OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_ | |
6 #define NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_ | |
7 | |
8 #include <map> | |
9 #include <string> | |
10 #include <vector> | |
11 | |
12 #include "base/memory/ref_counted.h" | |
13 #include "base/memory/scoped_ptr.h" | |
14 #include "base/time/time.h" | |
15 #include "net/base/privacy_mode.h" | |
16 #include "net/http/http_response_info.h" | |
17 #include "net/socket/client_socket_pool.h" | |
18 #include "net/socket/client_socket_pool_base.h" | |
19 #include "net/socket/client_socket_pool_histograms.h" | |
20 #include "net/socket/ssl_client_socket.h" | |
21 #include "net/ssl/ssl_config_service.h" | |
22 | |
23 namespace net { | |
24 | |
25 class CertPolicyEnforcer; | |
26 class CertVerifier; | |
27 class ClientSocketFactory; | |
28 class ConnectJobFactory; | |
29 class CTVerifier; | |
30 class HostPortPair; | |
31 class HttpProxyClientSocketPool; | |
32 class HttpProxySocketParams; | |
33 class SOCKSClientSocketPool; | |
34 class SOCKSSocketParams; | |
35 class SSLClientSocket; | |
36 class TransportClientSocketPool; | |
37 class TransportSecurityState; | |
38 class TransportSocketParams; | |
39 | |
40 class NET_EXPORT_PRIVATE SSLSocketParams | |
41 : public base::RefCounted<SSLSocketParams> { | |
42 public: | |
43 enum ConnectionType { DIRECT, SOCKS_PROXY, HTTP_PROXY }; | |
44 | |
45 // Exactly one of |direct_params|, |socks_proxy_params|, and | |
46 // |http_proxy_params| must be non-NULL. | |
47 SSLSocketParams( | |
48 const scoped_refptr<TransportSocketParams>& direct_params, | |
49 const scoped_refptr<SOCKSSocketParams>& socks_proxy_params, | |
50 const scoped_refptr<HttpProxySocketParams>& http_proxy_params, | |
51 const HostPortPair& host_and_port, | |
52 const SSLConfig& ssl_config, | |
53 PrivacyMode privacy_mode, | |
54 int load_flags, | |
55 bool force_spdy_over_ssl, | |
56 bool want_spdy_over_npn); | |
57 | |
58 // Returns the type of the underlying connection. | |
59 ConnectionType GetConnectionType() const; | |
60 | |
61 // Must be called only when GetConnectionType() returns DIRECT. | |
62 const scoped_refptr<TransportSocketParams>& | |
63 GetDirectConnectionParams() const; | |
64 | |
65 // Must be called only when GetConnectionType() returns SOCKS_PROXY. | |
66 const scoped_refptr<SOCKSSocketParams>& | |
67 GetSocksProxyConnectionParams() const; | |
68 | |
69 // Must be called only when GetConnectionType() returns HTTP_PROXY. | |
70 const scoped_refptr<HttpProxySocketParams>& | |
71 GetHttpProxyConnectionParams() const; | |
72 | |
73 const HostPortPair& host_and_port() const { return host_and_port_; } | |
74 const SSLConfig& ssl_config() const { return ssl_config_; } | |
75 PrivacyMode privacy_mode() const { return privacy_mode_; } | |
76 int load_flags() const { return load_flags_; } | |
77 bool force_spdy_over_ssl() const { return force_spdy_over_ssl_; } | |
78 bool want_spdy_over_npn() const { return want_spdy_over_npn_; } | |
79 bool ignore_limits() const { return ignore_limits_; } | |
80 | |
81 private: | |
82 friend class base::RefCounted<SSLSocketParams>; | |
83 ~SSLSocketParams(); | |
84 | |
85 const scoped_refptr<TransportSocketParams> direct_params_; | |
86 const scoped_refptr<SOCKSSocketParams> socks_proxy_params_; | |
87 const scoped_refptr<HttpProxySocketParams> http_proxy_params_; | |
88 const HostPortPair host_and_port_; | |
89 const SSLConfig ssl_config_; | |
90 const PrivacyMode privacy_mode_; | |
91 const int load_flags_; | |
92 const bool force_spdy_over_ssl_; | |
93 const bool want_spdy_over_npn_; | |
94 bool ignore_limits_; | |
95 | |
96 DISALLOW_COPY_AND_ASSIGN(SSLSocketParams); | |
97 }; | |
98 | |
99 // SSLConnectJobMessenger handles communication between concurrent | |
100 // SSLConnectJobs that share the same SSL session cache key. | |
101 // | |
102 // SSLConnectJobMessengers tell the session cache when a certain | |
103 // connection should be monitored for success or failure, and | |
104 // tell SSLConnectJobs when to pause or resume their connections. | |
105 class SSLConnectJobMessenger { | |
106 public: | |
