OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
7 | 7 |
8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
9 | 9 |
10 #include <errno.h> | 10 #include <errno.h> |
11 #include <openssl/bio.h> | 11 #include <openssl/bio.h> |
12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
13 #include <openssl/ssl.h> | 13 #include <openssl/ssl.h> |
14 #include <string.h> | 14 #include <string.h> |
15 | 15 |
16 #include "base/bind.h" | 16 #include "base/bind.h" |
17 #include "base/callback_helpers.h" | 17 #include "base/callback_helpers.h" |
18 #include "base/environment.h" | 18 #include "base/environment.h" |
19 #include "base/memory/singleton.h" | 19 #include "base/memory/singleton.h" |
20 #include "base/metrics/histogram.h" | 20 #include "base/metrics/histogram.h" |
| 21 #include "base/metrics/sparse_histogram.h" |
21 #include "base/profiler/scoped_tracker.h" | 22 #include "base/profiler/scoped_tracker.h" |
22 #include "base/strings/string_piece.h" | 23 #include "base/strings/string_piece.h" |
23 #include "base/synchronization/lock.h" | 24 #include "base/synchronization/lock.h" |
24 #include "base/threading/thread_local.h" | 25 #include "base/threading/thread_local.h" |
25 #include "crypto/ec_private_key.h" | 26 #include "crypto/ec_private_key.h" |
26 #include "crypto/openssl_util.h" | 27 #include "crypto/openssl_util.h" |
27 #include "crypto/scoped_openssl_types.h" | 28 #include "crypto/scoped_openssl_types.h" |
28 #include "net/base/net_errors.h" | 29 #include "net/base/net_errors.h" |
29 #include "net/cert/cert_policy_enforcer.h" | 30 #include "net/cert/cert_policy_enforcer.h" |
30 #include "net/cert/cert_verifier.h" | 31 #include "net/cert/cert_verifier.h" |
(...skipping 153 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
184 | 185 |
185 SSLContext() { | 186 SSLContext() { |
186 crypto::EnsureOpenSSLInit(); | 187 crypto::EnsureOpenSSLInit(); |
187 ssl_socket_data_index_ = SSL_get_ex_new_index(0, 0, 0, 0, 0); | 188 ssl_socket_data_index_ = SSL_get_ex_new_index(0, 0, 0, 0, 0); |
188 DCHECK_NE(ssl_socket_data_index_, -1); | 189 DCHECK_NE(ssl_socket_data_index_, -1); |
189 ssl_ctx_.reset(SSL_CTX_new(SSLv23_client_method())); | 190 ssl_ctx_.reset(SSL_CTX_new(SSLv23_client_method())); |
190 session_cache_.Reset(ssl_ctx_.get(), kDefaultSessionCacheConfig); | 191 session_cache_.Reset(ssl_ctx_.get(), kDefaultSessionCacheConfig); |
191 SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(), CertVerifyCallback, NULL); | 192 SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(), CertVerifyCallback, NULL); |
192 SSL_CTX_set_cert_cb(ssl_ctx_.get(), ClientCertRequestCallback, NULL); | 193 SSL_CTX_set_cert_cb(ssl_ctx_.get(), ClientCertRequestCallback, NULL); |
193 SSL_CTX_set_verify(ssl_ctx_.get(), SSL_VERIFY_PEER, NULL); | 194 SSL_CTX_set_verify(ssl_ctx_.get(), SSL_VERIFY_PEER, NULL); |
| 195 // This stops |SSL_shutdown| from generating the close_notify message, which |
| 196 // is currently not sent on the network. |
| 197 // TODO(haavardm): Remove setting quiet shutdown once 118366 is fixed. |
| 198 SSL_CTX_set_quiet_shutdown(ssl_ctx_.get(), 1); |
194 // TODO(kristianm): Only select this if ssl_config_.next_proto is not empty. | 199 // TODO(kristianm): Only select this if ssl_config_.next_proto is not empty. |
195 // It would be better if the callback were not a global setting, | 200 // It would be better if the callback were not a global setting, |
196 // but that is an OpenSSL issue. | 201 // but that is an OpenSSL issue. |
197 SSL_CTX_set_next_proto_select_cb(ssl_ctx_.get(), SelectNextProtoCallback, | 202 SSL_CTX_set_next_proto_select_cb(ssl_ctx_.get(), SelectNextProtoCallback, |
198 NULL); | 203 NULL); |
199 ssl_ctx_->tlsext_channel_id_enabled_new = 1; | 204 ssl_ctx_->tlsext_channel_id_enabled_new = 1; |
200 | 205 |
201 scoped_ptr<base::Environment> env(base::Environment::Create()); | 206 scoped_ptr<base::Environment> env(base::Environment::Create()); |
202 std::string ssl_keylog_file; | 207 std::string ssl_keylog_file; |
203 if (env->GetVar("SSLKEYLOGFILE", &ssl_keylog_file) && | 208 if (env->GetVar("SSLKEYLOGFILE", &ssl_keylog_file) && |
