OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 456 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
467 case SSL_ERROR_EXPIRED_CERT_ALERT: | 467 case SSL_ERROR_EXPIRED_CERT_ALERT: |
468 case SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT: | 468 case SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT: |
469 case SSL_ERROR_UNKNOWN_CA_ALERT: | 469 case SSL_ERROR_UNKNOWN_CA_ALERT: |
470 case SSL_ERROR_ACCESS_DENIED_ALERT: | 470 case SSL_ERROR_ACCESS_DENIED_ALERT: |
471 return ERR_BAD_SSL_CLIENT_AUTH_CERT; | 471 return ERR_BAD_SSL_CLIENT_AUTH_CERT; |
472 default: | 472 default: |
473 return MapNSSError(err); | 473 return MapNSSError(err); |
474 } | 474 } |
475 } | 475 } |
476 | 476 |
477 // Map NSS error code from the first SSL handshake to network error code. | |
478 int MapNSSClientHandshakeError(PRErrorCode err) { | |
479 switch (err) { | |
480 // If the server closed on us, it is a protocol error. | |
481 // Some TLS-intolerant servers do this when we request TLS. | |
482 case PR_END_OF_FILE_ERROR: | |
483 return ERR_SSL_PROTOCOL_ERROR; | |
484 default: | |
485 return MapNSSClientError(err); | |
486 } | |
487 } | |
488 | |
489 } // namespace | 477 } // namespace |
490 | 478 |
491 // SSLClientSocketNSS::Core provides a thread-safe, ref-counted core that is | 479 // SSLClientSocketNSS::Core provides a thread-safe, ref-counted core that is |
492 // able to marshal data between NSS functions and an underlying transport | 480 // able to marshal data between NSS functions and an underlying transport |
493 // socket. | 481 // socket. |
494 // | 482 // |
495 // All public functions are meant to be called from the network task runner, | 483 // All public functions are meant to be called from the network task runner, |
496 // and any callbacks supplied will be invoked there as well, provided that | 484 // and any callbacks supplied will be invoked there as well, provided that |
497 // Detach() has not been called yet. | 485 // Detach() has not been called yet. |
498 // | 486 // |
(...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
713 | 701 |
714 // Called by NSS once the handshake has completed. | 702 // Called by NSS once the handshake has completed. |
715 // |arg| contains a pointer to the current SSLClientSocketNSS::Core. | 703 // |arg| contains a pointer to the current SSLClientSocketNSS::Core. |
716 static void HandshakeCallback(PRFileDesc* socket, void* arg); | 704 static void HandshakeCallback(PRFileDesc* socket, void* arg); |
717 | 705 |
718 // Called once the handshake has succeeded. | 706 // Called once the handshake has succeeded. |
719 void HandshakeSucceeded(); | 707 void HandshakeSucceeded(); |
720 | 708 |
721 // Handles an NSS error generated while handshaking or performing IO. | 709 // Handles an NSS error generated while handshaking or performing IO. |
722 // Returns a network error code mapped from the original NSS error. | 710 // Returns a network error code mapped from the original NSS error. |
723 int HandleNSSError(PRErrorCode error, bool handshake_error); | 711 int HandleNSSError(PRErrorCode error); |
724 | 712 |
725 int DoHandshakeLoop(int last_io_result); | 713 int DoHandshakeLoop(int last_io_result); |
726 int DoReadLoop(int result); | 714 int DoReadLoop(int result); |
727 int DoWriteLoop(int result); | 715 int DoWriteLoop(int result); |
728 | 716 |
729 int DoHandshake(); | 717 int DoHandshake(); |
730 int DoGetDBCertComplete(int result); | 718 int DoGetDBCertComplete(int result); |
731 | 719 |
732 int DoPayloadRead(); | 720 int DoPayloadRead(); |
733 int DoPayloadWrite(); | 721 int DoPayloadWrite(); |
(...skipping 941 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1675 UpdateConnectionStatus(); | 1663 UpdateConnectionStatus(); |
1676 UpdateNextProto(); | 1664 UpdateNextProto(); |
1677 | 1665 |
1678 // Update the network task runners view of the handshake state whenever | 1666 // Update the network task runners view of the handshake state whenever |
1679 // a handshake has completed. | 1667 // a handshake has completed. |
1680 PostOrRunCallback( | 1668 PostOrRunCallback( |
1681 FROM_HERE, base::Bind(&Core::OnHandshakeStateUpdated, this, | 1669 FROM_HERE, base::Bind(&Core::OnHandshakeStateUpdated, this, |
1682 nss_handshake_state_)); | 1670 nss_handshake_state_)); |
1683 } | 1671 } |
1684 | 1672 |
