pending_read_error_; |
| 1524 pending_read_error_ = kNoPendingResult; | 1525 pending_read_error_ = kNoPendingResult; |
| 1525 if (rv == 0) { | 1526 if (rv == 0) { |
| 1526 net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, rv, | 1527 net_log_.AddByteTransferEvent(NetLogEventType::SSL_SOCKET_BYTES_RECEIVED, |
| 1527 user_read_buf_->data()); | 1528 rv, user_read_buf_->data()); |
| 1528 } else { | 1529 } else { |
| 1529 net_log_.AddEvent( | 1530 net_log_.AddEvent( |
| 1530 NetLog::TYPE_SSL_READ_ERROR, | 1531 NetLogEventType::SSL_READ_ERROR, |
| 1531 CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, | 1532 CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, |
| 1532 pending_read_error_info_)); | 1533 pending_read_error_info_)); |
| 1533 } | 1534 } |
| 1534 pending_read_ssl_error_ = SSL_ERROR_NONE; | 1535 pending_read_ssl_error_ = SSL_ERROR_NONE; |
| 1535 pending_read_error_info_ = OpenSSLErrorInfo(); | 1536 pending_read_error_info_ = OpenSSLErrorInfo(); |
| 1536 return rv; | 1537 return rv; |
| 1537 } | 1538 } |
| 1538 | 1539 |
| 1539 int total_bytes_read = 0; | 1540 int total_bytes_read = 0; |
| 1540 int ssl_ret; | 1541 int ssl_ret; |
| (...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1594 if (pending_read_error_ == ERR_IO_PENDING) | 1595 if (pending_read_error_ == ERR_IO_PENDING) |
| 1595 pending_read_error_ = kNoPendingResult; | 1596 pending_read_error_ = kNoPendingResult; |
| 1596 } else { | 1597 } else { |
| 1597 // No bytes were returned. Return the pending read error immediately. | 1598 // No bytes were returned. Return the pending read error immediately. |
| 1598 DCHECK_NE(kNoPendingResult, pending_read_error_); | 1599 DCHECK_NE(kNoPendingResult, pending_read_error_); |
| 1599 rv = pending_read_error_; | 1600 rv = pending_read_error_; |
| 1600 pending_read_error_ = kNoPendingResult; | 1601 pending_read_error_ = kNoPendingResult; |
| 1601 } | 1602 } |
| 1602 | 1603 |
| 1603 if (rv >= 0) { | 1604 if (rv >= 0) { |
| 1604 net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, rv, | 1605 net_log_.AddByteTransferEvent(NetLogEventType::SSL_SOCKET_BYTES_RECEIVED, |
| 1605 user_read_buf_->data()); | 1606 rv, user_read_buf_->data()); |
| 1606 } else if (rv != ERR_IO_PENDING) { | 1607 } else if (rv != ERR_IO_PENDING) { |
| 1607 net_log_.AddEvent( | 1608 net_log_.AddEvent( |
| 1608 NetLog::TYPE_SSL_READ_ERROR, | 1609 NetLogEventType::SSL_READ_ERROR, |
| 1609 CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, | 1610 CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, |
| 1610 pending_read_error_info_)); | 1611 pending_read_error_info_)); |
| 1611 pending_read_ssl_error_ = SSL_ERROR_NONE; | 1612 pending_read_ssl_error_ = SSL_ERROR_NONE; |
| 1612 pending_read_error_info_ = OpenSSLErrorInfo(); | 1613 pending_read_error_info_ = OpenSSLErrorInfo(); |
| 1613 } | 1614 } |
| 1614 return rv; | 1615 return rv; |
| 1615 } | 1616 } |
| 1616 | 1617 |
| 1617 int SSLClientSocketImpl::DoPayloadWrite() { | 1618 int SSLClientSocketImpl::DoPayloadWrite() { |
| 1618 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 1619 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 1619 int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_); | 1620 int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_); |
| 1620 | 1621 |
| 1621 if (rv >= 0) { | 1622 if (rv >= 0) { |
| 1622 net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv, | 1623 net_log_.AddByteTransferEvent(NetLogEventType::SSL_SOCKET_BYTES_SENT, rv, |
| 1623 user_write_buf_->data()); | 1624 user_write_buf_->data()); |
| 1624 return rv; | 1625 return rv; |
| 1625 } | 1626 } |
| 1626 | 1627 |
| 1627 int ssl_error = SSL_get_error(ssl_, rv); | 1628 int ssl_error = SSL_get_error(ssl_, rv); |
