| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/socket/nss_ssl_util.h" | |
| 6 | |
| 7 #include <nss.h> | |
| 8 #include <secerr.h> | |
| 9 #include <ssl.h> | |
| 10 #include <sslerr.h> | |
| 11 #include <sslproto.h> | |
| 12 | |
| 13 #include <string> | |
| 14 | |
| 15 #include "base/bind.h" | |
| 16 #include "base/cpu.h" | |
| 17 #include "base/lazy_instance.h" | |
| 18 #include "base/logging.h" | |
| 19 #include "base/memory/singleton.h" | |
| 20 #include "base/threading/thread_restrictions.h" | |
| 21 #include "base/values.h" | |
| 22 #include "build/build_config.h" | |
| 23 #include "crypto/nss_util.h" | |
| 24 #include "net/base/net_errors.h" | |
| 25 #include "net/base/net_log.h" | |
| 26 #include "net/base/nss_memio.h" | |
| 27 | |
| 28 #if defined(OS_WIN) | |
| 29 #include "base/win/windows_version.h" | |
| 30 #endif | |
| 31 | |
| 32 namespace net { | |
| 33 | |
| 34 namespace { | |
| 35 | |
| 36 // CiphersRemove takes a zero-terminated array of cipher suite ids in | |
| 37 // |to_remove| and sets every instance of them in |ciphers| to zero. It returns | |
| 38 // true if it found and removed every element of |to_remove|. It assumes that | |
| 39 // there are no duplicates in |ciphers| nor in |to_remove|. | |
| 40 bool CiphersRemove(const uint16* to_remove, uint16* ciphers, size_t num) { | |
| 41 size_t i, found = 0; | |
| 42 | |
| 43 for (i = 0; ; i++) { | |
| 44 if (to_remove[i] == 0) | |
| 45 break; | |
| 46 | |
| 47 for (size_t j = 0; j < num; j++) { | |
| 48 if (to_remove[i] == ciphers[j]) { | |
| 49 ciphers[j] = 0; | |
| 50 found++; | |
| 51 break; | |
| 52 } | |
| 53 } | |
| 54 } | |
| 55 | |
| 56 return found == i; | |
| 57 } | |
| 58 | |
| 59 // CiphersCompact takes an array of cipher suite ids in |ciphers|, where some | |
| 60 // entries are zero, and moves the entries so that all the non-zero elements | |
| 61 // are compacted at the end of the array. | |
| 62 void CiphersCompact(uint16* ciphers, size_t num) { | |
| 63 size_t j = num - 1; | |
| 64 | |
| 65 for (size_t i = num - 1; i < num; i--) { | |
| 66 if (ciphers[i] == 0) | |
| 67 continue; | |
| 68 ciphers[j--] = ciphers[i]; | |
| 69 } | |
| 70 } | |
| 71 | |
| 72 // CiphersCopy copies the zero-terminated array |in| to |out|. It returns the | |
| 73 // number of cipher suite ids copied. | |
| 74 size_t CiphersCopy(const uint16* in, uint16* out) { | |
| 75 for (size_t i = 0; ; i++) { | |
| 76 if (in[i] == 0) | |
| 77 return i; | |
| 78 out[i] = in[i]; | |
| 79 } | |
| 80 } | |
| 81 | |
| 82 base::Value* NetLogSSLErrorCallback(int net_error, | |
| 83 int ssl_lib_error, | |
| 84 NetLog::LogLevel /* log_level */) { | |
| 85 base::DictionaryValue* dict = new base::DictionaryValue(); | |
| 86 dict->SetInteger("net_error", net_error); | |
| 87 if (ssl_lib_error) | |
| 88 dict->SetInteger("ssl_lib_error", ssl_lib_error); | |
| 89 return dict; | |
| 90 } | |
| 91 | |
| 92 class NSSSSLInitSingleton { | |
| 93 public: | |
| 94 NSSSSLInitSingleton() : model_fd_(NULL) { | |
| 95 crypto::EnsureNSSInit(); | |
| 96 | |
| 97 NSS_SetDomesticPolicy(); | |
| 98 | |
| 99 const PRUint16* const ssl_ciphers = SSL_GetImplementedCiphers(); | |
| 100 const PRUint16 num_ciphers = SSL_GetNumImplementedCiphers(); | |
| 101 | |
| 102 // Disable ECDSA cipher suites on platforms that do not support ECDSA | |
| 103 // signed certificates, as servers may use the presence of such | |
