OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket_impl.h" | 5 #include "net/socket/ssl_client_socket_impl.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <string.h> | 8 #include <string.h> |
9 | 9 |
10 #include <algorithm> | 10 #include <algorithm> |
(...skipping 90 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
101 return true; | 101 return true; |
102 case NID_sha512: | 102 case NID_sha512: |
103 *hash = SSLPrivateKey::Hash::SHA512; | 103 *hash = SSLPrivateKey::Hash::SHA512; |
104 return true; | 104 return true; |
105 default: | 105 default: |
106 return false; | 106 return false; |
107 } | 107 } |
108 } | 108 } |
109 | 109 |
110 std::unique_ptr<base::Value> NetLogPrivateKeyOperationCallback( | 110 std::unique_ptr<base::Value> NetLogPrivateKeyOperationCallback( |
111 SSLPrivateKey::Type type, | |
112 SSLPrivateKey::Hash hash, | 111 SSLPrivateKey::Hash hash, |
113 NetLogCaptureMode mode) { | 112 NetLogCaptureMode mode) { |
114 std::string type_str; | |
115 switch (type) { | |
116 case SSLPrivateKey::Type::RSA: | |
117 type_str = "RSA"; | |
118 break; | |
119 case SSLPrivateKey::Type::ECDSA_P256: | |
120 type_str = "ECDSA_P256"; | |
121 break; | |
122 case SSLPrivateKey::Type::ECDSA_P384: | |
123 type_str = "ECDSA_P384"; | |
124 break; | |
125 case SSLPrivateKey::Type::ECDSA_P521: | |
126 type_str = "ECDSA_P521"; | |
127 break; | |
128 } | |
129 | |
130 std::string hash_str; | 113 std::string hash_str; |
131 switch (hash) { | 114 switch (hash) { |
132 case SSLPrivateKey::Hash::MD5_SHA1: | 115 case SSLPrivateKey::Hash::MD5_SHA1: |
133 hash_str = "MD5_SHA1"; | 116 hash_str = "MD5_SHA1"; |
134 break; | 117 break; |
135 case SSLPrivateKey::Hash::SHA1: | 118 case SSLPrivateKey::Hash::SHA1: |
136 hash_str = "SHA1"; | 119 hash_str = "SHA1"; |
137 break; | 120 break; |
138 case SSLPrivateKey::Hash::SHA256: | 121 case SSLPrivateKey::Hash::SHA256: |
139 hash_str = "SHA256"; | 122 hash_str = "SHA256"; |
140 break; | 123 break; |
141 case SSLPrivateKey::Hash::SHA384: | 124 case SSLPrivateKey::Hash::SHA384: |
142 hash_str = "SHA384"; | 125 hash_str = "SHA384"; |
143 break; | 126 break; |
144 case SSLPrivateKey::Hash::SHA512: | 127 case SSLPrivateKey::Hash::SHA512: |
145 hash_str = "SHA512"; | 128 hash_str = "SHA512"; |
146 break; | 129 break; |
147 } | 130 } |
148 | 131 |
149 std::unique_ptr<base::DictionaryValue> value(new base::DictionaryValue); | 132 std::unique_ptr<base::DictionaryValue> value(new base::DictionaryValue); |
150 value->SetString("type", type_str); | |
151 value->SetString("hash", hash_str); | 133 value->SetString("hash", hash_str); |
152 return std::move(value); | 134 return std::move(value); |
153 } | 135 } |
154 | 136 |
155 std::unique_ptr<base::Value> NetLogChannelIDLookupCallback( | 137 std::unique_ptr<base::Value> NetLogChannelIDLookupCallback( |
156 ChannelIDService* channel_id_service, | 138 ChannelIDService* channel_id_service, |
157 NetLogCaptureMode capture_mode) { | 139 NetLogCaptureMode capture_mode) { |
158 ChannelIDStore* store = channel_id_service->GetChannelIDStore(); | 140 ChannelIDStore* store = channel_id_service->GetChannelIDStore(); |
159 std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue()); | 141 std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue()); |
160 dict->SetBoolean("ephemeral", store->IsEphemeral()); | 142 dict->SetBoolean("ephemeral", store->IsEphemeral()); |
(...skipping 200 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
361 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); | 343 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); |
362 DCHECK(socket); | 344 DCHECK(socket); |
363 return socket->ClientCertRequestCallback(ssl); | 345 return socket->ClientCertRequestCallback(ssl); |
