| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "remoting/protocol/ssl_hmac_channel_authenticator.h" | 5 #include "remoting/protocol/ssl_hmac_channel_authenticator.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
| 9 #include "crypto/secure_util.h" | 9 #include "crypto/secure_util.h" |
| 10 #include "net/base/host_port_pair.h" | 10 #include "net/base/host_port_pair.h" |
| 11 #include "net/base/io_buffer.h" | 11 #include "net/base/io_buffer.h" |
| 12 #include "net/base/net_errors.h" | 12 #include "net/base/net_errors.h" |
| 13 #include "net/cert/x509_certificate.h" | 13 #include "net/cert/x509_certificate.h" |
| 14 #include "net/http/transport_security_state.h" | 14 #include "net/http/transport_security_state.h" |
| 15 #include "net/socket/client_socket_factory.h" | 15 #include "net/socket/client_socket_factory.h" |
| 16 #include "net/socket/client_socket_handle.h" | 16 #include "net/socket/client_socket_handle.h" |
| 17 #include "net/socket/ssl_client_socket.h" | 17 #include "net/socket/ssl_client_socket.h" |
| 18 #include "net/socket/ssl_client_socket_openssl.h" | |
| 19 #include "net/socket/ssl_server_socket.h" | 18 #include "net/socket/ssl_server_socket.h" |
| 20 #include "net/ssl/ssl_config_service.h" | 19 #include "net/ssl/ssl_config_service.h" |
| 21 #include "remoting/base/rsa_key_pair.h" | 20 #include "remoting/base/rsa_key_pair.h" |
| 22 #include "remoting/protocol/auth_util.h" | 21 #include "remoting/protocol/auth_util.h" |
| 23 | 22 |
| 24 namespace remoting { | 23 namespace remoting { |
| 25 namespace protocol { | 24 namespace protocol { |
| 26 | 25 |
| 27 // static | 26 // static |
| 28 scoped_ptr<SslHmacChannelAuthenticator> | 27 scoped_ptr<SslHmacChannelAuthenticator> |
| (...skipping 28 matching lines...) Expand all Loading... |
| 57 | 56 |
| 58 void SslHmacChannelAuthenticator::SecureAndAuthenticate( | 57 void SslHmacChannelAuthenticator::SecureAndAuthenticate( |
| 59 scoped_ptr<net::StreamSocket> socket, const DoneCallback& done_callback) { | 58 scoped_ptr<net::StreamSocket> socket, const DoneCallback& done_callback) { |
| 60 DCHECK(CalledOnValidThread()); | 59 DCHECK(CalledOnValidThread()); |
| 61 DCHECK(socket->IsConnected()); | 60 DCHECK(socket->IsConnected()); |
| 62 | 61 |
| 63 done_callback_ = done_callback; | 62 done_callback_ = done_callback; |
| 64 | 63 |
| 65 int result; | 64 int result; |
| 66 if (is_ssl_server()) { | 65 if (is_ssl_server()) { |
| 67 #if defined(OS_NACL) | |
| 68 // Client plugin doesn't use server SSL sockets, and so SSLServerSocket | |
| 69 // implementation is not compiled for NaCl as part of net_nacl. | |
| 70 NOTREACHED(); | |
| 71 result = net::ERR_FAILED; | |
| 72 #else | |
| 73 scoped_refptr<net::X509Certificate> cert = | 66 scoped_refptr<net::X509Certificate> cert = |
| 74 net::X509Certificate::CreateFromBytes( | 67 net::X509Certificate::CreateFromBytes( |
| 75 local_cert_.data(), local_cert_.length()); | 68 local_cert_.data(), local_cert_.length()); |
| 76 if (!cert.get()) { | 69 if (!cert.get()) { |
| 77 LOG(ERROR) << "Failed to parse X509Certificate"; | 70 LOG(ERROR) << "Failed to parse X509Certificate"; |
| 78 NotifyError(net::ERR_FAILED); | 71 NotifyError(net::ERR_FAILED); |
| 79 return; | 72 return; |
| 80 } | 73 } |
| 81 | 74 |
| 82 net::SSLConfig ssl_config; | 75 net::SSLConfig ssl_config; |
| 83 ssl_config.require_forward_secrecy = true; | 76 ssl_config.require_forward_secrecy = true; |
| 84 | 77 |
| 85 scoped_ptr<net::SSLServerSocket> server_socket = | 78 scoped_ptr<net::SSLServerSocket> server_socket = |
| 86 net::CreateSSLServerSocket(socket.Pass(), | 79 net::CreateSSLServerSocket(socket.Pass(), |
| 87 cert.get(), | 80 cert.get(), |
| 88 local_key_pair_->private_key(), | 81 local_key_pair_->private_key(), |
| 89 ssl_config); | 82 ssl_config); |
| 90 net::SSLServerSocket* raw_server_socket = server_socket.get(); | 83 net::SSLServerSocket* raw_server_socket = server_socket.get(); |
| 91 socket_ = server_socket.Pass(); | 84 socket_ = server_socket.Pass(); |