107 struct SocketAndCallback { | |
108 SocketAndCallback(SSLClientSocket* ssl_socket, | |
109 const base::Closure& job_resumption_callback); | |
110 ~SocketAndCallback(); | |
111 | |
112 SSLClientSocket* socket; | |
113 base::Closure callback; | |
114 }; | |
115 | |
116 typedef std::vector<SocketAndCallback> SSLPendingSocketsAndCallbacks; | |
117 | |
118 // |messenger_finished_callback| is run when a connection monitored by the | |
119 // SSLConnectJobMessenger has completed and we are finished with the | |
120 // SSLConnectJobMessenger. | |
121 explicit SSLConnectJobMessenger( | |
122 const base::Closure& messenger_finished_callback); | |
123 ~SSLConnectJobMessenger(); | |
124 | |
125 // Removes |socket| from the set of sockets being monitored. This | |
126 // guarantees that |job_resumption_callback| will not be called for | |
127 // the socket. | |
128 void RemovePendingSocket(SSLClientSocket* ssl_socket); | |
129 | |
130 // Returns true if |ssl_socket|'s Connect() method should be called. | |
131 bool CanProceed(SSLClientSocket* ssl_socket); | |
132 | |
133 // Configures the SSLConnectJobMessenger to begin monitoring |ssl_socket|'s | |
134 // connection status. After a successful connection, or an error, | |
135 // the messenger will determine which sockets that have been added | |
136 // via AddPendingSocket() to allow to proceed. | |
137 void MonitorConnectionResult(SSLClientSocket* ssl_socket); | |
138 | |
139 // Adds |socket| to the list of sockets waiting to Connect(). When | |
140 // the messenger has determined that it's an appropriate time for |socket| | |
141 // to connect, it will invoke |callback|. | |
142 // | |
143 // Note: It is an error to call AddPendingSocket() without having first | |
144 // called MonitorConnectionResult() and configuring a socket that WILL | |
145 // have Connect() called on it. | |
146 void AddPendingSocket(SSLClientSocket* ssl_socket, | |
147 const base::Closure& callback); | |
148 | |
149 private: | |
150 // Processes pending callbacks when a socket completes its SSL handshake -- | |
151 // either successfully or unsuccessfully. | |
152 void OnSSLHandshakeCompleted(); | |
153 | |
154 // Runs all callbacks stored in |pending_sockets_and_callbacks_|. | |
155 void RunAllCallbacks( | |
156 const SSLPendingSocketsAndCallbacks& pending_socket_and_callbacks); | |
157 | |
158 SSLPendingSocketsAndCallbacks pending_sockets_and_callbacks_; | |
159 // Note: this field is a vector to allow for future design changes. Currently, | |
160 // this vector should only ever have one entry. | |
161 std::vector<SSLClientSocket*> connecting_sockets_; | |
162 | |
163 base::Closure messenger_finished_callback_; | |
164 | |
165 base::WeakPtrFactory<SSLConnectJobMessenger> weak_factory_; | |
166 }; | |
167 | |
168 // SSLConnectJob handles the SSL handshake after setting up the underlying | |
169 // connection as specified in the params. | |
170 class SSLConnectJob : public ConnectJob { | |
171 public: | |
172 // Callback to allow the SSLConnectJob to obtain an SSLConnectJobMessenger to | |
173 // coordinate connecting. The SSLConnectJob will supply a unique identifer | |
174 // (ex: the SSL session cache key), with the expectation that the same | |
175 // Messenger will be returned for all such ConnectJobs. | |
176 // | |
177 // Note: It will only be called for situations where the SSL session cache | |
178 // does not already have a candidate session to resume. | |
179 typedef base::Callback<SSLConnectJobMessenger*(const std::string&)> | |
180 GetMessengerCallback; | |
181 | |
182 // Note: the SSLConnectJob does not own |messenger| so it must outlive the | |
183 // job. | |
184 SSLConnectJob(const std::string& group_name, | |
185 RequestPriority priority, | |
186 const scoped_refptr<SSLSocketParams>& params, | |
187 const base::TimeDelta& timeout_duration, | |
188 TransportClientSocketPool* transport_pool, | |
189 SOCKSClientSocketPool* socks_pool, | |
190 HttpProxyClientSocketPool* http_proxy_pool, | |
191 ClientSocketFactory* client_socket_factory, | |
192 const SSLClientSocketContext& context, | |
193 const GetMessengerCallback& get_messenger_callback, | |
