Add TLS-SRP (RFC 5054) support

net/socket/ssl_client_socket_nss.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
 #pragma once
 
 #include <certt.h>
 #include <keyt.h>
@@ skipping 79 matching lines @@
     STATE_VERIFY_DNSSEC_COMPLETE,
     STATE_VERIFY_CERT,
     STATE_VERIFY_CERT_COMPLETE,
   };
 
   int Init();
 
   // Initializes NSS SSL options.  Returns a net error code.
   int InitializeSSLOptions();
 
+  // Enables SRP ciphers. If |disable_non_srp_ciphers| is true, then non-SRP
+  // ciphers will be disabled. Returns a net error code.
+  int SetCiphersForTLSAuth(bool set_srp_ciphers, bool disable_non_srp_ciphers);
+
   // Initializes the socket peer name in SSL.  Returns a net error code.
   int InitializeSSLPeerName();
 
 #if defined(OS_MACOSX) || defined(OS_WIN)
   // Creates an OS certificate from a DER-encoded certificate.
   static X509Certificate::OSCertHandle CreateOSCert(const SECItem& der_cert);
 #endif
   X509Certificate* UpdateServerCert();
   void UpdateConnectionStatus();
+  void UpdateAuth();
   void DoReadCallback(int result);
   void DoWriteCallback(int result);
   void DoConnectCallback(int result);
   void OnHandshakeIOComplete(int result);
   void OnSendComplete(int result);
   void OnRecvComplete(int result);
 
   int DoHandshakeLoop(int last_io_result);
   int DoReadLoop(int result);
   int DoWriteLoop(int result);
@@ skipping 35 matching lines @@
                                              CERTDistNames* ca_names,
                                              CERTCertList** result_certs,
                                              void** result_private_key);
 #else
   static SECStatus ClientAuthHandler(void* arg,
                                      PRFileDesc* socket,
                                      CERTDistNames* ca_names,
                                      CERTCertificate** result_certificate,
                                      SECKEYPrivateKey** result_private_key);
 #endif
+
+  // NSS calls this when password authentication is requested (for TLS-SRP).
+  static SECStatus TLSAuthCallback(PRFileDesc *socket, SECItem *pw, void *arg);
+
   // NSS calls this when handshake is completed.  We pass 'this' as the second
   // argument.
   static void HandshakeCallback(PRFileDesc* socket, void* arg);
 
   CompletionCallbackImpl<SSLClientSocketNSS> buffer_send_callback_;
   CompletionCallbackImpl<SSLClientSocketNSS> buffer_recv_callback_;
   bool transport_send_busy_;
   bool transport_recv_busy_;
   // corked_ is true if we are currently suspending writes to the network. This
   // is named after the similar kernel flag, TCP_CORK.
@@ skipping 33 matching lines @@
   int ssl_connection_status_;
 
   // Stores client authentication information between ClientAuthHandler and
   // GetSSLCertRequestInfo calls.
   std::vector<scoped_refptr<X509Certificate> > client_certs_;
   bool client_auth_cert_needed_;
 
   CertVerifier* const cert_verifier_;
   scoped_ptr<SingleRequestCertVerifier> verifier_;
 
+  // The mutually authenticated TLS username for the connection. This is only
+  // set after the handshake has succeeded with this username.
+  // If none, this is the empty string.
+  std::string authenticated_tls_username_;
+
   // True if NSS has called HandshakeCallback.
   bool handshake_callback_called_;
 
   // True if the SSL handshake has been completed.
   bool completed_handshake_;
 
   // True if we are lying about being connected in order to merge the first
   // Write call into a Snap Start handshake.
   bool pseudo_connected_;
 
   // True iff we believe that the user has an ESET product intercepting our
   // HTTPS connections.
   bool eset_mitm_detected_;
 
+  // False iff we are using an SRP cipher suite that doesn't use server certs.
+  // Default is true.
+  bool server_cert_needed_;
+
   // True iff |ssl_host_info_| contained a predicted certificate chain and
   // that we found the prediction to be correct.
   bool predicted_cert_chain_correct_;
 
   // True if the peer name has been initialized.
   bool peername_initialized_;
 
   // This pointer is owned by the caller of UseDNSSEC.
   DNSSECProvider* dnssec_provider_;
   // The time when we started waiting for DNSSEC records.
@@ skipping 19 matching lines @@
 
   base::TimeTicks start_cert_verification_time_;
 
   scoped_ptr<SSLHostInfo> ssl_host_info_;
   DnsCertProvenanceChecker* const dns_cert_checker_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_