| 1628 if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) | 1629 if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) |
| 1629 return ERR_IO_PENDING; | 1630 return ERR_IO_PENDING; |
| 1630 OpenSSLErrorInfo error_info; | 1631 OpenSSLErrorInfo error_info; |
| 1631 int net_error = | 1632 int net_error = |
| 1632 MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); | 1633 MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); |
| 1633 | 1634 |
| 1634 if (net_error != ERR_IO_PENDING) { | 1635 if (net_error != ERR_IO_PENDING) { |
| 1635 net_log_.AddEvent( | 1636 net_log_.AddEvent( |
| 1636 NetLog::TYPE_SSL_WRITE_ERROR, | 1637 NetLogEventType::SSL_WRITE_ERROR, |
| 1637 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); | 1638 CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); |
| 1638 } | 1639 } |
| 1639 return net_error; | 1640 return net_error; |
| 1640 } | 1641 } |
| 1641 | 1642 |
| 1642 void SSLClientSocketImpl::PumpReadWriteEvents() { | 1643 void SSLClientSocketImpl::PumpReadWriteEvents() { |
| 1643 int rv_read = ERR_IO_PENDING; | 1644 int rv_read = ERR_IO_PENDING; |
| 1644 int rv_write = ERR_IO_PENDING; | 1645 int rv_write = ERR_IO_PENDING; |
| 1645 bool network_moved; | 1646 bool network_moved; |
| 1646 do { | 1647 do { |
| (...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1845 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED; | 1846 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED; |
| 1846 return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED; | 1847 return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED; |
| 1847 } | 1848 } |
| 1848 | 1849 |
| 1849 return OK; | 1850 return OK; |
| 1850 } | 1851 } |
| 1851 | 1852 |
| 1852 int SSLClientSocketImpl::ClientCertRequestCallback(SSL* ssl) { | 1853 int SSLClientSocketImpl::ClientCertRequestCallback(SSL* ssl) { |
| 1853 DCHECK(ssl == ssl_); | 1854 DCHECK(ssl == ssl_); |
| 1854 | 1855 |
| 1855 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); | 1856 net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_REQUESTED); |
| 1856 | 1857 |
| 1857 // Clear any currently configured certificates. | 1858 // Clear any currently configured certificates. |
| 1858 SSL_certs_clear(ssl_); | 1859 SSL_certs_clear(ssl_); |
| 1859 | 1860 |
| 1860 #if defined(OS_IOS) | 1861 #if defined(OS_IOS) |
| 1861 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). | 1862 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). |
| 1862 LOG(WARNING) << "Client auth is not supported"; | 1863 LOG(WARNING) << "Client auth is not supported"; |
| 1863 #else // !defined(OS_IOS) | 1864 #else // !defined(OS_IOS) |
| 1864 if (!ssl_config_.send_client_cert) { | 1865 if (!ssl_config_.send_client_cert) { |
| 1865 // First pass: we know that a client certificate is needed, but we do not | 1866 // First pass: we know that a client certificate is needed, but we do not |
| (...skipping 75 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1941 break; | 1942 break; |
| 1942 case SSLPrivateKey::Hash::MD5_SHA1: | 1943 case SSLPrivateKey::Hash::MD5_SHA1: |
| 1943 // MD5-SHA1 is not used in TLS 1.2. | 1944 // MD5-SHA1 is not used in TLS 1.2. |
| 1944 break; | 1945 break; |
| 1945 } | 1946 } |
| 1946 } | 1947 } |
| 1947 | 1948 |
| 1948 SSL_set_private_key_digest_prefs(ssl_, digests.data(), digests.size()); | 1949 SSL_set_private_key_digest_prefs(ssl_, digests.data(), digests.size()); |
| 1949 | 1950 |
| 1950 int cert_count = 1 + sk_X509_num(chain.get()); | 1951 int cert_count = 1 + sk_X509_num(chain.get()); |
| 1951 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1952 net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED, |
| 1952 NetLog::IntCallback("cert_count", cert_count)); | 1953 NetLog::IntCallback("cert_count", cert_count)); |
