OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | |
6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | |
7 | |
8 #include <string> | |
9 | |
10 #include "base/compiler_specific.h" | |
11 #include "base/memory/scoped_ptr.h" | |
12 #include "base/memory/weak_ptr.h" | |
13 #include "net/base/completion_callback.h" | |
14 #include "net/base/io_buffer.h" | |
15 #include "net/cert/cert_verify_result.h" | |
16 #include "net/cert/ct_verify_result.h" | |
17 #include "net/socket/client_socket_handle.h" | |
18 #include "net/socket/ssl_client_socket.h" | |
19 #include "net/ssl/channel_id_service.h" | |
20 #include "net/ssl/openssl_ssl_util.h" | |
21 #include "net/ssl/ssl_client_cert_type.h" | |
22 #include "net/ssl/ssl_config_service.h" | |
23 | |
24 // Avoid including misc OpenSSL headers, i.e.: | |
25 // <openssl/bio.h> | |
26 typedef struct bio_st BIO; | |
27 // <openssl/evp.h> | |
28 typedef struct evp_pkey_st EVP_PKEY; | |
29 // <openssl/ssl.h> | |
30 typedef struct ssl_st SSL; | |
31 // <openssl/x509.h> | |
32 typedef struct x509_st X509; | |
33 // <openssl/ossl_type.h> | |
34 typedef struct x509_store_ctx_st X509_STORE_CTX; | |
35 | |
36 namespace net { | |
37 | |
38 class CertVerifier; | |
39 class CTVerifier; | |
40 class SingleRequestCertVerifier; | |
41 class SSLCertRequestInfo; | |
42 class SSLInfo; | |
43 | |
44 // An SSL client socket implemented with OpenSSL. | |
45 class SSLClientSocketOpenSSL : public SSLClientSocket { | |
46 public: | |
47 // Takes ownership of the transport_socket, which may already be connected. | |
48 // The given hostname will be compared with the name(s) in the server's | |
49 // certificate during the SSL handshake. ssl_config specifies the SSL | |
50 // settings. | |
51 SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket, | |
52 const HostPortPair& host_and_port, | |
53 const SSLConfig& ssl_config, | |
54 const SSLClientSocketContext& context); | |
55 ~SSLClientSocketOpenSSL() override; | |
56 | |
57 const HostPortPair& host_and_port() const { return host_and_port_; } | |
58 const std::string& ssl_session_cache_shard() const { | |
59 return ssl_session_cache_shard_; | |
60 } | |
61 | |
62 // SSLClientSocket implementation. | |
63 std::string GetSessionCacheKey() const override; | |
64 bool InSessionCache() const override; | |
65 void SetHandshakeCompletionCallback(const base::Closure& callback) override; | |
66 void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info) override; | |
67 NextProtoStatus GetNextProto(std::string* proto) override; | |
68 ChannelIDService* GetChannelIDService() const override; | |
69 | |
70 // SSLSocket implementation. | |
71 int ExportKeyingMaterial(const base::StringPiece& label, | |
72 bool has_context, | |
73 const base::StringPiece& context, | |
74 unsigned char* out, | |
75 unsigned int outlen) override; | |
76 int GetTLSUniqueChannelBinding(std::string* out) override; | |
77 | |
78 // StreamSocket implementation. | |
79 int Connect(const CompletionCallback& callback) override; | |
80 void Disconnect() override; | |
81 bool IsConnected() const override; | |
82 bool IsConnectedAndIdle() const override; | |
83 int GetPeerAddress(IPEndPoint* address) const override; | |
84 int GetLocalAddress(IPEndPoint* address) const override; | |
85 const BoundNetLog& NetLog() const override; | |
86 void SetSubresourceSpeculation() override; | |
87 void SetOmniboxSpeculation() override; | |
88 bool WasEverUsed() const override; | |
89 bool UsingTCPFastOpen() const override; | |
90 bool GetSSLInfo(SSLInfo* ssl_info) override; | |
91 | |
92 // Socket implementation. | |
93 int Read(IOBuffer* buf, | |
94 int buf_len, | |
95 const CompletionCallback& callback) override; | |
96 int Write(IOBuffer* buf, | |
97 int buf_len, | |
98 const CompletionCallback& callback) override; | |
99 int SetReceiveBufferSize(int32 size) override; | |
100 int SetSendBufferSize(int32 size) override; | |
101 | |
102 protected: | |
103 // SSLClientSocket implementation. | |
104 scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain() | |
105 const override; | |
106 | |
107 private: | |
108 class PeerCertificateChain; | |
109 class SSLContext; | |
110 friend class SSLClientSocket; | |
111 friend class SSLContext; | |
112 | |
113 int Init(); | |
114 void DoReadCallback(int result); | |
115 void DoWriteCallback(int result); | |