364 } | 346 } |
365 | 347 |
366 static int NewSessionCallback(SSL* ssl, SSL_SESSION* session) { | 348 static int NewSessionCallback(SSL* ssl, SSL_SESSION* session) { |
367 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); | 349 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); |
368 return socket->NewSessionCallback(session); | 350 return socket->NewSessionCallback(session); |
369 } | 351 } |
370 | 352 |
371 static int PrivateKeyTypeCallback(SSL* ssl) { | |
372 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); | |
373 return socket->PrivateKeyTypeCallback(); | |
374 } | |
375 | |
376 static size_t PrivateKeyMaxSignatureLenCallback(SSL* ssl) { | |
377 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); | |
378 return socket->PrivateKeyMaxSignatureLenCallback(); | |
379 } | |
380 | |
381 static ssl_private_key_result_t PrivateKeySignDigestCallback( | 353 static ssl_private_key_result_t PrivateKeySignDigestCallback( |
382 SSL* ssl, | 354 SSL* ssl, |
383 uint8_t* out, | 355 uint8_t* out, |
384 size_t* out_len, | 356 size_t* out_len, |
385 size_t max_out, | 357 size_t max_out, |
386 const EVP_MD* md, | 358 const EVP_MD* md, |
387 const uint8_t* in, | 359 const uint8_t* in, |
388 size_t in_len) { | 360 size_t in_len) { |
389 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); | 361 SSLClientSocketImpl* socket = GetInstance()->GetClientSocketFromSSL(ssl); |
390 return socket->PrivateKeySignDigestCallback(out, out_len, max_out, md, in, | 362 return socket->PrivateKeySignDigestCallback(out, out_len, max_out, md, in, |
(...skipping 28 matching lines...) Expand all Loading... |
419 // https://crbug.com/458365 | 391 // https://crbug.com/458365 |
420 // | 392 // |
421 // TODO(davidben): Sessions should be invalidated on fatal | 393 // TODO(davidben): Sessions should be invalidated on fatal |
422 // alerts. https://crbug.com/466352 | 394 // alerts. https://crbug.com/466352 |
423 SSLClientSessionCache session_cache_; | 395 SSLClientSessionCache session_cache_; |
424 }; | 396 }; |
425 | 397 |
426 // TODO(davidben): Switch from sign_digest to sign. | 398 // TODO(davidben): Switch from sign_digest to sign. |
427 const SSL_PRIVATE_KEY_METHOD | 399 const SSL_PRIVATE_KEY_METHOD |
428 SSLClientSocketImpl::SSLContext::kPrivateKeyMethod = { | 400 SSLClientSocketImpl::SSLContext::kPrivateKeyMethod = { |
429 &SSLClientSocketImpl::SSLContext::PrivateKeyTypeCallback, | 401 nullptr /* type (unused) */, |
430 &SSLClientSocketImpl::SSLContext::PrivateKeyMaxSignatureLenCallback, | 402 nullptr /* max_signature_len (unused) */, |
431 nullptr /* sign */, | 403 nullptr /* sign */, |
432 &SSLClientSocketImpl::SSLContext::PrivateKeySignDigestCallback, | 404 &SSLClientSocketImpl::SSLContext::PrivateKeySignDigestCallback, |
433 nullptr /* decrypt */, | 405 nullptr /* decrypt */, |
434 &SSLClientSocketImpl::SSLContext::PrivateKeyCompleteCallback, | 406 &SSLClientSocketImpl::SSLContext::PrivateKeyCompleteCallback, |
435 }; | 407 }; |
436 | 408 |
437 // static | 409 // static |
438 void SSLClientSocket::ClearSessionCache() { | 410 void SSLClientSocket::ClearSessionCache() { |
439 SSLClientSocketImpl::SSLContext* context = | 411 SSLClientSocketImpl::SSLContext* context = |
440 SSLClientSocketImpl::SSLContext::GetInstance(); | 412 SSLClientSocketImpl::SSLContext::GetInstance(); |
(...skipping 1274 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1715 if (negotiated_protocol_ == kProtoUnknown) | 1687 if (negotiated_protocol_ == kProtoUnknown) |
1716 return ssl_config_.renego_allowed_default; | 1688 return ssl_config_.renego_allowed_default; |
1717 | 1689 |
1718 for (NextProto allowed : ssl_config_.renego_allowed_for_protos) { | 1690 for (NextProto allowed : ssl_config_.renego_allowed_for_protos) { |
