Add non-application-data SSL messages to NetLog.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
@@ skipping 218 matching lines @@
     "SSLLegacyECDSACiphers", base::FEATURE_DISABLED_BY_DEFAULT};
 
 bool AreLegacyECDSACiphersEnabled() {
   return base::FeatureList::IsEnabled(kLegacyECDSACiphersFeature);
 }
 #endif
 
 const base::Feature kShortRecordHeaderFeature{
     "SSLShortRecordHeader", base::FEATURE_DISABLED_BY_DEFAULT};
 
+std::unique_ptr<base::Value> NetLogSSLAlertCallback(
+    const void* bytes,
+    size_t len,
+    NetLogCaptureMode capture_mode) {
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
+  dict->SetString("hex_encoded_bytes", base::HexEncode(bytes, len));
+  return std::move(dict);
+}
+
+std::unique_ptr<base::Value> NetLogSSLMessageCallback(
+    bool is_write,
+    const void* bytes,
+    size_t len,
+    NetLogCaptureMode capture_mode) {
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
+  if (len == 0) {
+    NOTREACHED();
+    return std::move(dict);
+  }
+
+  // The handshake message type is the first byte. Include it so elided messages
+  // still report their type.
+  uint8_t type = reinterpret_cast<const uint8_t*>(bytes)[0];
+  dict->SetInteger("type", type);
+
+  // Elide client certificate messages unless logging socket bytes.
+  if (!is_write || type != SSL3_MT_CERTIFICATE ||
+      capture_mode.include_socket_bytes()) {
+    dict->SetString("hex_encoded_bytes", base::HexEncode(bytes, len));
+  }
+
+  return std::move(dict);
+}
+
 }  // namespace
 
 class SSLClientSocketImpl::SSLContext {
  public:
   static SSLContext* GetInstance() {
     return base::Singleton<SSLContext,
                            base::LeakySingletonTraits<SSLContext>>::get();
   }
   SSL_CTX* ssl_ctx() { return ssl_ctx_.get(); }
   SSLClientSessionCache* session_cache() { return &session_cache_; }
@@ skipping 43 matching lines @@
 
     SSL_CTX_set_grease_enabled(ssl_ctx_.get(), 1);
 
     // Deduplicate all certificates minted from the SSL_CTX in memory.
     SSL_CTX_set0_buffer_pool(ssl_ctx_.get(), x509_util::GetBufferPool());
 
     if (base::FeatureList::IsEnabled(kShortRecordHeaderFeature)) {
       SSL_CTX_set_short_header_enabled(ssl_ctx_.get(), 1);
     }
 
+    SSL_CTX_set_msg_callback(ssl_ctx_.get(), MessageCallback);
+
     if (!SSL_CTX_add_client_custom_ext(ssl_ctx_.get(), kTbExtNum,
                                        &TokenBindingAddCallback,
                                        &TokenBindingFreeCallback, nullptr,
                                        &TokenBindingParseCallback, nullptr)) {
       NOTREACHED();
     }
   }
 
   static int TokenBindingAddCallback(SSL* ssl,
                                      unsigned int extension_value,
@@ skipping 79 matching lines @@
     SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl);
     return socket->PrivateKeyCompleteCallback(out, out_len, max_out);
   }
 
 #if !defined(OS_NACL)
   static void KeyLogCallback(const SSL* ssl, const char* line) {
     GetInstance()->ssl_key_logger_->WriteLine(line);
   }
 #endif
 
+  static void MessageCallback(int is_write,
+                              int version,
+                              int content_type,
+                              const void* buf,
+                              size_t len,
+                              SSL* ssl,
+                              void* arg) {
+    SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl);
+    return socket->MessageCallback(is_write, content_type, buf, len);
+  }
+
   // This is the index used with SSL_get_ex_data to retrieve the owner
   // SSLClientSocketImpl object from an SSL instance.
   int ssl_socket_data_index_;
 
   bssl::UniquePtr<SSL_CTX> ssl_ctx_;
 
 #if !defined(OS_NACL)
   std::unique_ptr<SSLKeyLogger> ssl_key_logger_;
 #endif
 
@@ skipping 1483 matching lines @@
 
   signature_result_ = error;
   if (signature_result_ == OK)
     signature_ = signature;
 
   // During a renegotiation, either Read or Write calls may be blocked on an
   // asynchronous private key operation.
   RetryAllOperations();
 }
 
+void SSLClientSocketImpl::MessageCallback(int is_write,
+                                          int content_type,
+                                          const void* buf,
+                                          size_t len) {
+  switch (content_type) {
+    case SSL3_RT_ALERT:
+      net_log_.AddEvent(
+          is_write ? NetLogEventType::SSL_ALERT_SENT
+                   : NetLogEventType::SSL_ALERT_RECEIVED,
+          base::Bind(&NetLogSSLAlertCallback, base::Unretained(buf), len));

[eroman, 2017/02/17 22:16:51]

Is Unretained() needed here, or is it just for documentation purposes? Same
question below.

[davidben, 2017/04/18 20:51:17]

Oh, I didn't realize they weren't needed. Removed.

+      break;
+    case SSL3_RT_HANDSHAKE:
+      net_log_.AddEvent(is_write
+                            ? NetLogEventType::SSL_HANDSHAKE_MESSAGE_SENT
+                            : NetLogEventType::SSL_HANDSHAKE_MESSAGE_RECEIVED,
+                        base::Bind(&NetLogSSLMessageCallback, !!is_write,
+                                   base::Unretained(buf), len));
+      break;
+    default:
+      return;
+  }
+}
+
 int SSLClientSocketImpl::TokenBindingAdd(const uint8_t** out,
                                          size_t* out_len,
                                          int* out_alert_value) {
   if (ssl_config_.token_binding_params.empty()) {
     return 0;
   }
   bssl::ScopedCBB output;
   CBB parameters_list;
   if (!CBB_init(output.get(), 7) ||
       !CBB_add_u8(output.get(), kTbProtocolVersionMajor) ||
@@ skipping 135 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net