| 104 // ciphersuites as a hint to send an ECDSA certificate. | |
| 105 bool disableECDSA = false; | |
| 106 #if defined(OS_WIN) | |
| 107 if (base::win::GetVersion() < base::win::VERSION_VISTA) | |
| 108 disableECDSA = true; | |
| 109 #endif | |
| 110 | |
| 111 // Explicitly enable exactly those ciphers with keys of at least 80 bits | |
| 112 for (int i = 0; i < num_ciphers; i++) { | |
| 113 SSLCipherSuiteInfo info; | |
| 114 if (SSL_GetCipherSuiteInfo(ssl_ciphers[i], &info, | |
| 115 sizeof(info)) == SECSuccess) { | |
| 116 bool enabled = info.effectiveKeyBits >= 80; | |
| 117 if (info.authAlgorithm == ssl_auth_ecdsa && disableECDSA) | |
| 118 enabled = false; | |
| 119 | |
| 120 // Trim the list of cipher suites in order to keep the size of the | |
| 121 // ClientHello down. DSS, ECDH, CAMELLIA, SEED, ECC+3DES, and | |
| 122 // HMAC-SHA256 cipher suites are disabled. | |
| 123 if (info.symCipher == ssl_calg_camellia || | |
| 124 info.symCipher == ssl_calg_seed || | |
| 125 (info.symCipher == ssl_calg_3des && info.keaType != ssl_kea_rsa) || | |
| 126 info.authAlgorithm == ssl_auth_dsa || | |
| 127 info.macAlgorithm == ssl_hmac_sha256 || | |
| 128 info.nonStandard || | |
| 129 strcmp(info.keaTypeName, "ECDH") == 0) { | |
| 130 enabled = false; | |
| 131 } | |
| 132 | |
| 133 if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) { | |
| 134 // Enabled to allow servers with only a DSA certificate to function. | |
| 135 enabled = true; | |
| 136 } | |
| 137 SSL_CipherPrefSetDefault(ssl_ciphers[i], enabled); | |
| 138 } | |
| 139 } | |
| 140 | |
| 141 // Enable SSL. | |
| 142 SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE); | |
| 143 | |
| 144 // Calculate the order of ciphers that we'll use for NSS sockets. (Note | |
| 145 // that, even if a cipher is specified in the ordering, it must still be | |
| 146 // enabled in order to be included in a ClientHello.) | |
| 147 // | |
| 148 // Our top preference cipher suites are either forward-secret AES-GCM or | |
| 149 // forward-secret ChaCha20-Poly1305. If the local machine has AES-NI then | |
| 150 // we prefer AES-GCM, otherwise ChaCha20. The remainder of the cipher suite | |
| 151 // preference is inheriented from NSS. */ | |
| 152 static const uint16 chacha_ciphers[] = { | |
| 153 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, | |
| 154 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, | |
| 155 0, | |
| 156 }; | |
| 157 static const uint16 aes_gcm_ciphers[] = { | |
| 158 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, | |
| 159 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, | |
| 160 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, | |
| 161 0, | |
| 162 }; | |
| 163 scoped_ptr<uint16[]> ciphers(new uint16[num_ciphers]); | |
| 164 memcpy(ciphers.get(), ssl_ciphers, sizeof(uint16)*num_ciphers); | |
| 165 | |
| 166 if (CiphersRemove(chacha_ciphers, ciphers.get(), num_ciphers) && | |
| 167 CiphersRemove(aes_gcm_ciphers, ciphers.get(), num_ciphers)) { | |
| 168 CiphersCompact(ciphers.get(), num_ciphers); | |
| 169 | |
| 170 const uint16* preference_ciphers = chacha_ciphers; | |
| 171 const uint16* other_ciphers = aes_gcm_ciphers; | |
| 172 base::CPU cpu; | |
| 173 | |
| 174 if (cpu.has_aesni() && cpu.has_avx()) { | |
| 175 preference_ciphers = aes_gcm_ciphers; | |
