Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(929)

Side by Side Diff: net/socket/ssl_client_socket_openssl.cc

Issue 356713005: Rename ServerBoundCert => ChannelID to reflect the current name (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: fix cookies_list.js Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle
6 // of operation is derived from SSLClientSocketNSS. 6 // of operation is derived from SSLClientSocketNSS.
7 7
8 #include "net/socket/ssl_client_socket_openssl.h" 8 #include "net/socket/ssl_client_socket_openssl.h"
9 9
10 #include <errno.h> 10 #include <errno.h>
(...skipping 338 matching lines...) Expand 10 before | Expand all | Expand 10 after
349 transport_recv_busy_(false), 349 transport_recv_busy_(false),
350 weak_factory_(this), 350 weak_factory_(this),
351 pending_read_error_(kNoPendingReadResult), 351 pending_read_error_(kNoPendingReadResult),
352 transport_read_error_(OK), 352 transport_read_error_(OK),
353 transport_write_error_(OK), 353 transport_write_error_(OK),
354 server_cert_chain_(new PeerCertificateChain(NULL)), 354 server_cert_chain_(new PeerCertificateChain(NULL)),
355 completed_handshake_(false), 355 completed_handshake_(false),
356 was_ever_used_(false), 356 was_ever_used_(false),
357 client_auth_cert_needed_(false), 357 client_auth_cert_needed_(false),
358 cert_verifier_(context.cert_verifier), 358 cert_verifier_(context.cert_verifier),
359 server_bound_cert_service_(context.server_bound_cert_service), 359 channel_id_service_(context.channel_id_service),
360 ssl_(NULL), 360 ssl_(NULL),
361 transport_bio_(NULL), 361 transport_bio_(NULL),
362 transport_(transport_socket.Pass()), 362 transport_(transport_socket.Pass()),
363 host_and_port_(host_and_port), 363 host_and_port_(host_and_port),
364 ssl_config_(ssl_config), 364 ssl_config_(ssl_config),
365 ssl_session_cache_shard_(context.ssl_session_cache_shard), 365 ssl_session_cache_shard_(context.ssl_session_cache_shard),
366 trying_cached_session_(false), 366 trying_cached_session_(false),
367 next_handshake_state_(STATE_NONE), 367 next_handshake_state_(STATE_NONE),
368 npn_status_(kNextProtoUnsupported), 368 npn_status_(kNextProtoUnsupported),
369 channel_id_xtn_negotiated_(false), 369 channel_id_xtn_negotiated_(false),
(...skipping 10 matching lines...) Expand all
380 cert_request_info->cert_key_types = cert_key_types_; 380 cert_request_info->cert_key_types = cert_key_types_;
381 } 381 }
382 382
383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( 383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto(
384 std::string* proto, std::string* server_protos) { 384 std::string* proto, std::string* server_protos) {
385 *proto = npn_proto_; 385 *proto = npn_proto_;
386 *server_protos = server_protos_; 386 *server_protos = server_protos_;
387 return npn_status_; 387 return npn_status_;
388 } 388 }
389 389
390 ServerBoundCertService* 390 ChannelIDService*
391 SSLClientSocketOpenSSL::GetServerBoundCertService() const { 391 SSLClientSocketOpenSSL::GetChannelIDService() const {
392 return server_bound_cert_service_; 392 return channel_id_service_;
393 } 393 }
394 394
395 int SSLClientSocketOpenSSL::ExportKeyingMaterial( 395 int SSLClientSocketOpenSSL::ExportKeyingMaterial(
396 const base::StringPiece& label, 396 const base::StringPiece& label,
397 bool has_context, const base::StringPiece& context, 397 bool has_context, const base::StringPiece& context,
398 unsigned char* out, unsigned int outlen) { 398 unsigned char* out, unsigned int outlen) {
399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
400 400
401 int rv = SSL_export_keying_material( 401 int rv = SSL_export_keying_material(
402 ssl_, out, outlen, label.data(), label.size(), 402 ssl_, out, outlen, label.data(), label.size(),
(...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after
564 ssl_info->cert = server_cert_verify_result_.verified_cert; 564 ssl_info->cert = server_cert_verify_result_.verified_cert;
565 ssl_info->cert_status = server_cert_verify_result_.cert_status; 565 ssl_info->cert_status = server_cert_verify_result_.cert_status;
566 ssl_info->is_issued_by_known_root = 566 ssl_info->is_issued_by_known_root =
567 server_cert_verify_result_.is_issued_by_known_root; 567 server_cert_verify_result_.is_issued_by_known_root;
568 ssl_info->public_key_hashes = 568 ssl_info->public_key_hashes =
569 server_cert_verify_result_.public_key_hashes; 569 server_cert_verify_result_.public_key_hashes;
570 ssl_info->client_cert_sent = 570 ssl_info->client_cert_sent =
571 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); 571 ssl_config_.send_client_cert && ssl_config_.client_cert.get();
572 ssl_info->channel_id_sent = WasChannelIDSent(); 572 ssl_info->channel_id_sent = WasChannelIDSent();
573 573
574 RecordChannelIDSupport(server_bound_cert_service_, 574 RecordChannelIDSupport(channel_id_service_,
575 channel_id_xtn_negotiated_, 575 channel_id_xtn_negotiated_,
576 ssl_config_.channel_id_enabled, 576 ssl_config_.channel_id_enabled,
577 crypto::ECPrivateKey::IsSupported()); 577 crypto::ECPrivateKey::IsSupported());
578 578
579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); 579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_);
580 CHECK(cipher); 580 CHECK(cipher);
581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); 581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL);
582 582
583 ssl_info->connection_status = EncodeSSLConnectionStatus( 583 ssl_info->connection_status = EncodeSSLConnectionStatus(
584 SSL_CIPHER_get_id(cipher), 0 /* no compression */, 584 SSL_CIPHER_get_id(cipher), 0 /* no compression */,
(...skipping 168 matching lines...) Expand 10 before | Expand all | Expand 10 after
753 } 753 }
754 } 754 }
755 int rv = SSL_set_cipher_list(ssl_, command.c_str()); 755 int rv = SSL_set_cipher_list(ssl_, command.c_str());
756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. 756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL.
