| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
| 6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
| 7 | 7 |
| 8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
| 9 | 9 |
| 10 #include <errno.h> | 10 #include <errno.h> |
| (...skipping 338 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 349 transport_recv_busy_(false), | 349 transport_recv_busy_(false), |
| 350 weak_factory_(this), | 350 weak_factory_(this), |
| 351 pending_read_error_(kNoPendingReadResult), | 351 pending_read_error_(kNoPendingReadResult), |
| 352 transport_read_error_(OK), | 352 transport_read_error_(OK), |
| 353 transport_write_error_(OK), | 353 transport_write_error_(OK), |
| 354 server_cert_chain_(new PeerCertificateChain(NULL)), | 354 server_cert_chain_(new PeerCertificateChain(NULL)), |
| 355 completed_handshake_(false), | 355 completed_handshake_(false), |
| 356 was_ever_used_(false), | 356 was_ever_used_(false), |
| 357 client_auth_cert_needed_(false), | 357 client_auth_cert_needed_(false), |
| 358 cert_verifier_(context.cert_verifier), | 358 cert_verifier_(context.cert_verifier), |
| 359 server_bound_cert_service_(context.server_bound_cert_service), | 359 channel_id_service_(context.channel_id_service), |
| 360 ssl_(NULL), | 360 ssl_(NULL), |
| 361 transport_bio_(NULL), | 361 transport_bio_(NULL), |
| 362 transport_(transport_socket.Pass()), | 362 transport_(transport_socket.Pass()), |
| 363 host_and_port_(host_and_port), | 363 host_and_port_(host_and_port), |
| 364 ssl_config_(ssl_config), | 364 ssl_config_(ssl_config), |
| 365 ssl_session_cache_shard_(context.ssl_session_cache_shard), | 365 ssl_session_cache_shard_(context.ssl_session_cache_shard), |
| 366 trying_cached_session_(false), | 366 trying_cached_session_(false), |
| 367 next_handshake_state_(STATE_NONE), | 367 next_handshake_state_(STATE_NONE), |
| 368 npn_status_(kNextProtoUnsupported), | 368 npn_status_(kNextProtoUnsupported), |
| 369 channel_id_xtn_negotiated_(false), | 369 channel_id_xtn_negotiated_(false), |
| (...skipping 10 matching lines...) Expand all Loading... |
| 380 cert_request_info->cert_key_types = cert_key_types_; | 380 cert_request_info->cert_key_types = cert_key_types_; |
| 381 } | 381 } |
| 382 | 382 |
| 383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( | 383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( |
| 384 std::string* proto, std::string* server_protos) { | 384 std::string* proto, std::string* server_protos) { |
| 385 *proto = npn_proto_; | 385 *proto = npn_proto_; |
| 386 *server_protos = server_protos_; | 386 *server_protos = server_protos_; |
| 387 return npn_status_; | 387 return npn_status_; |
| 388 } | 388 } |
| 389 | 389 |
| 390 ServerBoundCertService* | 390 ChannelIDService* |
| 391 SSLClientSocketOpenSSL::GetServerBoundCertService() const { | 391 SSLClientSocketOpenSSL::GetChannelIDService() const { |
| 392 return server_bound_cert_service_; | 392 return channel_id_service_; |
| 393 } | 393 } |
| 394 | 394 |
| 395 int SSLClientSocketOpenSSL::ExportKeyingMaterial( | 395 int SSLClientSocketOpenSSL::ExportKeyingMaterial( |
| 396 const base::StringPiece& label, | 396 const base::StringPiece& label, |
| 397 bool has_context, const base::StringPiece& context, | 397 bool has_context, const base::StringPiece& context, |
| 398 unsigned char* out, unsigned int outlen) { | 398 unsigned char* out, unsigned int outlen) { |
| 399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 400 | 400 |
| 401 int rv = SSL_export_keying_material( | 401 int rv = SSL_export_keying_material( |
| 402 ssl_, out, outlen, label.data(), label.size(), | 402 ssl_, out, outlen, label.data(), label.size(), |
