OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "remoting/protocol/ssl_hmac_channel_authenticator.h" | 5 #include "remoting/protocol/ssl_hmac_channel_authenticator.h" |
6 | 6 |
7 #include "base/bind.h" | 7 #include "base/bind.h" |
8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
9 #include "crypto/secure_util.h" | 9 #include "crypto/secure_util.h" |
10 #include "net/base/host_port_pair.h" | 10 #include "net/base/host_port_pair.h" |
11 #include "net/base/io_buffer.h" | 11 #include "net/base/io_buffer.h" |
12 #include "net/base/net_errors.h" | 12 #include "net/base/net_errors.h" |
13 #include "net/cert/x509_certificate.h" | 13 #include "net/cert/x509_certificate.h" |
14 #include "net/http/transport_security_state.h" | 14 #include "net/http/transport_security_state.h" |
15 #include "net/socket/client_socket_factory.h" | 15 #include "net/socket/client_socket_factory.h" |
16 #include "net/socket/client_socket_handle.h" | 16 #include "net/socket/client_socket_handle.h" |
17 #include "net/socket/ssl_client_socket.h" | 17 #include "net/socket/ssl_client_socket.h" |
18 #include "net/socket/ssl_client_socket_openssl.h" | |
19 #include "net/socket/ssl_server_socket.h" | 18 #include "net/socket/ssl_server_socket.h" |
20 #include "net/ssl/ssl_config_service.h" | 19 #include "net/ssl/ssl_config_service.h" |
21 #include "remoting/base/rsa_key_pair.h" | 20 #include "remoting/base/rsa_key_pair.h" |
22 #include "remoting/protocol/auth_util.h" | 21 #include "remoting/protocol/auth_util.h" |
23 | 22 |
24 namespace remoting { | 23 namespace remoting { |
25 namespace protocol { | 24 namespace protocol { |
26 | 25 |
27 // static | 26 // static |
28 scoped_ptr<SslHmacChannelAuthenticator> | 27 scoped_ptr<SslHmacChannelAuthenticator> |
(...skipping 28 matching lines...) Expand all Loading... |
57 | 56 |
58 void SslHmacChannelAuthenticator::SecureAndAuthenticate( | 57 void SslHmacChannelAuthenticator::SecureAndAuthenticate( |
59 scoped_ptr<net::StreamSocket> socket, const DoneCallback& done_callback) { | 58 scoped_ptr<net::StreamSocket> socket, const DoneCallback& done_callback) { |
60 DCHECK(CalledOnValidThread()); | 59 DCHECK(CalledOnValidThread()); |
61 DCHECK(socket->IsConnected()); | 60 DCHECK(socket->IsConnected()); |
62 | 61 |
63 done_callback_ = done_callback; | 62 done_callback_ = done_callback; |
64 | 63 |
65 int result; | 64 int result; |
66 if (is_ssl_server()) { | 65 if (is_ssl_server()) { |
67 #if defined(OS_NACL) | |
68 // Client plugin doesn't use server SSL sockets, and so SSLServerSocket | |
69 // implementation is not compiled for NaCl as part of net_nacl. | |
70 NOTREACHED(); | |
71 result = net::ERR_FAILED; | |
72 #else | |
73 scoped_refptr<net::X509Certificate> cert = | 66 scoped_refptr<net::X509Certificate> cert = |
74 net::X509Certificate::CreateFromBytes( | 67 net::X509Certificate::CreateFromBytes( |
75 local_cert_.data(), local_cert_.length()); | 68 local_cert_.data(), local_cert_.length()); |
76 if (!cert.get()) { | 69 if (!cert.get()) { |
77 LOG(ERROR) << "Failed to parse X509Certificate"; | 70 LOG(ERROR) << "Failed to parse X509Certificate"; |
78 NotifyError(net::ERR_FAILED); | 71 NotifyError(net::ERR_FAILED); |
79 return; | 72 return; |
80 } | 73 } |
81 | 74 |
82 net::SSLConfig ssl_config; | 75 net::SSLConfig ssl_config; |
83 ssl_config.require_forward_secrecy = true; | 76 ssl_config.require_forward_secrecy = true; |
84 | 77 |
85 scoped_ptr<net::SSLServerSocket> server_socket = | 78 scoped_ptr<net::SSLServerSocket> server_socket = |
86 net::CreateSSLServerSocket(socket.Pass(), | 79 net::CreateSSLServerSocket(socket.Pass(), |
87 cert.get(), | 80 cert.get(), |
88 local_key_pair_->private_key(), | 81 local_key_pair_->private_key(), |
89 ssl_config); | 82 ssl_config); |
90 net::SSLServerSocket* raw_server_socket = server_socket.get(); | 83 net::SSLServerSocket* raw_server_socket = server_socket.get(); |
