Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(105)

Side by Side Diff: net/socket/ssl_client_socket_openssl.cc

Issue 754433003: Update from https://crrev.com/305340 (Closed) Base URL: git@github.com:domokit/mojo.git@master
Patch Set: Created 6 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle
6 // of operation is derived from SSLClientSocketNSS. 6 // of operation is derived from SSLClientSocketNSS.
7 7
8 #include "net/socket/ssl_client_socket_openssl.h" 8 #include "net/socket/ssl_client_socket_openssl.h"
9 9
10 #include <errno.h> 10 #include <errno.h>
11 #include <openssl/bio.h> 11 #include <openssl/bio.h>
12 #include <openssl/err.h> 12 #include <openssl/err.h>
13 #include <openssl/ssl.h> 13 #include <openssl/ssl.h>
14 14
15 #include "base/bind.h" 15 #include "base/bind.h"
16 #include "base/callback_helpers.h" 16 #include "base/callback_helpers.h"
17 #include "base/environment.h" 17 #include "base/environment.h"
18 #include "base/memory/singleton.h" 18 #include "base/memory/singleton.h"
19 #include "base/metrics/histogram.h" 19 #include "base/metrics/histogram.h"
20 #include "base/profiler/scoped_tracker.h"
20 #include "base/strings/string_piece.h" 21 #include "base/strings/string_piece.h"
21 #include "base/synchronization/lock.h" 22 #include "base/synchronization/lock.h"
22 #include "crypto/ec_private_key.h" 23 #include "crypto/ec_private_key.h"
23 #include "crypto/openssl_util.h" 24 #include "crypto/openssl_util.h"
24 #include "crypto/scoped_openssl_types.h" 25 #include "crypto/scoped_openssl_types.h"
25 #include "net/base/net_errors.h" 26 #include "net/base/net_errors.h"
26 #include "net/cert/cert_verifier.h" 27 #include "net/cert/cert_verifier.h"
27 #include "net/cert/ct_ev_whitelist.h" 28 #include "net/cert/ct_ev_whitelist.h"
28 #include "net/cert/ct_verifier.h" 29 #include "net/cert/ct_verifier.h"
29 #include "net/cert/single_request_cert_verifier.h" 30 #include "net/cert/single_request_cert_verifier.h"
(...skipping 862 matching lines...) Expand 10 before | Expand all | Expand 10 after
892 rv = BufferSend(); 893 rv = BufferSend();
893 if (rv != ERR_IO_PENDING && rv != 0) 894 if (rv != ERR_IO_PENDING && rv != 0)
894 network_moved = true; 895 network_moved = true;
895 } while (rv > 0); 896 } while (rv > 0);
896 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) 897 if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING)
897 network_moved = true; 898 network_moved = true;
898 return network_moved; 899 return network_moved;
899 } 900 }
900 901
901 int SSLClientSocketOpenSSL::DoHandshake() { 902 int SSLClientSocketOpenSSL::DoHandshake() {
903 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
904 tracked_objects::ScopedTracker tracking_profile1(
905 FROM_HERE_WITH_EXPLICIT_FUNCTION(
906 "424386 SSLClientSocketOpenSSL::DoHandshake1"));
907
902 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); 908 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
903 int net_error = OK; 909 int net_error = OK;
904 int rv = SSL_do_handshake(ssl_); 910 int rv = SSL_do_handshake(ssl_);
905 911
912 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
913 tracked_objects::ScopedTracker tracking_profile2(
914 FROM_HERE_WITH_EXPLICIT_FUNCTION(
915 "424386 SSLClientSocketOpenSSL::DoHandshake2"));
916
906 if (client_auth_cert_needed_) { 917 if (client_auth_cert_needed_) {
907 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; 918 net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
908 // If the handshake already succeeded (because the server requests but 919 // If the handshake already succeeded (because the server requests but
909 // doesn't require a client cert), we need to invalidate the SSL session 920 // doesn't require a client cert), we need to invalidate the SSL session
910 // so that we won't try to resume the non-client-authenticated session in 921 // so that we won't try to resume the non-client-authenticated session in
911 // the next handshake. This will cause the server to ask for a client 922 // the next handshake. This will cause the server to ask for a client
912 // cert again. 923 // cert again.
913 if (rv == 1) { 924 if (rv == 1) {
914 // Remove from session cache but don't clear this connection. 925 // Remove from session cache but don't clear this connection.
915 SSL_SESSION* session = SSL_get_session(ssl_); 926 SSL_SESSION* session = SSL_get_session(ssl_);
(...skipping 685 matching lines...) Expand 10 before | Expand all | Expand 10 after
1601 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result); 1612 int ret = BIO_write(transport_bio_, recv_buffer_->data(), result);
1602 // A write into a memory BIO should always succeed. 1613 // A write into a memory BIO should always succeed.