| 176 other_ciphers = chacha_ciphers; | |
| 177 } | |
| 178 unsigned i = CiphersCopy(preference_ciphers, ciphers.get()); | |
| 179 CiphersCopy(other_ciphers, &ciphers[i]); | |
| 180 | |
| 181 if ((model_fd_ = memio_CreateIOLayer(1, 1)) == NULL || | |
| 182 SSL_ImportFD(NULL, model_fd_) == NULL || | |
| 183 SECSuccess != | |
| 184 SSL_CipherOrderSet(model_fd_, ciphers.get(), num_ciphers)) { | |
| 185 NOTREACHED(); | |
| 186 if (model_fd_) { | |
| 187 PR_Close(model_fd_); | |
| 188 model_fd_ = NULL; | |
| 189 } | |
| 190 } | |
| 191 } | |
| 192 | |
| 193 // All other SSL options are set per-session by SSLClientSocket and | |
| 194 // SSLServerSocket. | |
| 195 } | |
| 196 | |
| 197 PRFileDesc* GetModelSocket() { | |
| 198 return model_fd_; | |
| 199 } | |
| 200 | |
| 201 ~NSSSSLInitSingleton() { | |
| 202 // Have to clear the cache, or NSS_Shutdown fails with SEC_ERROR_BUSY. | |
| 203 SSL_ClearSessionCache(); | |
| 204 if (model_fd_) | |
| 205 PR_Close(model_fd_); | |
| 206 } | |
| 207 | |
| 208 private: | |
| 209 PRFileDesc* model_fd_; | |
| 210 }; | |
| 211 | |
| 212 base::LazyInstance<NSSSSLInitSingleton>::Leaky g_nss_ssl_init_singleton = | |
| 213 LAZY_INSTANCE_INITIALIZER; | |
| 214 | |
| 215 } // anonymous namespace | |
| 216 | |
| 217 // Initialize the NSS SSL library if it isn't already initialized. This must | |
| 218 // be called before any other NSS SSL functions. This function is | |
| 219 // thread-safe, and the NSS SSL library will only ever be initialized once. | |
| 220 // The NSS SSL library will be properly shut down on program exit. | |
| 221 void EnsureNSSSSLInit() { | |
| 222 // Initializing SSL causes us to do blocking IO. | |
| 223 // Temporarily allow it until we fix | |
| 224 // http://code.google.com/p/chromium/issues/detail?id=59847 | |
| 225 base::ThreadRestrictions::ScopedAllowIO allow_io; | |
| 226 | |
| 227 g_nss_ssl_init_singleton.Get(); | |
| 228 } | |
| 229 | |
| 230 PRFileDesc* GetNSSModelSocket() { | |
| 231 return g_nss_ssl_init_singleton.Get().GetModelSocket(); | |
| 232 } | |
| 233 | |
| 234 // Map a Chromium net error code to an NSS error code. | |
| 235 // See _MD_unix_map_default_error in the NSS source | |
| 236 // tree for inspiration. | |
| 237 PRErrorCode MapErrorToNSS(int result) { | |
| 238 if (result >=0) | |
| 239 return result; | |
| 240 | |
| 241 switch (result) { | |
| 242 case ERR_IO_PENDING: | |
| 243 return PR_WOULD_BLOCK_ERROR; | |
| 244 case ERR_ACCESS_DENIED: | |
| 245 case ERR_NETWORK_ACCESS_DENIED: | |
| 246 // For connect, this could be mapped to PR_ADDRESS_NOT_SUPPORTED_ERROR. | |
| 247 return PR_NO_ACCESS_RIGHTS_ERROR; | |
| 248 case ERR_NOT_IMPLEMENTED: | |
| 249 return PR_NOT_IMPLEMENTED_ERROR; | |
| 250 case ERR_SOCKET_NOT_CONNECTED: | |
| 251 return PR_NOT_CONNECTED_ERROR; | |
| 252 case ERR_INTERNET_DISCONNECTED: // Equivalent to ENETDOWN. | |
| 253 return PR_NETWORK_UNREACHABLE_ERROR; // Best approximation. | |
| 254 case ERR_CONNECTION_TIMED_OUT: | |
| 255 case ERR_TIMED_OUT: | |
| 256 return PR_IO_TIMEOUT_ERROR; | |
| 257 case ERR_CONNECTION_RESET: | |
| 258 return PR_CONNECT_RESET_ERROR; | |
| 259 case ERR_CONNECTION_ABORTED: | |
| 260 return PR_CONNECT_ABORTED_ERROR; | |
| 261 case ERR_CONNECTION_REFUSED: | |
| 262 return PR_CONNECT_REFUSED_ERROR; | |
| 263 case ERR_ADDRESS_UNREACHABLE: | |
| 264 return PR_HOST_UNREACHABLE_ERROR; // Also PR_NETWORK_UNREACHABLE_ERROR. | |