| (...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 564 ssl_info->cert = server_cert_verify_result_.verified_cert; | 564 ssl_info->cert = server_cert_verify_result_.verified_cert; |
| 565 ssl_info->cert_status = server_cert_verify_result_.cert_status; | 565 ssl_info->cert_status = server_cert_verify_result_.cert_status; |
| 566 ssl_info->is_issued_by_known_root = | 566 ssl_info->is_issued_by_known_root = |
| 567 server_cert_verify_result_.is_issued_by_known_root; | 567 server_cert_verify_result_.is_issued_by_known_root; |
| 568 ssl_info->public_key_hashes = | 568 ssl_info->public_key_hashes = |
| 569 server_cert_verify_result_.public_key_hashes; | 569 server_cert_verify_result_.public_key_hashes; |
| 570 ssl_info->client_cert_sent = | 570 ssl_info->client_cert_sent = |
| 571 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); | 571 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); |
| 572 ssl_info->channel_id_sent = WasChannelIDSent(); | 572 ssl_info->channel_id_sent = WasChannelIDSent(); |
| 573 | 573 |
| 574 RecordChannelIDSupport(server_bound_cert_service_, | 574 RecordChannelIDSupport(channel_id_service_, |
| 575 channel_id_xtn_negotiated_, | 575 channel_id_xtn_negotiated_, |
| 576 ssl_config_.channel_id_enabled, | 576 ssl_config_.channel_id_enabled, |
| 577 crypto::ECPrivateKey::IsSupported()); | 577 crypto::ECPrivateKey::IsSupported()); |
| 578 | 578 |
| 579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); | 579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); |
| 580 CHECK(cipher); | 580 CHECK(cipher); |
| 581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); | 581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); |
| 582 | 582 |
| 583 ssl_info->connection_status = EncodeSSLConnectionStatus( | 583 ssl_info->connection_status = EncodeSSLConnectionStatus( |
| 584 SSL_CIPHER_get_id(cipher), 0 /* no compression */, | 584 SSL_CIPHER_get_id(cipher), 0 /* no compression */, |
| (...skipping 168 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 753 } | 753 } |
| 754 } | 754 } |
| 755 int rv = SSL_set_cipher_list(ssl_, command.c_str()); | 755 int rv = SSL_set_cipher_list(ssl_, command.c_str()); |
| 756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. | 756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. |
| 757 // This will almost certainly result in the socket failing to complete the | 757 // This will almost certainly result in the socket failing to complete the |
| 758 // handshake at which point the appropriate error is bubbled up to the client. | 758 // handshake at which point the appropriate error is bubbled up to the client. |
| 759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " | 759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " |
| 760 "returned " << rv; | 760 "returned " << rv; |
| 761 | 761 |
| 762 // TLS channel ids. | 762 // TLS channel ids. |
| 763 if (IsChannelIDEnabled(ssl_config_, server_bound_cert_service_)) { | 763 if (IsChannelIDEnabled(ssl_config_, channel_id_service_)) { |
| 764 SSL_enable_tls_channel_id(ssl_); | 764 SSL_enable_tls_channel_id(ssl_); |
| 765 } | 765 } |
| 766 | 766 |
| 767 return OK; | 767 return OK; |
| 768 } | 768 } |
| 769 | 769 |
| 770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) { | 770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) { |
| 771 // Since Run may result in Read being called, clear |user_read_callback_| | 771 // Since Run may result in Read being called, clear |user_read_callback_| |
| 772 // up front. | 772 // up front. |
| 773 if (rv > 0) | 773 if (rv > 0) |
| (...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 858 net_log_.AddEvent( | 858 net_log_.AddEvent( |
| 859 NetLog::TYPE_SSL_HANDSHAKE_ERROR, | 859 NetLog::TYPE_SSL_HANDSHAKE_ERROR, |