1603 DCHECK_EQ(result, ret); 1614 DCHECK_EQ(result, ret);
1604 } 1615 }
1605 recv_buffer_ = NULL; 1616 recv_buffer_ = NULL;
1606 transport_recv_busy_ = false; 1617 transport_recv_busy_ = false;
1607 return result; 1618 return result;
1608 } 1619 }
1609 1620
1610 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { 1621 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) {
1622 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1623 tracked_objects::ScopedTracker tracking_profile(
1624 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1625 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback"));
1626
1611 DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; 1627 DVLOG(3) << "OpenSSL ClientCertRequestCallback called";
1612 DCHECK(ssl == ssl_); 1628 DCHECK(ssl == ssl_);
1613 1629
1614 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); 1630 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED);
1615 1631
1616 // Clear any currently configured certificates. 1632 // Clear any currently configured certificates.
1617 SSL_certs_clear(ssl_); 1633 SSL_certs_clear(ssl_);
1618 1634
1619 #if defined(OS_IOS) 1635 #if defined(OS_IOS)
1620 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). 1636 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954).
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after
1698 } 1714 }
1699 #endif // defined(OS_IOS) 1715 #endif // defined(OS_IOS)
1700 1716
1701 // Send no client certificate. 1717 // Send no client certificate.
1702 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, 1718 net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED,
1703 NetLog::IntegerCallback("cert_count", 0)); 1719 NetLog::IntegerCallback("cert_count", 0));
1704 return 1; 1720 return 1;
1705 } 1721 }
1706 1722
1707 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { 1723 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
1724 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1725 tracked_objects::ScopedTracker tracking_profile(
1726 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1727 "424386 SSLClientSocketOpenSSL::CertVerifyCallback"));
1728
1708 if (!completed_connect_) { 1729 if (!completed_connect_) {
1709 // If the first handshake hasn't completed then we accept any certificates 1730 // If the first handshake hasn't completed then we accept any certificates
1710 // because we verify after the handshake. 1731 // because we verify after the handshake.
1711 return 1; 1732 return 1;
1712 } 1733 }
1713 1734
1714 // Disallow the server certificate to change in a renegotiation. 1735 // Disallow the server certificate to change in a renegotiation.
1715 if (server_cert_chain_->empty()) { 1736 if (server_cert_chain_->empty()) {
1716 LOG(ERROR) << "Received invalid certificate chain between handshakes"; 1737 LOG(ERROR) << "Received invalid certificate chain between handshakes";
1717 return 0; 1738 return 0;
(...skipping 14 matching lines...) Expand all
1732 } 1753 }
1733 1754
1734 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the 1755 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the
1735 // server supports NPN, selects a protocol from the list that the server 1756 // server supports NPN, selects a protocol from the list that the server
1736 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the 1757 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the
1737 // callback can assume that |in| is syntactically valid. 1758 // callback can assume that |in| is syntactically valid.
1738 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, 1759 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out,
1739 unsigned char* outlen, 1760 unsigned char* outlen,
1740 const unsigned char* in, 1761 const unsigned char* in,
1741 unsigned int inlen) { 1762 unsigned int inlen) {
1763 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1764 tracked_objects::ScopedTracker tracking_profile(
1765 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1766 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback"));
1767
1742 if (ssl_config_.next_protos.empty()) { 1768 if (ssl_config_.next_protos.empty()) {
1743 *out = reinterpret_cast<uint8*>( 1769 *out = reinterpret_cast<uint8*>(
1744 const_cast<char*>(kDefaultSupportedNPNProtocol)); 1770 const_cast<char*>(kDefaultSupportedNPNProtocol));
1745 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; 1771 *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1;
1746 npn_status_ = kNextProtoUnsupported; 1772 npn_status_ = kNextProtoUnsupported;
1747 return SSL_TLSEXT_ERR_OK; 1773 return SSL_TLSEXT_ERR_OK;
1748 } 1774 }
1749 1775
1750 // Assume there's no overlap between our protocols and the server's list. 1776 // Assume there's no overlap between our protocols and the server's list.
1751 npn_status_ = kNextProtoNoOverlap; 1777 npn_status_ = kNextProtoNoOverlap;
(...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after
1873 ct::SCT_STATUS_LOG_UNKNOWN)); 1899 ct::SCT_STATUS_LOG_UNKNOWN));
1874 } 1900 }
1875 } 1901 }
1876 1902
1877 scoped_refptr<X509Certificate> 1903 scoped_refptr<X509Certificate>
1878 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { 1904 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
1879 return server_cert_; 1905 return server_cert_;
1880 } 1906 }
1881 1907
1882 } // namespace net 1908 } // namespace net
OLDNEW
« no previous file with comments | « net/socket/socks_client_socket_unittest.cc ('k') | net/socket/ssl_client_socket_pool_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698