757 // This will almost certainly result in the socket failing to complete the 757 // This will almost certainly result in the socket failing to complete the
758 // handshake at which point the appropriate error is bubbled up to the client. 758 // handshake at which point the appropriate error is bubbled up to the client.
759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " 759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') "
760 "returned " << rv; 760 "returned " << rv;
761 761
762 // TLS channel ids. 762 // TLS channel ids.
763 if (IsChannelIDEnabled(ssl_config_, server_bound_cert_service_)) { 763 if (IsChannelIDEnabled(ssl_config_, channel_id_service_)) {
764 SSL_enable_tls_channel_id(ssl_); 764 SSL_enable_tls_channel_id(ssl_);
765 } 765 }
766 766
767 return OK; 767 return OK;
768 } 768 }
769 769
770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) { 770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) {
771 // Since Run may result in Read being called, clear |user_read_callback_| 771 // Since Run may result in Read being called, clear |user_read_callback_|
772 // up front. 772 // up front.
773 if (rv > 0) 773 if (rv > 0)
(...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after
858 net_log_.AddEvent( 858 net_log_.AddEvent(
859 NetLog::TYPE_SSL_HANDSHAKE_ERROR, 859 NetLog::TYPE_SSL_HANDSHAKE_ERROR,
860 CreateNetLogSSLErrorCallback(net_error, ssl_error)); 860 CreateNetLogSSLErrorCallback(net_error, ssl_error));
861 } 861 }
862 } 862 }
863 return net_error; 863 return net_error;
864 } 864 }
865 865
866 int SSLClientSocketOpenSSL::DoChannelIDLookup() { 866 int SSLClientSocketOpenSSL::DoChannelIDLookup() {
867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); 867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE);
868 return server_bound_cert_service_->GetOrCreateDomainBoundCert( 868 return channel_id_service_->GetOrCreateChannelID(
869 host_and_port_.host(), 869 host_and_port_.host(),
870 &channel_id_private_key_, 870 &channel_id_private_key_,
871 &channel_id_cert_, 871 &channel_id_cert_,
872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, 872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete,
873 base::Unretained(this)), 873 base::Unretained(this)),
874 &channel_id_request_handle_); 874 &channel_id_request_handle_);
875 } 875 }
876 876
877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { 877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) {
878 if (result < 0) 878 if (result < 0)
879 return result; 879 return result;
880 880
881 DCHECK_LT(0u, channel_id_private_key_.size()); 881 DCHECK_LT(0u, channel_id_private_key_.size());
882 // Decode key. 882 // Decode key.
883 std::vector<uint8> encrypted_private_key_info; 883 std::vector<uint8> encrypted_private_key_info;
884 std::vector<uint8> subject_public_key_info; 884 std::vector<uint8> subject_public_key_info;
885 encrypted_private_key_info.assign( 885 encrypted_private_key_info.assign(
886 channel_id_private_key_.data(), 886 channel_id_private_key_.data(),
887 channel_id_private_key_.data() + channel_id_private_key_.size()); 887 channel_id_private_key_.data() + channel_id_private_key_.size());
888 subject_public_key_info.assign( 888 subject_public_key_info.assign(
889 channel_id_cert_.data(), 889 channel_id_cert_.data(),
890 channel_id_cert_.data() + channel_id_cert_.size()); 890 channel_id_cert_.data() + channel_id_cert_.size());
891 scoped_ptr<crypto::ECPrivateKey> ec_private_key( 891 scoped_ptr<crypto::ECPrivateKey> ec_private_key(
892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( 892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo(
893 ServerBoundCertService::kEPKIPassword, 893 ChannelIDService::kEPKIPassword,
894 encrypted_private_key_info, 894 encrypted_private_key_info,
895 subject_public_key_info)); 895 subject_public_key_info));
896 if (!ec_private_key) { 896 if (!ec_private_key) {
897 LOG(ERROR) << "Failed to import Channel ID."; 897 LOG(ERROR) << "Failed to import Channel ID.";
898 return ERR_CHANNEL_ID_IMPORT_FAILED; 898 return ERR_CHANNEL_ID_IMPORT_FAILED;
899 } 899 }
900 900
901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key 901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key
902 // type. 902 // type.
903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
(...skipping 602 matching lines...) Expand 10 before | Expand all | Expand 10 after
1506 return socket->MaybeReplayTransportError( 1506 return socket->MaybeReplayTransportError(
1507 bio, cmd, argp, argi, argl, retvalue); 1507 bio, cmd, argp, argi, argl, retvalue);
1508 } 1508 }
1509 1509
1510 scoped_refptr<X509Certificate> 1510 scoped_refptr<X509Certificate>
1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { 1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
1512 return server_cert_; 1512 return server_cert_;
1513 } 1513 }
1514 1514
1515 } // namespace net 1515 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698