OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
7 | 7 |
8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
9 | 9 |
10 #include <errno.h> | 10 #include <errno.h> |
(...skipping 338 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
349 transport_recv_busy_(false), | 349 transport_recv_busy_(false), |
350 weak_factory_(this), | 350 weak_factory_(this), |
351 pending_read_error_(kNoPendingReadResult), | 351 pending_read_error_(kNoPendingReadResult), |
352 transport_read_error_(OK), | 352 transport_read_error_(OK), |
353 transport_write_error_(OK), | 353 transport_write_error_(OK), |
354 server_cert_chain_(new PeerCertificateChain(NULL)), | 354 server_cert_chain_(new PeerCertificateChain(NULL)), |
355 completed_handshake_(false), | 355 completed_handshake_(false), |
356 was_ever_used_(false), | 356 was_ever_used_(false), |
357 client_auth_cert_needed_(false), | 357 client_auth_cert_needed_(false), |
358 cert_verifier_(context.cert_verifier), | 358 cert_verifier_(context.cert_verifier), |
359 server_bound_cert_service_(context.server_bound_cert_service), | 359 channel_id_service_(context.channel_id_service), |
360 ssl_(NULL), | 360 ssl_(NULL), |
361 transport_bio_(NULL), | 361 transport_bio_(NULL), |
362 transport_(transport_socket.Pass()), | 362 transport_(transport_socket.Pass()), |
363 host_and_port_(host_and_port), | 363 host_and_port_(host_and_port), |
364 ssl_config_(ssl_config), | 364 ssl_config_(ssl_config), |
365 ssl_session_cache_shard_(context.ssl_session_cache_shard), | 365 ssl_session_cache_shard_(context.ssl_session_cache_shard), |
366 trying_cached_session_(false), | 366 trying_cached_session_(false), |
367 next_handshake_state_(STATE_NONE), | 367 next_handshake_state_(STATE_NONE), |
368 npn_status_(kNextProtoUnsupported), | 368 npn_status_(kNextProtoUnsupported), |
369 channel_id_xtn_negotiated_(false), | 369 channel_id_xtn_negotiated_(false), |
(...skipping 10 matching lines...) Expand all Loading... |
380 cert_request_info->cert_key_types = cert_key_types_; | 380 cert_request_info->cert_key_types = cert_key_types_; |
381 } | 381 } |
382 | 382 |
383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( | 383 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( |
384 std::string* proto, std::string* server_protos) { | 384 std::string* proto, std::string* server_protos) { |
385 *proto = npn_proto_; | 385 *proto = npn_proto_; |
386 *server_protos = server_protos_; | 386 *server_protos = server_protos_; |
387 return npn_status_; | 387 return npn_status_; |
388 } | 388 } |
389 | 389 |
390 ServerBoundCertService* | 390 ChannelIDService* |
391 SSLClientSocketOpenSSL::GetServerBoundCertService() const { | 391 SSLClientSocketOpenSSL::GetChannelIDService() const { |
392 return server_bound_cert_service_; | 392 return channel_id_service_; |
393 } | 393 } |
394 | 394 |
395 int SSLClientSocketOpenSSL::ExportKeyingMaterial( | 395 int SSLClientSocketOpenSSL::ExportKeyingMaterial( |
396 const base::StringPiece& label, | 396 const base::StringPiece& label, |
397 bool has_context, const base::StringPiece& context, | 397 bool has_context, const base::StringPiece& context, |
398 unsigned char* out, unsigned int outlen) { | 398 unsigned char* out, unsigned int outlen) { |
399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 399 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
400 | 400 |
401 int rv = SSL_export_keying_material( | 401 int rv = SSL_export_keying_material( |
402 ssl_, out, outlen, label.data(), label.size(), | 402 ssl_, out, outlen, label.data(), label.size(), |
(...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
564 ssl_info->cert = server_cert_verify_result_.verified_cert; | 564 ssl_info->cert = server_cert_verify_result_.verified_cert; |
565 ssl_info->cert_status = server_cert_verify_result_.cert_status; | 565 ssl_info->cert_status = server_cert_verify_result_.cert_status; |
566 ssl_info->is_issued_by_known_root = | 566 ssl_info->is_issued_by_known_root = |
567 server_cert_verify_result_.is_issued_by_known_root; | 567 server_cert_verify_result_.is_issued_by_known_root; |
568 ssl_info->public_key_hashes = | 568 ssl_info->public_key_hashes = |
569 server_cert_verify_result_.public_key_hashes; | 569 server_cert_verify_result_.public_key_hashes; |
570 ssl_info->client_cert_sent = | 570 ssl_info->client_cert_sent = |
571 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); | 571 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); |
572 ssl_info->channel_id_sent = WasChannelIDSent(); | 572 ssl_info->channel_id_sent = WasChannelIDSent(); |
573 | 573 |
574 RecordChannelIDSupport(server_bound_cert_service_, | 574 RecordChannelIDSupport(channel_id_service_, |
575 channel_id_xtn_negotiated_, | 575 channel_id_xtn_negotiated_, |
576 ssl_config_.channel_id_enabled, | 576 ssl_config_.channel_id_enabled, |
577 crypto::ECPrivateKey::IsSupported()); | 577 crypto::ECPrivateKey::IsSupported()); |
578 | 578 |
579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); | 579 const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); |
580 CHECK(cipher); | 580 CHECK(cipher); |
581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); | 581 ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); |
582 | 582 |
583 ssl_info->connection_status = EncodeSSLConnectionStatus( | 583 ssl_info->connection_status = EncodeSSLConnectionStatus( |
584 SSL_CIPHER_get_id(cipher), 0 /* no compression */, | 584 SSL_CIPHER_get_id(cipher), 0 /* no compression */, |
(...skipping 168 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