194 Delegate* delegate, | |
195 NetLog* net_log); | |
196 ~SSLConnectJob() override; | |
197 | |
198 // ConnectJob methods. | |
199 LoadState GetLoadState() const override; | |
200 | |
201 void GetAdditionalErrorState(ClientSocketHandle* handle) override; | |
202 | |
203 private: | |
204 enum State { | |
205 STATE_TRANSPORT_CONNECT, | |
206 STATE_TRANSPORT_CONNECT_COMPLETE, | |
207 STATE_SOCKS_CONNECT, | |
208 STATE_SOCKS_CONNECT_COMPLETE, | |
209 STATE_TUNNEL_CONNECT, | |
210 STATE_TUNNEL_CONNECT_COMPLETE, | |
211 STATE_CREATE_SSL_SOCKET, | |
212 STATE_CHECK_FOR_RESUME, | |
213 STATE_SSL_CONNECT, | |
214 STATE_SSL_CONNECT_COMPLETE, | |
215 STATE_NONE, | |
216 }; | |
217 | |
218 void OnIOComplete(int result); | |
219 | |
220 // Runs the state transition loop. | |
221 int DoLoop(int result); | |
222 | |
223 int DoTransportConnect(); | |
224 int DoTransportConnectComplete(int result); | |
225 int DoSOCKSConnect(); | |
226 int DoSOCKSConnectComplete(int result); | |
227 int DoTunnelConnect(); | |
228 int DoTunnelConnectComplete(int result); | |
229 int DoCreateSSLSocket(); | |
230 int DoCheckForResume(); | |
231 int DoSSLConnect(); | |
232 int DoSSLConnectComplete(int result); | |
233 | |
234 // Tells a waiting SSLConnectJob to resume its SSL connection. | |
235 void ResumeSSLConnection(); | |
236 | |
237 // Returns the initial state for the state machine based on the | |
238 // |connection_type|. | |
239 static State GetInitialState(SSLSocketParams::ConnectionType connection_type); | |
240 | |
241 // Starts the SSL connection process. Returns OK on success and | |
242 // ERR_IO_PENDING if it cannot immediately service the request. | |
243 // Otherwise, it returns a net error code. | |
244 int ConnectInternal() override; | |
245 | |
246 scoped_refptr<SSLSocketParams> params_; | |
247 TransportClientSocketPool* const transport_pool_; | |
248 SOCKSClientSocketPool* const socks_pool_; | |
249 HttpProxyClientSocketPool* const http_proxy_pool_; | |
250 ClientSocketFactory* const client_socket_factory_; | |
251 | |
252 const SSLClientSocketContext context_; | |
253 | |
254 State next_state_; | |
255 CompletionCallback io_callback_; | |
256 scoped_ptr<ClientSocketHandle> transport_socket_handle_; | |
257 scoped_ptr<SSLClientSocket> ssl_socket_; | |
258 | |
259 SSLConnectJobMessenger* messenger_; | |
260 HttpResponseInfo error_response_info_; | |
261 | |
262 GetMessengerCallback get_messenger_callback_; | |
263 | |
264 base::WeakPtrFactory<SSLConnectJob> weak_factory_; | |
265 | |
266 DISALLOW_COPY_AND_ASSIGN(SSLConnectJob); | |
267 }; | |
268 | |
269 class NET_EXPORT_PRIVATE SSLClientSocketPool | |
270 : public ClientSocketPool, | |
271 public HigherLayeredPool, | |
272 public SSLConfigService::Observer { | |
273 public: | |
274 typedef SSLSocketParams SocketParams; | |
275 | |
276 // Only the pools that will be used are required. i.e. if you never | |
277 // try to create an SSL over SOCKS socket, |socks_pool| may be NULL. | |
278 SSLClientSocketPool(int max_sockets, | |
279 int max_sockets_per_group, | |
280 ClientSocketPoolHistograms* histograms, | |
281 CertVerifier* cert_verifier, | |
282 ChannelIDService* channel_id_service, | |
283 TransportSecurityState* transport_security_state, | |
284 CTVerifier* cert_transparency_verifier, | |
285 CertPolicyEnforcer* cert_policy_enforcer, | |
286 const std::string& ssl_session_cache_shard, | |
287 ClientSocketFactory* client_socket_factory, | |
288 TransportClientSocketPool* transport_pool, | |
289 SOCKSClientSocketPool* socks_pool, | |
290 HttpProxyClientSocketPool* http_proxy_pool, | |
291 SSLConfigService* ssl_config_service, | |
292 bool enable_ssl_connect_job_waiting, | |
293 NetLog* net_log); | |
294 | |
295 ~SSLClientSocketPool() override; | |
296 | |
297 // ClientSocketPool implementation. | |
298 int RequestSocket(const std::string& group_name, | |
299 const void* connect_params, | |
300 RequestPriority priority, | |
301 ClientSocketHandle* handle, | |
302 const CompletionCallback& callback, | |
303 const BoundNetLog& net_log) override; | |
304 | |
305 void RequestSockets(const std::string& group_name, | |
