OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
7 | 7 |
8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
9 | 9 |
10 #include <errno.h> | 10 #include <errno.h> |
11 #include <openssl/bio.h> | 11 #include <openssl/bio.h> |
12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
13 #include <openssl/ssl.h> | 13 #include <openssl/ssl.h> |
14 | 14 |
15 #include "base/bind.h" | 15 #include "base/bind.h" |
16 #include "base/callback_helpers.h" | 16 #include "base/callback_helpers.h" |
17 #include "base/environment.h" | 17 #include "base/environment.h" |
18 #include "base/memory/singleton.h" | 18 #include "base/memory/singleton.h" |
19 #include "base/metrics/histogram.h" | 19 #include "base/metrics/histogram.h" |
| 20 #include "base/profiler/scoped_tracker.h" |
20 #include "base/strings/string_piece.h" | 21 #include "base/strings/string_piece.h" |
21 #include "base/synchronization/lock.h" | 22 #include "base/synchronization/lock.h" |
22 #include "crypto/ec_private_key.h" | 23 #include "crypto/ec_private_key.h" |
23 #include "crypto/openssl_util.h" | 24 #include "crypto/openssl_util.h" |
24 #include "crypto/scoped_openssl_types.h" | 25 #include "crypto/scoped_openssl_types.h" |
25 #include "net/base/net_errors.h" | 26 #include "net/base/net_errors.h" |
26 #include "net/cert/cert_verifier.h" | 27 #include "net/cert/cert_verifier.h" |
27 #include "net/cert/ct_ev_whitelist.h" | 28 #include "net/cert/ct_ev_whitelist.h" |
28 #include "net/cert/ct_verifier.h" | 29 #include "net/cert/ct_verifier.h" |
29 #include "net/cert/single_request_cert_verifier.h" | 30 #include "net/cert/single_request_cert_verifier.h" |
(...skipping 862 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
892 rv = BufferSend(); | 893 rv = BufferSend(); |
893 if (rv != ERR_IO_PENDING && rv != 0) | 894 if (rv != ERR_IO_PENDING && rv != 0) |
894 network_moved = true; | 895 network_moved = true; |
895 } while (rv > 0); | 896 } while (rv > 0); |
896 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) | 897 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) |
897 network_moved = true; | 898 network_moved = true; |
898 return network_moved; | 899 return network_moved; |
899 } | 900 } |
900 | 901 |
901 int SSLClientSocketOpenSSL::DoHandshake() { | 902 int SSLClientSocketOpenSSL::DoHandshake() { |
| 903 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 904 tracked_objects::ScopedTracker tracking_profile1( |
| 905 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 906 "424386 SSLClientSocketOpenSSL::DoHandshake1")); |
| 907 |
902 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 908 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
903 int net_error = OK; | 909 int net_error = OK; |
904 int rv = SSL_do_handshake(ssl_); | 910 int rv = SSL_do_handshake(ssl_); |
905 | 911 |
| 912 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 913 tracked_objects::ScopedTracker tracking_profile2( |
| 914 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 915 "424386 SSLClientSocketOpenSSL::DoHandshake2")); |
| 916 |
906 if (client_auth_cert_needed_) { | 917 if (client_auth_cert_needed_) { |
907 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; | 918 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; |
908 // If the handshake already succeeded (because the server requests but | 919 // If the handshake already succeeded (because the server requests but |
909 // doesn't require a client cert), we need to invalidate the SSL session | 920 // doesn't require a client cert), we need to invalidate the SSL session |
910 // so that we won't try to resume the non-client-authenticated session in | 921 // so that we won't try to resume the non-client-authenticated session in |
911 // the next handshake. This will cause the server to ask for a client | 922 // the next handshake. This will cause the server to ask for a client |
912 // cert again. | 923 // cert again. |
913 if (rv == 1) { | 924 if (rv == 1) { |
914 // Remove from session cache but don't clear this connection. | 925 // Remove from session cache but don't clear this connection. |
915 SSL_SESSION* session = SSL_get_session(ssl_); | 926 SSL_SESSION* session = SSL_get_session(ssl_); |
(...skipping 685 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1601 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); | 1612 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); |
1602 // A write into a memory BIO should always succeed. | 1613 // A write into a memory BIO should always succeed. |
1603 DCHECK_EQ(result, ret); | 1614 DCHECK_EQ(result, ret); |
1604 } | 1615 } |
1605 recv_buffer_ = NULL; | 1616 recv_buffer_ = NULL; |
1606 transport_recv_busy_ = false; | 1617 transport_recv_busy_ = false; |
1607 return result; | 1618 return result; |
1608 } | 1619 } |
1609 | 1620 |
1610 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { | 1621 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { |
| 1622 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1623 tracked_objects::ScopedTracker tracking_profile( |