116 | |
117 void OnHandshakeCompletion(); | |
118 | |
119 bool DoTransportIO(); | |
120 int DoHandshake(); | |
121 int DoChannelIDLookup(); | |
122 int DoChannelIDLookupComplete(int result); | |
123 int DoVerifyCert(int result); | |
124 int DoVerifyCertComplete(int result); | |
125 void DoConnectCallback(int result); | |
126 void UpdateServerCert(); | |
127 void VerifyCT(); | |
128 | |
129 void OnHandshakeIOComplete(int result); | |
130 void OnSendComplete(int result); | |
131 void OnRecvComplete(int result); | |
132 | |
133 int DoHandshakeLoop(int last_io_result); | |
134 int DoReadLoop(); | |
135 int DoWriteLoop(); | |
136 int DoPayloadRead(); | |
137 int DoPayloadWrite(); | |
138 | |
139 int BufferSend(); | |
140 int BufferRecv(); | |
141 void BufferSendComplete(int result); | |
142 void BufferRecvComplete(int result); | |
143 void TransportWriteComplete(int result); | |
144 int TransportReadComplete(int result); | |
145 | |
146 // Callback from the SSL layer that indicates the remote server is requesting | |
147 // a certificate for this client. | |
148 int ClientCertRequestCallback(SSL* ssl); | |
149 | |
150 // CertVerifyCallback is called to verify the server's certificates. We do | |
151 // verification after the handshake so this function only enforces that the | |
152 // certificates don't change during renegotiation. | |
153 int CertVerifyCallback(X509_STORE_CTX *store_ctx); | |
154 | |
155 // Callback from the SSL layer to check which NPN protocol we are supporting | |
156 int SelectNextProtoCallback(unsigned char** out, unsigned char* outlen, | |
157 const unsigned char* in, unsigned int inlen); | |
158 | |
159 // Called during an operation on |transport_bio_|'s peer. Checks saved | |
160 // transport error state and, if appropriate, returns an error through | |
161 // OpenSSL's error system. | |
162 long MaybeReplayTransportError(BIO *bio, | |
163 int cmd, | |
164 const char *argp, int argi, long argl, | |
165 long retvalue); | |
166 | |
167 // Callback from the SSL layer when an operation is performed on | |
168 // |transport_bio_|'s peer. | |
169 static long BIOCallback(BIO *bio, | |
170 int cmd, | |
171 const char *argp, int argi, long argl, | |
172 long retvalue); | |
173 | |
174 // Callback that is used to obtain information about the state of the SSL | |
175 // handshake. | |
176 static void InfoCallback(const SSL* ssl, int type, int val); | |
177 | |
178 void CheckIfHandshakeFinished(); | |
179 | |
180 // Adds the SignedCertificateTimestamps from ct_verify_result_ to |ssl_info|. | |
181 // SCTs are held in three separate vectors in ct_verify_result, each | |
182 // vetor representing a particular verification state, this method associates | |
183 // each of the SCTs with the corresponding SCTVerifyStatus as it adds it to | |
184 // the |ssl_info|.signed_certificate_timestamps list. | |
185 void AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const; | |
186 | |
187 bool transport_send_busy_; | |
188 bool transport_recv_busy_; | |
189 | |
190 // Buffers which are shared by BoringSSL and SSLClientSocketOpenSSL. | |
191 // GrowableIOBuffer is used to keep ownership and setting offset. | |
192 scoped_refptr<GrowableIOBuffer> send_buffer_; | |
193 scoped_refptr<GrowableIOBuffer> recv_buffer_; | |
194 | |
195 CompletionCallback user_connect_callback_; | |
196 CompletionCallback user_read_callback_; | |
197 CompletionCallback user_write_callback_; | |
198 | |
199 // Used by Read function. | |
200 scoped_refptr<IOBuffer> user_read_buf_; | |
201 int user_read_buf_len_; | |
202 | |
203 // Used by Write function. | |
204 scoped_refptr<IOBuffer> user_write_buf_; | |
205 int user_write_buf_len_; | |
206 | |
207 // Used by DoPayloadRead() when attempting to fill the caller's buffer with | |
208 // as much data as possible without blocking. | |
209 // If DoPayloadRead() encounters an error after having read some data, stores | |
210 // the result to return on the *next* call to DoPayloadRead(). A value > 0 | |
211 // indicates there is no pending result, otherwise 0 indicates EOF and < 0 | |
212 // indicates an error. | |
213 int pending_read_error_; | |
214 | |
215 // If there is a pending read result, the OpenSSL result code (output of | |
216 // SSL_get_error) associated with it. | |
217 int pending_read_ssl_error_; | |
218 | |