| 1953 return 1; | 1954 return 1; |
| 1954 } | 1955 } |
| 1955 #endif // defined(OS_IOS) | 1956 #endif // defined(OS_IOS) |
| 1956 | 1957 |
| 1957 // Send no client certificate. | 1958 // Send no client certificate. |
| 1958 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1959 net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED, |
| 1959 NetLog::IntCallback("cert_count", 0)); | 1960 NetLog::IntCallback("cert_count", 0)); |
| 1960 return 1; | 1961 return 1; |
| 1961 } | 1962 } |
| 1962 | 1963 |
| 1963 int SSLClientSocketImpl::CertVerifyCallback(X509_STORE_CTX* store_ctx) { | 1964 int SSLClientSocketImpl::CertVerifyCallback(X509_STORE_CTX* store_ctx) { |
| 1964 if (!completed_connect_) { | 1965 if (!completed_connect_) { |
| 1965 // If the first handshake hasn't completed then we accept any certificates | 1966 // If the first handshake hasn't completed then we accept any certificates |
| 1966 // because we verify after the handshake. | 1967 // because we verify after the handshake. |
| 1967 return 1; | 1968 return 1; |
| 1968 } | 1969 } |
| (...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 2183 DCHECK(signature_.empty()); | 2184 DCHECK(signature_.empty()); |
| 2184 DCHECK(ssl_config_.client_private_key); | 2185 DCHECK(ssl_config_.client_private_key); |
| 2185 | 2186 |
| 2186 SSLPrivateKey::Hash hash; | 2187 SSLPrivateKey::Hash hash; |
| 2187 if (!EVP_MDToPrivateKeyHash(md, &hash)) { | 2188 if (!EVP_MDToPrivateKeyHash(md, &hash)) { |
| 2188 OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED); | 2189 OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED); |
| 2189 return ssl_private_key_failure; | 2190 return ssl_private_key_failure; |
| 2190 } | 2191 } |
| 2191 | 2192 |
| 2192 net_log_.BeginEvent( | 2193 net_log_.BeginEvent( |
| 2193 NetLog::TYPE_SSL_PRIVATE_KEY_OPERATION, | 2194 NetLogEventType::SSL_PRIVATE_KEY_OP, |
| 2194 base::Bind(&NetLogPrivateKeyOperationCallback, | 2195 base::Bind(&NetLogPrivateKeyOperationCallback, |
| 2195 ssl_config_.client_private_key->GetType(), hash)); | 2196 ssl_config_.client_private_key->GetType(), hash)); |
| 2196 | 2197 |
| 2197 signature_result_ = ERR_IO_PENDING; | 2198 signature_result_ = ERR_IO_PENDING; |
| 2198 ssl_config_.client_private_key->SignDigest( | 2199 ssl_config_.client_private_key->SignDigest( |
| 2199 hash, base::StringPiece(reinterpret_cast<const char*>(in), in_len), | 2200 hash, base::StringPiece(reinterpret_cast<const char*>(in), in_len), |
| 2200 base::Bind(&SSLClientSocketImpl::OnPrivateKeyComplete, | 2201 base::Bind(&SSLClientSocketImpl::OnPrivateKeyComplete, |
| 2201 weak_factory_.GetWeakPtr())); | 2202 weak_factory_.GetWeakPtr())); |
| 2202 return ssl_private_key_retry; | 2203 return ssl_private_key_retry; |
| 2203 } | 2204 } |
| (...skipping 21 matching lines...) Expand all Loading... | |
| 2225 return ssl_private_key_success; | 2226 return ssl_private_key_success; |
| 2226 } | 2227 } |
| 2227 | 2228 |
| 2228 void SSLClientSocketImpl::OnPrivateKeyComplete( | 2229 void SSLClientSocketImpl::OnPrivateKeyComplete( |
| 2229 Error error, | 2230 Error error, |
| 2230 const std::vector<uint8_t>& signature) { | 2231 const std::vector<uint8_t>& signature) { |
| 2231 DCHECK_EQ(ERR_IO_PENDING, signature_result_); | 2232 DCHECK_EQ(ERR_IO_PENDING, signature_result_); |
| 2232 DCHECK(signature_.empty()); | 2233 DCHECK(signature_.empty()); |
| 2233 DCHECK(ssl_config_.client_private_key); | 2234 DCHECK(ssl_config_.client_private_key); |
| 2234 | 2235 |
| 2235 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_PRIVATE_KEY_OPERATION, | 2236 net_log_.EndEventWithNetErrorCode(NetLogEventType::SSL_PRIVATE_KEY_OP, |
|
eroman
2016/09/06 19:32:20
Same question as earlier.