(...skipping 257 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
461 // It is an error to create an SSLClientSocket whose context has no | 466 // It is an error to create an SSLClientSocket whose context has no |
462 // TransportSecurityState. | 467 // TransportSecurityState. |
463 DCHECK(transport_security_state_); | 468 DCHECK(transport_security_state_); |
464 | 469 |
465 net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT); | 470 net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT); |
466 | 471 |
467 // Set up new ssl object. | 472 // Set up new ssl object. |
468 int rv = Init(); | 473 int rv = Init(); |
469 if (rv != OK) { | 474 if (rv != OK) { |
470 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); | 475 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); |
| 476 UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error", std::abs(rv)); |
471 return rv; | 477 return rv; |
472 } | 478 } |
473 | 479 |
474 // Set SSL to client mode. Handshake happens in the loop below. | 480 // Set SSL to client mode. Handshake happens in the loop below. |
475 SSL_set_connect_state(ssl_); | 481 SSL_set_connect_state(ssl_); |
476 | 482 |
477 GotoState(STATE_HANDSHAKE); | 483 GotoState(STATE_HANDSHAKE); |
478 rv = DoHandshakeLoop(OK); | 484 rv = DoHandshakeLoop(OK); |
479 if (rv == ERR_IO_PENDING) { | 485 if (rv == ERR_IO_PENDING) { |
480 user_connect_callback_ = callback; | 486 user_connect_callback_ = callback; |
481 } else { | 487 } else { |
482 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); | 488 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); |
| 489 UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error", std::abs(rv)); |
483 if (rv < OK) | 490 if (rv < OK) |
484 OnHandshakeCompletion(); | 491 OnHandshakeCompletion(); |
485 } | 492 } |
486 | 493 |
487 return rv > OK ? OK : rv; | 494 return rv > OK ? OK : rv; |
488 } | 495 } |
489 | 496 |
490 void SSLClientSocketOpenSSL::Disconnect() { | 497 void SSLClientSocketOpenSSL::Disconnect() { |
491 // If a handshake was pending (Connect() had been called), notify interested | 498 // If a handshake was pending (Connect() had been called), notify interested |
492 // parties that it's been aborted now. If the handshake had already | 499 // parties that it's been aborted now. If the handshake had already |
(...skipping 859 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1352 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; | 1359 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; |
1353 } | 1360 } |
1354 } | 1361 } |
1355 } | 1362 } |
1356 } | 1363 } |
1357 | 1364 |
1358 void SSLClientSocketOpenSSL::OnHandshakeIOComplete(int result) { | 1365 void SSLClientSocketOpenSSL::OnHandshakeIOComplete(int result) { |
1359 int rv = DoHandshakeLoop(result); | 1366 int rv = DoHandshakeLoop(result); |
1360 if (rv != ERR_IO_PENDING) { | 1367 if (rv != ERR_IO_PENDING) { |
1361 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); | 1368 net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); |
| 1369 UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error", std::abs(rv)); |
1362 DoConnectCallback(rv); | 1370 DoConnectCallback(rv); |
1363 } | 1371 } |
1364 } | 1372 } |
1365 | 1373 |
1366 void SSLClientSocketOpenSSL::OnSendComplete(int result) { | 1374 void SSLClientSocketOpenSSL::OnSendComplete(int result) { |
1367 if (next_handshake_state_ == STATE_HANDSHAKE) { | 1375 if (next_handshake_state_ == STATE_HANDSHAKE) { |
1368 // In handshake phase. | 1376 // In handshake phase. |
1369 OnHandshakeIOComplete(result); | 1377 OnHandshakeIOComplete(result); |
1370 return; | 1378 return; |
1371 } | 1379 } |
(...skipping 643 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2015 ct::SCT_STATUS_LOG_UNKNOWN)); | 2023 ct::SCT_STATUS_LOG_UNKNOWN)); |
2016 } | 2024 } |
2017 } | 2025 } |
2018 | 2026 |
2019 scoped_refptr<X509Certificate> | 2027 scoped_refptr<X509Certificate> |
2020 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 2028 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
2021 return server_cert_; | 2029 return server_cert_; |
2022 } | 2030 } |
2023 | 2031 |
2024 } // namespace net | 2032 } // namespace net |
OLD | NEW |