1685 int SSLClientSocketNSS::Core::HandleNSSError(PRErrorCode nss_error, | 1673 int SSLClientSocketNSS::Core::HandleNSSError(PRErrorCode nss_error) { |
1686 bool handshake_error) { | |
1687 DCHECK(OnNSSTaskRunner()); | 1674 DCHECK(OnNSSTaskRunner()); |
1688 | 1675 |
1689 int net_error = handshake_error ? MapNSSClientHandshakeError(nss_error) : | 1676 int net_error = MapNSSClientError(nss_error); |
1690 MapNSSClientError(nss_error); | |
1691 | 1677 |
1692 #if defined(OS_WIN) | 1678 #if defined(OS_WIN) |
1693 // On Windows, a handle to the HCRYPTPROV is cached in the X509Certificate | 1679 // On Windows, a handle to the HCRYPTPROV is cached in the X509Certificate |
1694 // os_cert_handle() as an optimization. However, if the certificate | 1680 // os_cert_handle() as an optimization. However, if the certificate |
1695 // private key is stored on a smart card, and the smart card is removed, | 1681 // private key is stored on a smart card, and the smart card is removed, |
1696 // the cached HCRYPTPROV will not be able to obtain the HCRYPTKEY again, | 1682 // the cached HCRYPTPROV will not be able to obtain the HCRYPTKEY again, |
1697 // preventing client certificate authentication. Because the | 1683 // preventing client certificate authentication. Because the |
1698 // X509Certificate may outlive the individual SSLClientSocketNSS, due to | 1684 // X509Certificate may outlive the individual SSLClientSocketNSS, due to |
1699 // caching in X509Certificate, this failure ends up preventing client | 1685 // caching in X509Certificate, this failure ends up preventing client |
1700 // certificate authentication with the same certificate for all future | 1686 // certificate authentication with the same certificate for all future |
(...skipping 137 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1838 // cert again. | 1824 // cert again. |
1839 if (rv == SECSuccess && SSL_InvalidateSession(nss_fd_) != SECSuccess) | 1825 if (rv == SECSuccess && SSL_InvalidateSession(nss_fd_) != SECSuccess) |
1840 LOG(WARNING) << "Couldn't invalidate SSL session: " << PR_GetError(); | 1826 LOG(WARNING) << "Couldn't invalidate SSL session: " << PR_GetError(); |
1841 } else if (rv == SECSuccess) { | 1827 } else if (rv == SECSuccess) { |
1842 if (!handshake_callback_called_) { | 1828 if (!handshake_callback_called_) { |
1843 false_started_ = true; | 1829 false_started_ = true; |
1844 HandshakeSucceeded(); | 1830 HandshakeSucceeded(); |
1845 } | 1831 } |
1846 } else { | 1832 } else { |
1847 PRErrorCode prerr = PR_GetError(); | 1833 PRErrorCode prerr = PR_GetError(); |
1848 net_error = HandleNSSError(prerr, true); | 1834 net_error = HandleNSSError(prerr); |
1849 | |
1850 // Some network devices that inspect application-layer packets seem to | |
1851 // inject TCP reset packets to break the connections when they see | |
1852 // TLS 1.1 in ClientHello or ServerHello. See http://crbug.com/130293. | |
1853 // | |
1854 // Only allow ERR_CONNECTION_RESET to trigger a fallback from TLS 1.1 or | |
1855 // 1.2. We don't lose much in this fallback because the explicit IV for CBC | |
1856 // mode in TLS 1.1 is approximated by record splitting in TLS 1.0. The | |
1857 // fallback will be more painful for TLS 1.2 when we have GCM support. | |
1858 // | |
1859 // ERR_CONNECTION_RESET is a common network error, so we don't want it | |
1860 // to trigger a version fallback in general, especially the TLS 1.0 -> | |
1861 // SSL 3.0 fallback, which would drop TLS extensions. | |
1862 if (prerr == PR_CONNECT_RESET_ERROR && | |
1863 ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1_1) { | |
1864 net_error = ERR_SSL_PROTOCOL_ERROR; | |
1865 } | |
1866 | 1835 |
1867 // If not done, stay in this state | 1836 // If not done, stay in this state |
1868 if (net_error == ERR_IO_PENDING) { | 1837 if (net_error == ERR_IO_PENDING) { |
1869 GotoState(STATE_HANDSHAKE); | 1838 GotoState(STATE_HANDSHAKE); |
1870 } else { | 1839 } else { |
1871 PostOrRunCallback( | 1840 PostOrRunCallback( |
1872 FROM_HERE, | 1841 FROM_HERE, |
1873 base::Bind(&AddLogEventWithCallback, weak_net_log_, | 1842 base::Bind(&AddLogEventWithCallback, weak_net_log_, |
1874 NetLog::TYPE_SSL_HANDSHAKE_ERROR, | 1843 NetLog::TYPE_SSL_HANDSHAKE_ERROR, |
1875 CreateNetLogSSLErrorCallback(net_error, prerr))); | 1844 CreateNetLogSSLErrorCallback(net_error, prerr))); |
(...skipping 106 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1982 next_result = &pending_read_result_; | 1951 next_result = &pending_read_result_; |