This name change is fine
mikecirone
2016/09/07 21:35:41
Done.
| |
| 2236 error); | 2237 error); |
| 2237 | 2238 |
| 2238 signature_result_ = error; | 2239 signature_result_ = error; |
| 2239 if (signature_result_ == OK) | 2240 if (signature_result_ == OK) |
| 2240 signature_ = signature; | 2241 signature_ = signature; |
| 2241 | 2242 |
| 2242 if (next_handshake_state_ == STATE_HANDSHAKE) { | 2243 if (next_handshake_state_ == STATE_HANDSHAKE) { |
| 2243 OnHandshakeIOComplete(signature_result_); | 2244 OnHandshakeIOComplete(signature_result_); |
| 2244 return; | 2245 return; |
| 2245 } | 2246 } |
| (...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 2323 return 1; | 2324 return 1; |
| 2324 } | 2325 } |
| 2325 } | 2326 } |
| 2326 | 2327 |
| 2327 *out_alert_value = SSL_AD_ILLEGAL_PARAMETER; | 2328 *out_alert_value = SSL_AD_ILLEGAL_PARAMETER; |
| 2328 return 0; | 2329 return 0; |
| 2329 } | 2330 } |
| 2330 | 2331 |
| 2331 void SSLClientSocketImpl::LogConnectEndEvent(int rv) { | 2332 void SSLClientSocketImpl::LogConnectEndEvent(int rv) { |
| 2332 if (rv != OK) { | 2333 if (rv != OK) { |
| 2333 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); | 2334 net_log_.EndEventWithNetErrorCode(NetLogEventType::SSL_CONNECT, rv); |
| 2334 return; | 2335 return; |
| 2335 } | 2336 } |
| 2336 | 2337 |
| 2337 net_log_.EndEvent(NetLog::TYPE_SSL_CONNECT, | 2338 net_log_.EndEvent(NetLogEventType::SSL_CONNECT, |
| 2338 base::Bind(&NetLogSSLInfoCallback, base::Unretained(this))); | 2339 base::Bind(&NetLogSSLInfoCallback, base::Unretained(this))); |
| 2339 } | 2340 } |
| 2340 | 2341 |
| 2341 void SSLClientSocketImpl::RecordNegotiationExtension() const { | 2342 void SSLClientSocketImpl::RecordNegotiationExtension() const { |
| 2342 if (negotiation_extension_ == kExtensionUnknown) | 2343 if (negotiation_extension_ == kExtensionUnknown) |
| 2343 return; | 2344 return; |
| 2344 if (npn_status_ == kNextProtoUnsupported) | 2345 if (npn_status_ == kNextProtoUnsupported) |
| 2345 return; | 2346 return; |
| 2346 base::HistogramBase::Sample sample = | 2347 base::HistogramBase::Sample sample = |
| 2347 static_cast<base::HistogramBase::Sample>(negotiated_protocol_); | 2348 static_cast<base::HistogramBase::Sample>(negotiated_protocol_); |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 2382 } | 2383 } |
| 2383 UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.Support", supported, | 2384 UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.Support", supported, |
| 2384 CHANNEL_ID_USAGE_MAX); | 2385 CHANNEL_ID_USAGE_MAX); |
| 2385 } | 2386 } |
| 2386 | 2387 |
| 2387 bool SSLClientSocketImpl::IsChannelIDEnabled() const { | 2388 bool SSLClientSocketImpl::IsChannelIDEnabled() const { |
| 2388 return ssl_config_.channel_id_enabled && channel_id_service_; | 2389 return ssl_config_.channel_id_enabled && channel_id_service_; |
| 2389 } | 2390 } |
| 2390 | 2391 |
| 2391 } // namespace net | 2392 } // namespace net |
| OLD | NEW |