| 1624 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1625 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback")); |
| 1626 |
1611 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; | 1627 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; |
1612 DCHECK(ssl == ssl_); | 1628 DCHECK(ssl == ssl_); |
1613 | 1629 |
1614 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); | 1630 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); |
1615 | 1631 |
1616 // Clear any currently configured certificates. | 1632 // Clear any currently configured certificates. |
1617 SSL_certs_clear(ssl_); | 1633 SSL_certs_clear(ssl_); |
1618 | 1634 |
1619 #if defined(OS_IOS) | 1635 #if defined(OS_IOS) |
1620 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). | 1636 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1698 } | 1714 } |
1699 #endif // defined(OS_IOS) | 1715 #endif // defined(OS_IOS) |
1700 | 1716 |
1701 // Send no client certificate. | 1717 // Send no client certificate. |
1702 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1718 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, |
1703 NetLog::IntegerCallback("cert_count", 0)); | 1719 NetLog::IntegerCallback("cert_count", 0)); |
1704 return 1; | 1720 return 1; |
1705 } | 1721 } |
1706 | 1722 |
1707 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { | 1723 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { |
| 1724 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1725 tracked_objects::ScopedTracker tracking_profile( |
| 1726 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1727 "424386 SSLClientSocketOpenSSL::CertVerifyCallback")); |
| 1728 |
1708 if (!completed_connect_) { | 1729 if (!completed_connect_) { |
1709 // If the first handshake hasn't completed then we accept any certificates | 1730 // If the first handshake hasn't completed then we accept any certificates |
1710 // because we verify after the handshake. | 1731 // because we verify after the handshake. |
1711 return 1; | 1732 return 1; |
1712 } | 1733 } |
1713 | 1734 |
1714 // Disallow the server certificate to change in a renegotiation. | 1735 // Disallow the server certificate to change in a renegotiation. |
1715 if (server_cert_chain_->empty()) { | 1736 if (server_cert_chain_->empty()) { |
1716 LOG(ERROR) << "Received invalid certificate chain between handshakes"; | 1737 LOG(ERROR) << "Received invalid certificate chain between handshakes"; |
1717 return 0; | 1738 return 0; |
(...skipping 14 matching lines...) Expand all Loading... |
1732 } | 1753 } |
1733 | 1754 |
1734 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the | 1755 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the |
1735 // server supports NPN, selects a protocol from the list that the server | 1756 // server supports NPN, selects a protocol from the list that the server |
1736 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the | 1757 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the |
1737 // callback can assume that |in| is syntactically valid. | 1758 // callback can assume that |in| is syntactically valid. |
1738 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, | 1759 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, |
1739 unsigned char* outlen, | 1760 unsigned char* outlen, |
1740 const unsigned char* in, | 1761 const unsigned char* in, |
1741 unsigned int inlen) { | 1762 unsigned int inlen) { |
| 1763 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1764 tracked_objects::ScopedTracker tracking_profile( |
| 1765 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1766 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback")); |
| 1767 |
1742 if (ssl_config_.next_protos.empty()) { | 1768 if (ssl_config_.next_protos.empty()) { |
1743 *out = reinterpret_cast<uint8*>( | 1769 *out = reinterpret_cast<uint8*>( |
1744 const_cast<char*>(kDefaultSupportedNPNProtocol)); | 1770 const_cast<char*>(kDefaultSupportedNPNProtocol)); |
1745 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; | 1771 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; |
1746 npn_status_ = kNextProtoUnsupported; | 1772 npn_status_ = kNextProtoUnsupported; |
1747 return SSL_TLSEXT_ERR_OK; | 1773 return SSL_TLSEXT_ERR_OK; |
1748 } | 1774 } |
1749 | 1775 |
1750 // Assume there's no overlap between our protocols and the server's list. | 1776 // Assume there's no overlap between our protocols and the server's list. |
1751 npn_status_ = kNextProtoNoOverlap; | 1777 npn_status_ = kNextProtoNoOverlap; |
(...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1873 ct::SCT_STATUS_LOG_UNKNOWN)); | 1899 ct::SCT_STATUS_LOG_UNKNOWN)); |
1874 } | 1900 } |
1875 } | 1901 } |
1876 | 1902 |
1877 scoped_refptr<X509Certificate> | 1903 scoped_refptr<X509Certificate> |
1878 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1904 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
1879 return server_cert_; | 1905 return server_cert_; |
1880 } | 1906 } |
1881 | 1907 |
1882 } // namespace net | 1908 } // namespace net |
OLD | NEW |