1719 if (negotiated_protocol_ == allowed) | 1691 if (negotiated_protocol_ == allowed) |
1720 return true; | 1692 return true; |
1721 } | 1693 } |
1722 return false; | 1694 return false; |
1723 } | 1695 } |
1724 | 1696 |
1725 int SSLClientSocketImpl::PrivateKeyTypeCallback() { | |
1726 switch (ssl_config_.client_private_key->GetType()) { | |
1727 case SSLPrivateKey::Type::RSA: | |
1728 return NID_rsaEncryption; | |
1729 case SSLPrivateKey::Type::ECDSA_P256: | |
1730 return NID_X9_62_prime256v1; | |
1731 case SSLPrivateKey::Type::ECDSA_P384: | |
1732 return NID_secp384r1; | |
1733 case SSLPrivateKey::Type::ECDSA_P521: | |
1734 return NID_secp521r1; | |
1735 } | |
1736 NOTREACHED(); | |
1737 return NID_undef; | |
1738 } | |
1739 | |
1740 size_t SSLClientSocketImpl::PrivateKeyMaxSignatureLenCallback() { | |
1741 return ssl_config_.client_private_key->GetMaxSignatureLengthInBytes(); | |
1742 } | |
1743 | |
1744 ssl_private_key_result_t SSLClientSocketImpl::PrivateKeySignDigestCallback( | 1697 ssl_private_key_result_t SSLClientSocketImpl::PrivateKeySignDigestCallback( |
1745 uint8_t* out, | 1698 uint8_t* out, |
1746 size_t* out_len, | 1699 size_t* out_len, |
1747 size_t max_out, | 1700 size_t max_out, |
1748 const EVP_MD* md, | 1701 const EVP_MD* md, |
1749 const uint8_t* in, | 1702 const uint8_t* in, |
1750 size_t in_len) { | 1703 size_t in_len) { |
1751 DCHECK_EQ(kNoPendingResult, signature_result_); | 1704 DCHECK_EQ(kNoPendingResult, signature_result_); |
1752 DCHECK(signature_.empty()); | 1705 DCHECK(signature_.empty()); |
1753 DCHECK(ssl_config_.client_private_key); | 1706 DCHECK(ssl_config_.client_private_key); |
1754 | 1707 |
1755 SSLPrivateKey::Hash hash; | 1708 SSLPrivateKey::Hash hash; |
1756 if (!EVP_MDToPrivateKeyHash(md, &hash)) { | 1709 if (!EVP_MDToPrivateKeyHash(md, &hash)) { |
1757 OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED); | 1710 OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED); |
1758 return ssl_private_key_failure; | 1711 return ssl_private_key_failure; |
1759 } | 1712 } |
1760 | 1713 |
1761 net_log_.BeginEvent( | 1714 net_log_.BeginEvent(NetLogEventType::SSL_PRIVATE_KEY_OP, |
1762 NetLogEventType::SSL_PRIVATE_KEY_OP, | 1715 base::Bind(&NetLogPrivateKeyOperationCallback, hash)); |
1763 base::Bind(&NetLogPrivateKeyOperationCallback, | |
1764 ssl_config_.client_private_key->GetType(), hash)); | |
1765 | 1716 |
1766 signature_result_ = ERR_IO_PENDING; | 1717 signature_result_ = ERR_IO_PENDING; |
1767 ssl_config_.client_private_key->SignDigest( | 1718 ssl_config_.client_private_key->SignDigest( |
1768 hash, base::StringPiece(reinterpret_cast<const char*>(in), in_len), | 1719 hash, base::StringPiece(reinterpret_cast<const char*>(in), in_len), |
1769 base::Bind(&SSLClientSocketImpl::OnPrivateKeyComplete, | 1720 base::Bind(&SSLClientSocketImpl::OnPrivateKeyComplete, |
1770 weak_factory_.GetWeakPtr())); | 1721 weak_factory_.GetWeakPtr())); |
1771 return ssl_private_key_retry; | 1722 return ssl_private_key_retry; |
1772 } | 1723 } |
1773 | 1724 |
1774 ssl_private_key_result_t SSLClientSocketImpl::PrivateKeyCompleteCallback( | 1725 ssl_private_key_result_t SSLClientSocketImpl::PrivateKeyCompleteCallback( |
(...skipping 185 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1960 if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED && | 1911 if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED && |
1961 !certificate_requested_) { | 1912 !certificate_requested_) { |
1962 net_error = ERR_SSL_PROTOCOL_ERROR; | 1913 net_error = ERR_SSL_PROTOCOL_ERROR; |
1963 } | 1914 } |
1964 } | 1915 } |
1965 | 1916 |
1966 return net_error; | 1917 return net_error; |
1967 } | 1918 } |
1968 | 1919 |
1969 } // namespace net | 1920 } // namespace net |
OLD | NEW |