| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
| 6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
| 7 | 7 |
| 8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
| 9 | 9 |
| 10 #include <errno.h> | 10 #include <errno.h> |
| 11 #include <openssl/bio.h> | 11 #include <openssl/bio.h> |
| 12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
| 13 #include <openssl/ssl.h> | 13 #include <openssl/ssl.h> |
| 14 | 14 |
| 15 #include "base/bind.h" | 15 #include "base/bind.h" |
| 16 #include "base/callback_helpers.h" | 16 #include "base/callback_helpers.h" |
| 17 #include "base/environment.h" | 17 #include "base/environment.h" |
| 18 #include "base/memory/singleton.h" | 18 #include "base/memory/singleton.h" |
| 19 #include "base/metrics/histogram.h" | 19 #include "base/metrics/histogram.h" |
| 20 #include "base/profiler/scoped_tracker.h" |
| 20 #include "base/strings/string_piece.h" | 21 #include "base/strings/string_piece.h" |
| 21 #include "base/synchronization/lock.h" | 22 #include "base/synchronization/lock.h" |
| 22 #include "crypto/ec_private_key.h" | 23 #include "crypto/ec_private_key.h" |
| 23 #include "crypto/openssl_util.h" | 24 #include "crypto/openssl_util.h" |
| 24 #include "crypto/scoped_openssl_types.h" | 25 #include "crypto/scoped_openssl_types.h" |
| 25 #include "net/base/net_errors.h" | 26 #include "net/base/net_errors.h" |
| 26 #include "net/cert/cert_verifier.h" | 27 #include "net/cert/cert_verifier.h" |
| 27 #include "net/cert/ct_ev_whitelist.h" | 28 #include "net/cert/ct_ev_whitelist.h" |
| 28 #include "net/cert/ct_verifier.h" | 29 #include "net/cert/ct_verifier.h" |
| 29 #include "net/cert/single_request_cert_verifier.h" | 30 #include "net/cert/single_request_cert_verifier.h" |
| (...skipping 862 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 892 rv = BufferSend(); | 893 rv = BufferSend(); |
| 893 if (rv != ERR_IO_PENDING && rv != 0) | 894 if (rv != ERR_IO_PENDING && rv != 0) |
| 894 network_moved = true; | 895 network_moved = true; |
| 895 } while (rv > 0); | 896 } while (rv > 0); |
| 896 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) | 897 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) |
| 897 network_moved = true; | 898 network_moved = true; |
| 898 return network_moved; | 899 return network_moved; |
| 899 } | 900 } |
| 900 | 901 |
| 901 int SSLClientSocketOpenSSL::DoHandshake() { | 902 int SSLClientSocketOpenSSL::DoHandshake() { |
| 903 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 904 tracked_objects::ScopedTracker tracking_profile1( |
| 905 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 906 "424386 SSLClientSocketOpenSSL::DoHandshake1")); |
| 907 |
| 902 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 908 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 903 int net_error = OK; | 909 int net_error = OK; |
| 904 int rv = SSL_do_handshake(ssl_); | 910 int rv = SSL_do_handshake(ssl_); |
| 905 | 911 |
| 912 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 913 tracked_objects::ScopedTracker tracking_profile2( |
| 914 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 915 "424386 SSLClientSocketOpenSSL::DoHandshake2")); |
| 916 |
| 906 if (client_auth_cert_needed_) { | 917 if (client_auth_cert_needed_) { |
| 907 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; | 918 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; |
| 908 // If the handshake already succeeded (because the server requests but | 919 // If the handshake already succeeded (because the server requests but |
| 909 // doesn't require a client cert), we need to invalidate the SSL session | 920 // doesn't require a client cert), we need to invalidate the SSL session |
| 910 // so that we won't try to resume the non-client-authenticated session in | 921 // so that we won't try to resume the non-client-authenticated session in |
| 911 // the next handshake. This will cause the server to ask for a client | 922 // the next handshake. This will cause the server to ask for a client |
| 912 // cert again. | 923 // cert again. |
| 913 if (rv == 1) { | 924 if (rv == 1) { |
| 914 // Remove from session cache but don't clear this connection. | 925 // Remove from session cache but don't clear this connection. |
| 915 SSL_SESSION* session = SSL_get_session(ssl_); | 926 SSL_SESSION* session = SSL_get_session(ssl_); |
| (...skipping 685 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1601 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); | 1612 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); |
| 1602 // A write into a memory BIO should always succeed. | 1613 // A write into a memory BIO should always succeed. |
| 1603 DCHECK_EQ(result, ret); | 1614 DCHECK_EQ(result, ret); |
| 1604 } | 1615 } |
| 1605 recv_buffer_ = NULL; | 1616 recv_buffer_ = NULL; |
| 1606 transport_recv_busy_ = false; | 1617 transport_recv_busy_ = false; |
| 1607 return result; | 1618 return result; |
| 1608 } | 1619 } |
| 1609 | 1620 |
| 1610 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { | 1621 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { |
| 1622 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1623 tracked_objects::ScopedTracker tracking_profile( |