| 860 CreateNetLogSSLErrorCallback(net_error, ssl_error)); | 860 CreateNetLogSSLErrorCallback(net_error, ssl_error)); |
| 861 } | 861 } |
| 862 } | 862 } |
| 863 return net_error; | 863 return net_error; |
| 864 } | 864 } |
| 865 | 865 |
| 866 int SSLClientSocketOpenSSL::DoChannelIDLookup() { | 866 int SSLClientSocketOpenSSL::DoChannelIDLookup() { |
| 867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); | 867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); |
| 868 return server_bound_cert_service_->GetOrCreateDomainBoundCert( | 868 return channel_id_service_->GetOrCreateChannelID( |
| 869 host_and_port_.host(), | 869 host_and_port_.host(), |
| 870 &channel_id_private_key_, | 870 &channel_id_private_key_, |
| 871 &channel_id_cert_, | 871 &channel_id_cert_, |
| 872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, | 872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, |
| 873 base::Unretained(this)), | 873 base::Unretained(this)), |
| 874 &channel_id_request_handle_); | 874 &channel_id_request_handle_); |
| 875 } | 875 } |
| 876 | 876 |
| 877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { | 877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { |
| 878 if (result < 0) | 878 if (result < 0) |
| 879 return result; | 879 return result; |
| 880 | 880 |
| 881 DCHECK_LT(0u, channel_id_private_key_.size()); | 881 DCHECK_LT(0u, channel_id_private_key_.size()); |
| 882 // Decode key. | 882 // Decode key. |
| 883 std::vector<uint8> encrypted_private_key_info; | 883 std::vector<uint8> encrypted_private_key_info; |
| 884 std::vector<uint8> subject_public_key_info; | 884 std::vector<uint8> subject_public_key_info; |
| 885 encrypted_private_key_info.assign( | 885 encrypted_private_key_info.assign( |
| 886 channel_id_private_key_.data(), | 886 channel_id_private_key_.data(), |
| 887 channel_id_private_key_.data() + channel_id_private_key_.size()); | 887 channel_id_private_key_.data() + channel_id_private_key_.size()); |
| 888 subject_public_key_info.assign( | 888 subject_public_key_info.assign( |
| 889 channel_id_cert_.data(), | 889 channel_id_cert_.data(), |
| 890 channel_id_cert_.data() + channel_id_cert_.size()); | 890 channel_id_cert_.data() + channel_id_cert_.size()); |
| 891 scoped_ptr<crypto::ECPrivateKey> ec_private_key( | 891 scoped_ptr<crypto::ECPrivateKey> ec_private_key( |
| 892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | 892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( |
| 893 ServerBoundCertService::kEPKIPassword, | 893 ChannelIDService::kEPKIPassword, |
| 894 encrypted_private_key_info, | 894 encrypted_private_key_info, |
| 895 subject_public_key_info)); | 895 subject_public_key_info)); |
| 896 if (!ec_private_key) { | 896 if (!ec_private_key) { |
| 897 LOG(ERROR) << "Failed to import Channel ID."; | 897 LOG(ERROR) << "Failed to import Channel ID."; |
| 898 return ERR_CHANNEL_ID_IMPORT_FAILED; | 898 return ERR_CHANNEL_ID_IMPORT_FAILED; |
| 899 } | 899 } |
| 900 | 900 |
| 901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key | 901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key |
| 902 // type. | 902 // type. |
| 903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| (...skipping 602 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1506 return socket->MaybeReplayTransportError( | 1506 return socket->MaybeReplayTransportError( |
| 1507 bio, cmd, argp, argi, argl, retvalue); | 1507 bio, cmd, argp, argi, argl, retvalue); |
| 1508 } | 1508 } |
| 1509 | 1509 |
| 1510 scoped_refptr<X509Certificate> | 1510 scoped_refptr<X509Certificate> |
| 1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
| 1512 return server_cert_; | 1512 return server_cert_; |
| 1513 } | 1513 } |
| 1514 | 1514 |
| 1515 } // namespace net | 1515 } // namespace net |
| OLD | NEW |