753 } | 753 } |
754 } | 754 } |
755 int rv = SSL_set_cipher_list(ssl_, command.c_str()); | 755 int rv = SSL_set_cipher_list(ssl_, command.c_str()); |
756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. | 756 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. |
757 // This will almost certainly result in the socket failing to complete the | 757 // This will almost certainly result in the socket failing to complete the |
758 // handshake at which point the appropriate error is bubbled up to the client. | 758 // handshake at which point the appropriate error is bubbled up to the client. |
759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " | 759 LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " |
760 "returned " << rv; | 760 "returned " << rv; |
761 | 761 |
762 // TLS channel ids. | 762 // TLS channel ids. |
763 if (IsChannelIDEnabled(ssl_config_, server_bound_cert_service_)) { | 763 if (IsChannelIDEnabled(ssl_config_, channel_id_service_)) { |
764 SSL_enable_tls_channel_id(ssl_); | 764 SSL_enable_tls_channel_id(ssl_); |
765 } | 765 } |
766 | 766 |
767 return OK; | 767 return OK; |
768 } | 768 } |
769 | 769 |
770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) { | 770 void SSLClientSocketOpenSSL::DoReadCallback(int rv) { |
771 // Since Run may result in Read being called, clear |user_read_callback_| | 771 // Since Run may result in Read being called, clear |user_read_callback_| |
772 // up front. | 772 // up front. |
773 if (rv > 0) | 773 if (rv > 0) |
(...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
858 net_log_.AddEvent( | 858 net_log_.AddEvent( |
859 NetLog::TYPE_SSL_HANDSHAKE_ERROR, | 859 NetLog::TYPE_SSL_HANDSHAKE_ERROR, |
860 CreateNetLogSSLErrorCallback(net_error, ssl_error)); | 860 CreateNetLogSSLErrorCallback(net_error, ssl_error)); |
861 } | 861 } |
862 } | 862 } |
863 return net_error; | 863 return net_error; |
864 } | 864 } |
865 | 865 |
866 int SSLClientSocketOpenSSL::DoChannelIDLookup() { | 866 int SSLClientSocketOpenSSL::DoChannelIDLookup() { |
867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); | 867 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); |
868 return server_bound_cert_service_->GetOrCreateDomainBoundCert( | 868 return channel_id_service_->GetOrCreateChannelID( |
869 host_and_port_.host(), | 869 host_and_port_.host(), |
870 &channel_id_private_key_, | 870 &channel_id_private_key_, |
871 &channel_id_cert_, | 871 &channel_id_cert_, |
872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, | 872 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, |
873 base::Unretained(this)), | 873 base::Unretained(this)), |
874 &channel_id_request_handle_); | 874 &channel_id_request_handle_); |
875 } | 875 } |
876 | 876 |
877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { | 877 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { |
878 if (result < 0) | 878 if (result < 0) |
879 return result; | 879 return result; |
880 | 880 |
881 DCHECK_LT(0u, channel_id_private_key_.size()); | 881 DCHECK_LT(0u, channel_id_private_key_.size()); |
882 // Decode key. | 882 // Decode key. |
883 std::vector<uint8> encrypted_private_key_info; | 883 std::vector<uint8> encrypted_private_key_info; |
884 std::vector<uint8> subject_public_key_info; | 884 std::vector<uint8> subject_public_key_info; |
885 encrypted_private_key_info.assign( | 885 encrypted_private_key_info.assign( |
886 channel_id_private_key_.data(), | 886 channel_id_private_key_.data(), |
887 channel_id_private_key_.data() + channel_id_private_key_.size()); | 887 channel_id_private_key_.data() + channel_id_private_key_.size()); |
888 subject_public_key_info.assign( | 888 subject_public_key_info.assign( |
889 channel_id_cert_.data(), | 889 channel_id_cert_.data(), |
890 channel_id_cert_.data() + channel_id_cert_.size()); | 890 channel_id_cert_.data() + channel_id_cert_.size()); |
891 scoped_ptr<crypto::ECPrivateKey> ec_private_key( | 891 scoped_ptr<crypto::ECPrivateKey> ec_private_key( |
892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | 892 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( |
893 ServerBoundCertService::kEPKIPassword, | 893 ChannelIDService::kEPKIPassword, |
894 encrypted_private_key_info, | 894 encrypted_private_key_info, |
895 subject_public_key_info)); | 895 subject_public_key_info)); |
896 if (!ec_private_key) { | 896 if (!ec_private_key) { |
897 LOG(ERROR) << "Failed to import Channel ID."; | 897 LOG(ERROR) << "Failed to import Channel ID."; |
898 return ERR_CHANNEL_ID_IMPORT_FAILED; | 898 return ERR_CHANNEL_ID_IMPORT_FAILED; |
899 } | 899 } |
900 | 900 |
901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key | 901 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key |
902 // type. | 902 // type. |
903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 903 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
(...skipping 602 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1506 return socket->MaybeReplayTransportError( | 1506 return socket->MaybeReplayTransportError( |
1507 bio, cmd, argp, argi, argl, retvalue); | 1507 bio, cmd, argp, argi, argl, retvalue); |
1508 } | 1508 } |
1509 | 1509 |
1510 scoped_refptr<X509Certificate> | 1510 scoped_refptr<X509Certificate> |
1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1511 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
1512 return server_cert_; | 1512 return server_cert_; |
1513 } | 1513 } |
1514 | 1514 |
1515 } // namespace net | 1515 } // namespace net |
OLD | NEW |