| 1624 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1625 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback")); |
| 1626 |
| 1611 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; | 1627 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; |
| 1612 DCHECK(ssl == ssl_); | 1628 DCHECK(ssl == ssl_); |
| 1613 | 1629 |
| 1614 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); | 1630 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); |
| 1615 | 1631 |
| 1616 // Clear any currently configured certificates. | 1632 // Clear any currently configured certificates. |
| 1617 SSL_certs_clear(ssl_); | 1633 SSL_certs_clear(ssl_); |
| 1618 | 1634 |
| 1619 #if defined(OS_IOS) | 1635 #if defined(OS_IOS) |
| 1620 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). | 1636 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). |
| (...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1698 } | 1714 } |
| 1699 #endif // defined(OS_IOS) | 1715 #endif // defined(OS_IOS) |
| 1700 | 1716 |
| 1701 // Send no client certificate. | 1717 // Send no client certificate. |
| 1702 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, | 1718 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, |
| 1703 NetLog::IntegerCallback("cert_count", 0)); | 1719 NetLog::IntegerCallback("cert_count", 0)); |
| 1704 return 1; | 1720 return 1; |
| 1705 } | 1721 } |
| 1706 | 1722 |
| 1707 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { | 1723 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { |
| 1724 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1725 tracked_objects::ScopedTracker tracking_profile( |
| 1726 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1727 "424386 SSLClientSocketOpenSSL::CertVerifyCallback")); |
| 1728 |
| 1708 if (!completed_connect_) { | 1729 if (!completed_connect_) { |
| 1709 // If the first handshake hasn't completed then we accept any certificates | 1730 // If the first handshake hasn't completed then we accept any certificates |
| 1710 // because we verify after the handshake. | 1731 // because we verify after the handshake. |
| 1711 return 1; | 1732 return 1; |
| 1712 } | 1733 } |
| 1713 | 1734 |
| 1714 // Disallow the server certificate to change in a renegotiation. | 1735 // Disallow the server certificate to change in a renegotiation. |
| 1715 if (server_cert_chain_->empty()) { | 1736 if (server_cert_chain_->empty()) { |
| 1716 LOG(ERROR) << "Received invalid certificate chain between handshakes"; | 1737 LOG(ERROR) << "Received invalid certificate chain between handshakes"; |
| 1717 return 0; | 1738 return 0; |
| (...skipping 14 matching lines...) Expand all Loading... |
| 1732 } | 1753 } |
| 1733 | 1754 |
| 1734 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the | 1755 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the |
| 1735 // server supports NPN, selects a protocol from the list that the server | 1756 // server supports NPN, selects a protocol from the list that the server |
| 1736 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the | 1757 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the |
| 1737 // callback can assume that |in| is syntactically valid. | 1758 // callback can assume that |in| is syntactically valid. |
| 1738 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, | 1759 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, |
| 1739 unsigned char* outlen, | 1760 unsigned char* outlen, |
| 1740 const unsigned char* in, | 1761 const unsigned char* in, |
| 1741 unsigned int inlen) { | 1762 unsigned int inlen) { |
| 1763 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. |
| 1764 tracked_objects::ScopedTracker tracking_profile( |
| 1765 FROM_HERE_WITH_EXPLICIT_FUNCTION( |
| 1766 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback")); |
| 1767 |
| 1742 if (ssl_config_.next_protos.empty()) { | 1768 if (ssl_config_.next_protos.empty()) { |
| 1743 *out = reinterpret_cast<uint8*>( | 1769 *out = reinterpret_cast<uint8*>( |
| 1744 const_cast<char*>(kDefaultSupportedNPNProtocol)); | 1770 const_cast<char*>(kDefaultSupportedNPNProtocol)); |
| 1745 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; | 1771 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; |
| 1746 npn_status_ = kNextProtoUnsupported; | 1772 npn_status_ = kNextProtoUnsupported; |
| 1747 return SSL_TLSEXT_ERR_OK; | 1773 return SSL_TLSEXT_ERR_OK; |
| 1748 } | 1774 } |
| 1749 | 1775 |
| 1750 // Assume there's no overlap between our protocols and the server's list. | 1776 // Assume there's no overlap between our protocols and the server's list. |
| 1751 npn_status_ = kNextProtoNoOverlap; | 1777 npn_status_ = kNextProtoNoOverlap; |
| (...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1873 ct::SCT_STATUS_LOG_UNKNOWN)); | 1899 ct::SCT_STATUS_LOG_UNKNOWN)); |
| 1874 } | 1900 } |
| 1875 } | 1901 } |
| 1876 | 1902 |
| 1877 scoped_refptr<X509Certificate> | 1903 scoped_refptr<X509Certificate> |
| 1878 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1904 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
| 1879 return server_cert_; | 1905 return server_cert_; |
| 1880 } | 1906 } |
| 1881 | 1907 |
| 1882 } // namespace net | 1908 } // namespace net |
| OLD | NEW |