91 socket_ = server_socket.Pass(); | 84 socket_ = server_socket.Pass(); |
92 result = raw_server_socket->Handshake( | 85 result = raw_server_socket->Handshake( |
93 base::Bind(&SslHmacChannelAuthenticator::OnConnected, | 86 base::Bind(&SslHmacChannelAuthenticator::OnConnected, |
94 base::Unretained(this))); | 87 base::Unretained(this))); |
95 #endif | |
96 } else { | 88 } else { |
97 transport_security_state_.reset(new net::TransportSecurityState); | 89 transport_security_state_.reset(new net::TransportSecurityState); |
98 | 90 |
99 net::SSLConfig::CertAndStatus cert_and_status; | 91 net::SSLConfig::CertAndStatus cert_and_status; |
100 cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID; | 92 cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID; |
101 cert_and_status.der_cert = remote_cert_; | 93 cert_and_status.der_cert = remote_cert_; |
102 | 94 |
103 net::SSLConfig ssl_config; | 95 net::SSLConfig ssl_config; |
104 // Certificate verification and revocation checking are not needed | 96 // Certificate verification and revocation checking are not needed |
105 // because we use self-signed certs. Disable it so that the SSL | 97 // because we use self-signed certs. Disable it so that the SSL |
106 // layer doesn't try to initialize OCSP (OCSP works only on the IO | 98 // layer doesn't try to initialize OCSP (OCSP works only on the IO |
107 // thread). | 99 // thread). |
108 ssl_config.cert_io_enabled = false; | 100 ssl_config.cert_io_enabled = false; |
109 ssl_config.rev_checking_enabled = false; | 101 ssl_config.rev_checking_enabled = false; |
110 ssl_config.allowed_bad_certs.push_back(cert_and_status); | 102 ssl_config.allowed_bad_certs.push_back(cert_and_status); |
111 | 103 |
112 net::HostPortPair host_and_port(kSslFakeHostName, 0); | 104 net::HostPortPair host_and_port(kSslFakeHostName, 0); |
113 net::SSLClientSocketContext context; | 105 net::SSLClientSocketContext context; |
114 context.transport_security_state = transport_security_state_.get(); | 106 context.transport_security_state = transport_security_state_.get(); |
115 scoped_ptr<net::ClientSocketHandle> socket_handle( | 107 scoped_ptr<net::ClientSocketHandle> connection(new net::ClientSocketHandle); |
116 new net::ClientSocketHandle); | 108 connection->SetSocket(socket.Pass()); |
117 socket_handle->SetSocket(socket.Pass()); | |
118 | |
119 #if defined(OS_NACL) | |
120 // net_nacl doesn't include ClientSocketFactory. | |
121 socket_.reset(new net::SSLClientSocketOpenSSL( | |
122 socket_handle.Pass(), host_and_port, ssl_config, context)); | |
123 #else | |
124 socket_ = | 109 socket_ = |
125 net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket( | 110 net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket( |
126 socket_handle.Pass(), host_and_port, ssl_config, context); | 111 connection.Pass(), host_and_port, ssl_config, context); |
127 #endif | |
128 | 112 |
129 result = socket_->Connect( | 113 result = socket_->Connect( |
130 base::Bind(&SslHmacChannelAuthenticator::OnConnected, | 114 base::Bind(&SslHmacChannelAuthenticator::OnConnected, |
131 base::Unretained(this))); | 115 base::Unretained(this))); |
132 } | 116 } |
133 | 117 |
134 if (result == net::ERR_IO_PENDING) | 118 if (result == net::ERR_IO_PENDING) |
135 return; | 119 return; |
136 | 120 |
137 OnConnected(result); | 121 OnConnected(result); |
(...skipping 145 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
283 } | 267 } |
284 } | 268 } |
285 | 269 |
286 void SslHmacChannelAuthenticator::NotifyError(int error) { | 270 void SslHmacChannelAuthenticator::NotifyError(int error) { |
287 done_callback_.Run(static_cast<net::Error>(error), | 271 done_callback_.Run(static_cast<net::Error>(error), |
288 scoped_ptr<net::StreamSocket>()); | 272 scoped_ptr<net::StreamSocket>()); |
289 } | 273 } |
290 | 274 |
291 } // namespace protocol | 275 } // namespace protocol |
292 } // namespace remoting | 276 } // namespace remoting |
OLD | NEW |