| 265 case ERR_ADDRESS_INVALID: | |
| 266 return PR_ADDRESS_NOT_AVAILABLE_ERROR; | |
| 267 case ERR_NAME_NOT_RESOLVED: | |
| 268 return PR_DIRECTORY_LOOKUP_ERROR; | |
| 269 default: | |
| 270 LOG(WARNING) << "MapErrorToNSS " << result | |
| 271 << " mapped to PR_UNKNOWN_ERROR"; | |
| 272 return PR_UNKNOWN_ERROR; | |
| 273 } | |
| 274 } | |
| 275 | |
| 276 // The default error mapping function. | |
| 277 // Maps an NSS error code to a network error code. | |
| 278 int MapNSSError(PRErrorCode err) { | |
| 279 // TODO(port): fill this out as we learn what's important | |
| 280 switch (err) { | |
| 281 case PR_WOULD_BLOCK_ERROR: | |
| 282 return ERR_IO_PENDING; | |
| 283 case PR_ADDRESS_NOT_SUPPORTED_ERROR: // For connect. | |
| 284 case PR_NO_ACCESS_RIGHTS_ERROR: | |
| 285 return ERR_ACCESS_DENIED; | |
| 286 case PR_IO_TIMEOUT_ERROR: | |
| 287 return ERR_TIMED_OUT; | |
| 288 case PR_CONNECT_RESET_ERROR: | |
| 289 return ERR_CONNECTION_RESET; | |
| 290 case PR_CONNECT_ABORTED_ERROR: | |
| 291 return ERR_CONNECTION_ABORTED; | |
| 292 case PR_CONNECT_REFUSED_ERROR: | |
| 293 return ERR_CONNECTION_REFUSED; | |
| 294 case PR_NOT_CONNECTED_ERROR: | |
| 295 return ERR_SOCKET_NOT_CONNECTED; | |
| 296 case PR_HOST_UNREACHABLE_ERROR: | |
| 297 case PR_NETWORK_UNREACHABLE_ERROR: | |
| 298 return ERR_ADDRESS_UNREACHABLE; | |
| 299 case PR_ADDRESS_NOT_AVAILABLE_ERROR: | |
| 300 return ERR_ADDRESS_INVALID; | |
| 301 case PR_INVALID_ARGUMENT_ERROR: | |
| 302 return ERR_INVALID_ARGUMENT; | |
| 303 case PR_END_OF_FILE_ERROR: | |
| 304 return ERR_CONNECTION_CLOSED; | |
| 305 case PR_NOT_IMPLEMENTED_ERROR: | |
| 306 return ERR_NOT_IMPLEMENTED; | |
| 307 | |
| 308 case SEC_ERROR_LIBRARY_FAILURE: | |
| 309 return ERR_UNEXPECTED; | |
| 310 case SEC_ERROR_INVALID_ARGS: | |
| 311 return ERR_INVALID_ARGUMENT; | |
| 312 case SEC_ERROR_NO_MEMORY: | |
| 313 return ERR_OUT_OF_MEMORY; | |
| 314 case SEC_ERROR_NO_KEY: | |
| 315 return ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY; | |
| 316 case SEC_ERROR_INVALID_KEY: | |
| 317 case SSL_ERROR_SIGN_HASHES_FAILURE: | |
| 318 LOG(ERROR) << "ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: NSS error " << err | |
| 319 << ", OS error " << PR_GetOSError(); | |
| 320 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED; | |
| 321 // A handshake (initial or renegotiation) may fail because some signature | |
| 322 // (for example, the signature in the ServerKeyExchange message for an | |
| 323 // ephemeral Diffie-Hellman cipher suite) is invalid. | |
| 324 case SEC_ERROR_BAD_SIGNATURE: | |
| 325 return ERR_SSL_PROTOCOL_ERROR; | |
| 326 | |
| 327 case SSL_ERROR_SSL_DISABLED: | |
| 328 return ERR_NO_SSL_VERSIONS_ENABLED; | |
| 329 case SSL_ERROR_NO_CYPHER_OVERLAP: | |
| 330 case SSL_ERROR_PROTOCOL_VERSION_ALERT: | |
| 331 case SSL_ERROR_UNSUPPORTED_VERSION: | |
| 332 return ERR_SSL_VERSION_OR_CIPHER_MISMATCH; | |
| 333 case SSL_ERROR_HANDSHAKE_FAILURE_ALERT: | |
| 334 case SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT: | |
| 335 case SSL_ERROR_ILLEGAL_PARAMETER_ALERT: | |
| 336 return ERR_SSL_PROTOCOL_ERROR; | |
| 337 case SSL_ERROR_DECOMPRESSION_FAILURE_ALERT: | |
| 338 return ERR_SSL_DECOMPRESSION_FAILURE_ALERT; | |
| 339 case SSL_ERROR_BAD_MAC_ALERT: | |
| 340 return ERR_SSL_BAD_RECORD_MAC_ALERT; | |
| 341 case SSL_ERROR_DECRYPT_ERROR_ALERT: | |