1983 } | 1952 } |
1984 | 1953 |
1985 if (client_auth_cert_needed_) { | 1954 if (client_auth_cert_needed_) { |
1986 *next_result = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; | 1955 *next_result = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; |
1987 pending_read_nss_error_ = 0; | 1956 pending_read_nss_error_ = 0; |
1988 } else if (*next_result < 0) { | 1957 } else if (*next_result < 0) { |
1989 // If *next_result == 0, then that indicates EOF, and no special error | 1958 // If *next_result == 0, then that indicates EOF, and no special error |
1990 // handling is needed. | 1959 // handling is needed. |
1991 pending_read_nss_error_ = PR_GetError(); | 1960 pending_read_nss_error_ = PR_GetError(); |
1992 *next_result = HandleNSSError(pending_read_nss_error_, false); | 1961 *next_result = HandleNSSError(pending_read_nss_error_); |
1993 if (rv > 0 && *next_result == ERR_IO_PENDING) { | 1962 if (rv > 0 && *next_result == ERR_IO_PENDING) { |
1994 // If at least some data was read from PR_Read(), do not treat | 1963 // If at least some data was read from PR_Read(), do not treat |
1995 // insufficient data as an error to return in the next call to | 1964 // insufficient data as an error to return in the next call to |
1996 // DoPayloadRead() - instead, let the call fall through to check | 1965 // DoPayloadRead() - instead, let the call fall through to check |
1997 // PR_Read() again. This is because DoTransportIO() may complete | 1966 // PR_Read() again. This is because DoTransportIO() may complete |
1998 // in between the next call to DoPayloadRead(), and thus it is | 1967 // in between the next call to DoPayloadRead(), and thus it is |
1999 // important to check PR_Read() on subsequent invocations to see | 1968 // important to check PR_Read() on subsequent invocations to see |
2000 // if a complete record may now be read. | 1969 // if a complete record may now be read. |
2001 pending_read_nss_error_ = 0; | 1970 pending_read_nss_error_ = 0; |
2002 pending_read_result_ = kNoPendingReadResult; | 1971 pending_read_result_ = kNoPendingReadResult; |
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2044 FROM_HERE, | 2013 FROM_HERE, |
2045 base::Bind(&LogByteTransferEvent, weak_net_log_, | 2014 base::Bind(&LogByteTransferEvent, weak_net_log_, |
2046 NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv, | 2015 NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv, |
2047 scoped_refptr<IOBuffer>(user_write_buf_))); | 2016 scoped_refptr<IOBuffer>(user_write_buf_))); |
2048 return rv; | 2017 return rv; |
2049 } | 2018 } |
2050 PRErrorCode prerr = PR_GetError(); | 2019 PRErrorCode prerr = PR_GetError(); |
2051 if (prerr == PR_WOULD_BLOCK_ERROR) | 2020 if (prerr == PR_WOULD_BLOCK_ERROR) |
2052 return ERR_IO_PENDING; | 2021 return ERR_IO_PENDING; |
2053 | 2022 |
2054 rv = HandleNSSError(prerr, false); | 2023 rv = HandleNSSError(prerr); |
2055 PostOrRunCallback( | 2024 PostOrRunCallback( |
2056 FROM_HERE, | 2025 FROM_HERE, |
2057 base::Bind(&AddLogEventWithCallback, weak_net_log_, | 2026 base::Bind(&AddLogEventWithCallback, weak_net_log_, |
2058 NetLog::TYPE_SSL_WRITE_ERROR, | 2027 NetLog::TYPE_SSL_WRITE_ERROR, |
2059 CreateNetLogSSLErrorCallback(rv, prerr))); | 2028 CreateNetLogSSLErrorCallback(rv, prerr))); |
2060 return rv; | 2029 return rv; |
2061 } | 2030 } |
2062 | 2031 |
2063 // Do as much network I/O as possible between the buffer and the | 2032 // Do as much network I/O as possible between the buffer and the |
2064 // transport socket. Return true if some I/O performed, false | 2033 // transport socket. Return true if some I/O performed, false |
(...skipping 1549 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3614 scoped_refptr<X509Certificate> | 3583 scoped_refptr<X509Certificate> |
3615 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { | 3584 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { |
3616 return core_->state().server_cert.get(); | 3585 return core_->state().server_cert.get(); |
3617 } | 3586 } |
3618 | 3587 |
3619 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const { | 3588 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const { |
3620 return server_bound_cert_service_; | 3589 return server_bound_cert_service_; |
3621 } | 3590 } |
3622 | 3591 |
3623 } // namespace net | 3592 } // namespace net |
OLD | NEW |