| 92 result = raw_server_socket->Handshake( | 85 result = raw_server_socket->Handshake( |
| 93 base::Bind(&SslHmacChannelAuthenticator::OnConnected, | 86 base::Bind(&SslHmacChannelAuthenticator::OnConnected, |
| 94 base::Unretained(this))); | 87 base::Unretained(this))); |
| 95 #endif | |
| 96 } else { | 88 } else { |
| 97 transport_security_state_.reset(new net::TransportSecurityState); | 89 transport_security_state_.reset(new net::TransportSecurityState); |
| 98 | 90 |
| 99 net::SSLConfig::CertAndStatus cert_and_status; | 91 net::SSLConfig::CertAndStatus cert_and_status; |
| 100 cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID; | 92 cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID; |
| 101 cert_and_status.der_cert = remote_cert_; | 93 cert_and_status.der_cert = remote_cert_; |
| 102 | 94 |
| 103 net::SSLConfig ssl_config; | 95 net::SSLConfig ssl_config; |
| 104 // Certificate verification and revocation checking are not needed | 96 // Certificate verification and revocation checking are not needed |
| 105 // because we use self-signed certs. Disable it so that the SSL | 97 // because we use self-signed certs. Disable it so that the SSL |
| 106 // layer doesn't try to initialize OCSP (OCSP works only on the IO | 98 // layer doesn't try to initialize OCSP (OCSP works only on the IO |
| 107 // thread). | 99 // thread). |
| 108 ssl_config.cert_io_enabled = false; | 100 ssl_config.cert_io_enabled = false; |
| 109 ssl_config.rev_checking_enabled = false; | 101 ssl_config.rev_checking_enabled = false; |
| 110 ssl_config.allowed_bad_certs.push_back(cert_and_status); | 102 ssl_config.allowed_bad_certs.push_back(cert_and_status); |
| 111 | 103 |
| 112 net::HostPortPair host_and_port(kSslFakeHostName, 0); | 104 net::HostPortPair host_and_port(kSslFakeHostName, 0); |
| 113 net::SSLClientSocketContext context; | 105 net::SSLClientSocketContext context; |
| 114 context.transport_security_state = transport_security_state_.get(); | 106 context.transport_security_state = transport_security_state_.get(); |
| 115 scoped_ptr<net::ClientSocketHandle> socket_handle( | 107 scoped_ptr<net::ClientSocketHandle> connection(new net::ClientSocketHandle); |
| 116 new net::ClientSocketHandle); | 108 connection->SetSocket(socket.Pass()); |
| 117 socket_handle->SetSocket(socket.Pass()); | |
| 118 | |
| 119 #if defined(OS_NACL) | |
| 120 // net_nacl doesn't include ClientSocketFactory. | |
| 121 socket_.reset(new net::SSLClientSocketOpenSSL( | |
| 122 socket_handle.Pass(), host_and_port, ssl_config, context)); | |
| 123 #else | |
| 124 socket_ = | 109 socket_ = |
| 125 net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket( | 110 net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket( |
| 126 socket_handle.Pass(), host_and_port, ssl_config, context); | 111 connection.Pass(), host_and_port, ssl_config, context); |
| 127 #endif | |
| 128 | 112 |
| 129 result = socket_->Connect( | 113 result = socket_->Connect( |
| 130 base::Bind(&SslHmacChannelAuthenticator::OnConnected, | 114 base::Bind(&SslHmacChannelAuthenticator::OnConnected, |
| 131 base::Unretained(this))); | 115 base::Unretained(this))); |
| 132 } | 116 } |
| 133 | 117 |
| 134 if (result == net::ERR_IO_PENDING) | 118 if (result == net::ERR_IO_PENDING) |
| 135 return; | 119 return; |
| 136 | 120 |
| 137 OnConnected(result); | 121 OnConnected(result); |
| (...skipping 145 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 283 } | 267 } |
| 284 } | 268 } |
| 285 | 269 |
| 286 void SslHmacChannelAuthenticator::NotifyError(int error) { | 270 void SslHmacChannelAuthenticator::NotifyError(int error) { |
| 287 done_callback_.Run(static_cast<net::Error>(error), | 271 done_callback_.Run(static_cast<net::Error>(error), |
| 288 scoped_ptr<net::StreamSocket>()); | 272 scoped_ptr<net::StreamSocket>()); |
| 289 } | 273 } |
| 290 | 274 |
| 291 } // namespace protocol | 275 } // namespace protocol |
| 292 } // namespace remoting | 276 } // namespace remoting |
| OLD | NEW |