| 342 return ERR_SSL_DECRYPT_ERROR_ALERT; | |
| 343 case SSL_ERROR_UNRECOGNIZED_NAME_ALERT: | |
| 344 return ERR_SSL_UNRECOGNIZED_NAME_ALERT; | |
| 345 case SSL_ERROR_UNSAFE_NEGOTIATION: | |
| 346 return ERR_SSL_UNSAFE_NEGOTIATION; | |
| 347 case SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY: | |
| 348 return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY; | |
| 349 case SSL_ERROR_HANDSHAKE_NOT_COMPLETED: | |
| 350 return ERR_SSL_HANDSHAKE_NOT_COMPLETED; | |
| 351 case SEC_ERROR_BAD_KEY: | |
| 352 case SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE: | |
| 353 // TODO(wtc): the following errors may also occur in contexts unrelated | |
| 354 // to the peer's public key. We should add new error codes for them, or | |
| 355 // map them to ERR_SSL_BAD_PEER_PUBLIC_KEY only in the right context. | |
| 356 // General unsupported/unknown key algorithm error. | |
| 357 case SEC_ERROR_UNSUPPORTED_KEYALG: | |
| 358 // General DER decoding errors. | |
| 359 case SEC_ERROR_BAD_DER: | |
| 360 case SEC_ERROR_EXTRA_INPUT: | |
| 361 return ERR_SSL_BAD_PEER_PUBLIC_KEY; | |
| 362 // During renegotiation, the server presented a different certificate than | |
| 363 // was used earlier. | |
| 364 case SSL_ERROR_WRONG_CERTIFICATE: | |
| 365 return ERR_SSL_SERVER_CERT_CHANGED; | |
| 366 case SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT: | |
| 367 return ERR_SSL_INAPPROPRIATE_FALLBACK; | |
| 368 | |
| 369 default: { | |
| 370 const char* err_name = PR_ErrorToName(err); | |
| 371 if (err_name == NULL) | |
| 372 err_name = ""; | |
| 373 if (IS_SSL_ERROR(err)) { | |
| 374 LOG(WARNING) << "Unknown SSL error " << err << " (" << err_name << ")" | |
| 375 << " mapped to net::ERR_SSL_PROTOCOL_ERROR"; | |
| 376 return ERR_SSL_PROTOCOL_ERROR; | |
| 377 } | |
| 378 LOG(WARNING) << "Unknown error " << err << " (" << err_name << ")" | |
| 379 << " mapped to net::ERR_FAILED"; | |
| 380 return ERR_FAILED; | |
| 381 } | |
| 382 } | |
| 383 } | |
| 384 | |
| 385 // Returns parameters to attach to the NetLog when we receive an error in | |
| 386 // response to a call to an NSS function. Used instead of | |
| 387 // NetLogSSLErrorCallback with events of type TYPE_SSL_NSS_ERROR. | |
| 388 base::Value* NetLogSSLFailedNSSFunctionCallback( | |
| 389 const char* function, | |
| 390 const char* param, | |
| 391 int ssl_lib_error, | |
| 392 NetLog::LogLevel /* log_level */) { | |
| 393 base::DictionaryValue* dict = new base::DictionaryValue(); | |
| 394 dict->SetString("function", function); | |
| 395 if (param[0] != '\0') | |
| 396 dict->SetString("param", param); | |
| 397 dict->SetInteger("ssl_lib_error", ssl_lib_error); | |
| 398 return dict; | |
| 399 } | |
| 400 | |
| 401 void LogFailedNSSFunction(const BoundNetLog& net_log, | |
| 402 const char* function, | |
| 403 const char* param) { | |
| 404 DCHECK(function); | |
| 405 DCHECK(param); | |
| 406 net_log.AddEvent( | |
| 407 NetLog::TYPE_SSL_NSS_ERROR, | |
| 408 base::Bind(&NetLogSSLFailedNSSFunctionCallback, | |
| 409 function, param, PR_GetError())); | |
| 410 } | |
| 411 | |
| 412 NetLog::ParametersCallback CreateNetLogSSLErrorCallback(int net_error, | |
| 413 int ssl_lib_error) { | |
| 414 return base::Bind(&NetLogSSLErrorCallback, net_error, ssl_lib_error); | |
| 415 } | |
| 416 | |
| 417 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master