306 const void* params, | |
307 int num_sockets, | |
308 const BoundNetLog& net_log) override; | |
309 | |
310 void CancelRequest(const std::string& group_name, | |
311 ClientSocketHandle* handle) override; | |
312 | |
313 void ReleaseSocket(const std::string& group_name, | |
314 scoped_ptr<StreamSocket> socket, | |
315 int id) override; | |
316 | |
317 void FlushWithError(int error) override; | |
318 | |
319 void CloseIdleSockets() override; | |
320 | |
321 int IdleSocketCount() const override; | |
322 | |
323 int IdleSocketCountInGroup(const std::string& group_name) const override; | |
324 | |
325 LoadState GetLoadState(const std::string& group_name, | |
326 const ClientSocketHandle* handle) const override; | |
327 | |
328 base::DictionaryValue* GetInfoAsValue( | |
329 const std::string& name, | |
330 const std::string& type, | |
331 bool include_nested_pools) const override; | |
332 | |
333 base::TimeDelta ConnectionTimeout() const override; | |
334 | |
335 ClientSocketPoolHistograms* histograms() const override; | |
336 | |
337 // LowerLayeredPool implementation. | |
338 bool IsStalled() const override; | |
339 | |
340 void AddHigherLayeredPool(HigherLayeredPool* higher_pool) override; | |
341 | |
342 void RemoveHigherLayeredPool(HigherLayeredPool* higher_pool) override; | |
343 | |
344 // HigherLayeredPool implementation. | |
345 bool CloseOneIdleConnection() override; | |
346 | |
347 // Gets the SSLConnectJobMessenger for the given ssl session |cache_key|. If | |
348 // none exits, it creates one and stores it in |messenger_map_|. | |
349 SSLConnectJobMessenger* GetOrCreateSSLConnectJobMessenger( | |
350 const std::string& cache_key); | |
351 void DeleteSSLConnectJobMessenger(const std::string& cache_key); | |
352 | |
353 private: | |
354 typedef ClientSocketPoolBase<SSLSocketParams> PoolBase; | |
355 // Maps SSLConnectJob cache keys to SSLConnectJobMessenger objects. | |
356 typedef std::map<std::string, SSLConnectJobMessenger*> MessengerMap; | |
357 | |
358 // SSLConfigService::Observer implementation. | |
359 | |
360 // When the user changes the SSL config, we flush all idle sockets so they | |
361 // won't get re-used. | |
362 void OnSSLConfigChanged() override; | |
363 | |
364 class SSLConnectJobFactory : public PoolBase::ConnectJobFactory { | |
365 public: | |
366 SSLConnectJobFactory( | |
367 TransportClientSocketPool* transport_pool, | |
368 SOCKSClientSocketPool* socks_pool, | |
369 HttpProxyClientSocketPool* http_proxy_pool, | |
370 ClientSocketFactory* client_socket_factory, | |
371 const SSLClientSocketContext& context, | |
372 const SSLConnectJob::GetMessengerCallback& get_messenger_callback, | |
373 NetLog* net_log); | |
374 | |
375 ~SSLConnectJobFactory() override; | |
376 | |
377 // ClientSocketPoolBase::ConnectJobFactory methods. | |
378 scoped_ptr<ConnectJob> NewConnectJob( | |
379 const std::string& group_name, | |
380 const PoolBase::Request& request, | |
381 ConnectJob::Delegate* delegate) const override; | |
382 | |
383 base::TimeDelta ConnectionTimeout() const override; | |
384 | |
385 private: | |
386 TransportClientSocketPool* const transport_pool_; | |
387 SOCKSClientSocketPool* const socks_pool_; | |
388 HttpProxyClientSocketPool* const http_proxy_pool_; | |
389 ClientSocketFactory* const client_socket_factory_; | |
390 const SSLClientSocketContext context_; | |
391 base::TimeDelta timeout_; | |
392 SSLConnectJob::GetMessengerCallback get_messenger_callback_; | |
393 NetLog* net_log_; | |
394 | |
395 DISALLOW_COPY_AND_ASSIGN(SSLConnectJobFactory); | |
396 }; | |
397 | |
398 TransportClientSocketPool* const transport_pool_; | |
399 SOCKSClientSocketPool* const socks_pool_; | |
400 HttpProxyClientSocketPool* const http_proxy_pool_; | |
401 PoolBase base_; | |
402 const scoped_refptr<SSLConfigService> ssl_config_service_; | |
403 MessengerMap messenger_map_; | |
404 bool enable_ssl_connect_job_waiting_; | |
405 | |
406 DISALLOW_COPY_AND_ASSIGN(SSLClientSocketPool); | |
407 }; | |
408 | |
409 } // namespace net | |
410 | |
411 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_ | |
OLD | NEW |