219 // If there is a pending read result, the OpenSSLErrorInfo associated with it. | |
220 OpenSSLErrorInfo pending_read_error_info_; | |
221 | |
222 // Used by TransportReadComplete() to signify an error reading from the | |
223 // transport socket. A value of OK indicates the socket is still | |
224 // readable. EOFs are mapped to ERR_CONNECTION_CLOSED. | |
225 int transport_read_error_; | |
226 | |
227 // Used by TransportWriteComplete() and TransportReadComplete() to signify an | |
228 // error writing to the transport socket. A value of OK indicates no error. | |
229 int transport_write_error_; | |
230 | |
231 // Set when Connect finishes. | |
232 scoped_ptr<PeerCertificateChain> server_cert_chain_; | |
233 scoped_refptr<X509Certificate> server_cert_; | |
234 CertVerifyResult server_cert_verify_result_; | |
235 bool completed_connect_; | |
236 | |
237 // Set when Read() or Write() successfully reads or writes data to or from the | |
238 // network. | |
239 bool was_ever_used_; | |
240 | |
241 // Stores client authentication information between ClientAuthHandler and | |
242 // GetSSLCertRequestInfo calls. | |
243 bool client_auth_cert_needed_; | |
244 // List of DER-encoded X.509 DistinguishedName of certificate authorities | |
245 // allowed by the server. | |
246 std::vector<std::string> cert_authorities_; | |
247 // List of SSLClientCertType values for client certificates allowed by the | |
248 // server. | |
249 std::vector<SSLClientCertType> cert_key_types_; | |
250 | |
251 CertVerifier* const cert_verifier_; | |
252 scoped_ptr<SingleRequestCertVerifier> verifier_; | |
253 base::TimeTicks start_cert_verification_time_; | |
254 | |
255 // Certificate Transparency: Verifier and result holder. | |
256 ct::CTVerifyResult ct_verify_result_; | |
257 CTVerifier* cert_transparency_verifier_; | |
258 | |
259 // The service for retrieving Channel ID keys. May be NULL. | |
260 ChannelIDService* channel_id_service_; | |
261 | |
262 // Callback that is invoked when the connection finishes. | |
263 // | |
264 // Note: this callback will be run in Disconnect(). It will not alter | |
265 // any member variables of the SSLClientSocketOpenSSL. | |
266 base::Closure handshake_completion_callback_; | |
267 | |
268 // OpenSSL stuff | |
269 SSL* ssl_; | |
270 BIO* transport_bio_; | |
271 | |
272 scoped_ptr<ClientSocketHandle> transport_; | |
273 const HostPortPair host_and_port_; | |
274 SSLConfig ssl_config_; | |
275 // ssl_session_cache_shard_ is an opaque string that partitions the SSL | |
276 // session cache. i.e. sessions created with one value will not attempt to | |
277 // resume on the socket with a different value. | |
278 const std::string ssl_session_cache_shard_; | |
279 | |
280 // Used for session cache diagnostics. | |
281 bool trying_cached_session_; | |
282 | |
283 enum State { | |
284 STATE_NONE, | |
285 STATE_HANDSHAKE, | |
286 STATE_CHANNEL_ID_LOOKUP, | |
287 STATE_CHANNEL_ID_LOOKUP_COMPLETE, | |
288 STATE_VERIFY_CERT, | |
289 STATE_VERIFY_CERT_COMPLETE, | |
290 }; | |
291 State next_handshake_state_; | |
292 NextProtoStatus npn_status_; | |
293 std::string npn_proto_; | |
294 // Written by the |channel_id_service_|. | |
295 std::string channel_id_private_key_; | |
296 std::string channel_id_cert_; | |
297 // True if channel ID extension was negotiated. | |
298 bool channel_id_xtn_negotiated_; | |
299 // True if InfoCallback has been run with result = SSL_CB_HANDSHAKE_DONE. | |
300 bool handshake_succeeded_; | |
301 // True if MarkSSLSessionAsGood has been called for this socket's | |
302 // SSL session. | |
303 bool marked_session_as_good_; | |
304 // The request handle for |channel_id_service_|. | |
305 ChannelIDService::RequestHandle channel_id_request_handle_; | |
306 | |
307 TransportSecurityState* transport_security_state_; | |
308 | |
309 CertPolicyEnforcer* const policy_enforcer_; | |
310 | |
311 // pinning_failure_log contains a message produced by | |
312 // TransportSecurityState::CheckPublicKeyPins in the event of a | |
313 // pinning failure. It is a (somewhat) human-readable string. | |
314 std::string pinning_failure_log_; | |
315 | |
316 BoundNetLog net_log_; | |
317 base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_; | |
318 }; | |
319 | |
320 } // namespace net | |
321 | |
322 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_ | |
OLD | NEW |