Support for client certs in ssl_server_socket.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
 #include <sslproto.h>
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/cpu.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "crypto/nss_util.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/base/nss_memio.h"
+#include "net/ssl/ssl_config.h"
+#include "net/ssl/ssl_connection_status_flags.h"
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
 #endif
 
 namespace net {
 
 namespace {
 
 // CiphersRemove takes a zero-terminated array of cipher suite ids in
@@ skipping 319 matching lines @@
     // General unsupported/unknown key algorithm error.
     case SEC_ERROR_UNSUPPORTED_KEYALG:
     // General DER decoding errors.
     case SEC_ERROR_BAD_DER:
     case SEC_ERROR_EXTRA_INPUT:
       return ERR_SSL_BAD_PEER_PUBLIC_KEY;
     // During renegotiation, the server presented a different certificate than
     // was used earlier.
     case SSL_ERROR_WRONG_CERTIFICATE:
       return ERR_SSL_SERVER_CERT_CHANGED;
+    case SSL_ERROR_NO_CERTIFICATE:
+      return ERR_BAD_SSL_CLIENT_AUTH_CERT;
     case SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT:
       return ERR_SSL_INAPPROPRIATE_FALLBACK;
 
     default: {
       const char* err_name = PR_ErrorToName(err);
       if (err_name == NULL)
         err_name = "";
       if (IS_SSL_ERROR(err)) {
         LOG(WARNING) << "Unknown SSL error " << err << " (" << err_name << ")"
                      << " mapped to net::ERR_SSL_PROTOCOL_ERROR";
@@ skipping 31 matching lines @@
       NetLog::TYPE_SSL_NSS_ERROR,
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 NetLog::ParametersCallback CreateNetLogSSLErrorCallback(int net_error,
                                                         int ssl_lib_error) {
   return base::Bind(&NetLogSSLErrorCallback, net_error, ssl_lib_error);
 }
 
+void UpdateSSLConnectionStatus(PRFileDesc* nss_fd,
+                               const SSLConfig& ssl_config,
+                               int* ssl_connection_status) {

[Ryan Sleevi, 2015/03/19 04:38:24]

This method fails to properly wipe |ssl_connection_status| between calls.

It'd be cleaner just to use a stack temp and assign, and then let the compiler
optimize as it's permitted to.

+  SSLChannelInfo channel_info;
+  SECStatus ok =
+      SSL_GetChannelInfo(nss_fd, &channel_info, sizeof(channel_info));
+  if (ok == SECSuccess && channel_info.length == sizeof(channel_info) &&
+      channel_info.cipherSuite) {
+    (*ssl_connection_status) |= static_cast<int>(channel_info.cipherSuite) &
+                                SSL_CONNECTION_CIPHERSUITE_MASK;
+
+    (*ssl_connection_status) |=
+        (static_cast<int>(channel_info.compressionMethod) &
+         SSL_CONNECTION_COMPRESSION_MASK)
+        << SSL_CONNECTION_COMPRESSION_SHIFT;
+
+    // NSS 3.14.x doesn't have a version macro for TLS 1.2 (because NSS didn't
+    // support it yet), so use 0x0303 directly.
+    int version = SSL_CONNECTION_VERSION_UNKNOWN;
+    if (channel_info.protocolVersion < SSL_LIBRARY_VERSION_3_0) {
+      // All versions less than SSL_LIBRARY_VERSION_3_0 are treated as SSL
+      // version 2.
+      version = SSL_CONNECTION_VERSION_SSL2;
+    } else if (channel_info.protocolVersion == SSL_LIBRARY_VERSION_3_0) {
+      version = SSL_CONNECTION_VERSION_SSL3;
+    } else if (channel_info.protocolVersion == SSL_LIBRARY_VERSION_3_1_TLS) {
+      version = SSL_CONNECTION_VERSION_TLS1;
+    } else if (channel_info.protocolVersion == SSL_LIBRARY_VERSION_TLS_1_1) {
+      version = SSL_CONNECTION_VERSION_TLS1_1;
+    } else if (channel_info.protocolVersion == 0x0303) {
+      version = SSL_CONNECTION_VERSION_TLS1_2;
+    }
+    (*ssl_connection_status) |= (version & SSL_CONNECTION_VERSION_MASK)
+                                << SSL_CONNECTION_VERSION_SHIFT;
+  }
+
+  PRBool peer_supports_renego_ext;
+  ok = SSL_HandshakeNegotiatedExtension(nss_fd, ssl_renegotiation_info_xtn,
+                                        &peer_supports_renego_ext);
+  if (ok == SECSuccess) {
+    if (!peer_supports_renego_ext) {
+      (*ssl_connection_status) |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
+    }
+  }
+
+  if (ssl_config.version_fallback) {
+    (*ssl_connection_status) |= SSL_CONNECTION_VERSION_FALLBACK;
+  }
+}
+
 }  // namespace net