1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle
6 // of operation is derived from SSLClientSocketNSS.
8 #include "net/socket/ssl_client_socket_openssl.h"
11 #include <openssl/bio.h>
12 #include <openssl/err.h>
13 #include <openssl/ssl.h>
16 #include "base/bind.h"
17 #include "base/callback_helpers.h"
18 #include "base/environment.h"
19 #include "base/memory/singleton.h"
20 #include "base/metrics/histogram.h"
21 #include "base/profiler/scoped_tracker.h"
22 #include "base/strings/string_piece.h"
23 #include "base/synchronization/lock.h"
24 #include "base/threading/thread_local.h"
25 #include "crypto/ec_private_key.h"
26 #include "crypto/openssl_util.h"
27 #include "crypto/scoped_openssl_types.h"
28 #include "net/base/net_errors.h"
29 #include "net/cert/cert_policy_enforcer.h"
30 #include "net/cert/cert_verifier.h"
31 #include "net/cert/ct_ev_whitelist.h"
32 #include "net/cert/ct_verifier.h"
33 #include "net/cert/single_request_cert_verifier.h"
34 #include "net/cert/x509_certificate_net_log_param.h"
35 #include "net/cert/x509_util_openssl.h"
36 #include "net/http/transport_security_state.h"
37 #include "net/socket/ssl_session_cache_openssl.h"
38 #include "net/ssl/ssl_cert_request_info.h"
39 #include "net/ssl/ssl_connection_status_flags.h"
40 #include "net/ssl/ssl_info.h"
43 #include "base/win/windows_version.h"
46 #if defined(USE_OPENSSL_CERTS)
47 #include "net/ssl/openssl_client_key_store.h"
49 #include "net/ssl/openssl_platform_key.h"
56 // Enable this to see logging for state machine state transitions.
58 #define GotoState(s) do { DVLOG(2) << (void *)this << " " << __FUNCTION__ << \
59 " jump to state " << s; \
60 next_handshake_state_ = s; } while (0)
62 #define GotoState(s) next_handshake_state_ = s
65 // This constant can be any non-negative/non-zero value (eg: it does not
66 // overlap with any value of the net::Error range, including net::OK).
67 const int kNoPendingReadResult
= 1;
69 // If a client doesn't have a list of protocols that it supports, but
70 // the server supports NPN, choosing "http/1.1" is the best answer.
71 const char kDefaultSupportedNPNProtocol
[] = "http/1.1";
73 // Default size of the internal BoringSSL buffers.
74 const int KDefaultOpenSSLBufferSize
= 17 * 1024;
76 void FreeX509Stack(STACK_OF(X509
)* ptr
) {
77 sk_X509_pop_free(ptr
, X509_free
);
80 typedef crypto::ScopedOpenSSL
<X509
, X509_free
>::Type ScopedX509
;
81 typedef crypto::ScopedOpenSSL
<STACK_OF(X509
), FreeX509Stack
>::Type
84 #if OPENSSL_VERSION_NUMBER < 0x1000103fL
85 // This method doesn't seem to have made it into the OpenSSL headers.
86 unsigned long SSL_CIPHER_get_id(const SSL_CIPHER
* cipher
) { return cipher
->id
; }
89 // Used for encoding the |connection_status| field of an SSLInfo object.
90 int EncodeSSLConnectionStatus(uint16 cipher_suite
,
94 ((compression
& SSL_CONNECTION_COMPRESSION_MASK
) <<
95 SSL_CONNECTION_COMPRESSION_SHIFT
) |
96 ((version
& SSL_CONNECTION_VERSION_MASK
) <<
97 SSL_CONNECTION_VERSION_SHIFT
);
100 // Returns the net SSL version number (see ssl_connection_status_flags.h) for
101 // this SSL connection.
102 int GetNetSSLVersion(SSL
* ssl
) {
103 switch (SSL_version(ssl
)) {
105 return SSL_CONNECTION_VERSION_SSL2
;
107 return SSL_CONNECTION_VERSION_SSL3
;
109 return SSL_CONNECTION_VERSION_TLS1
;
111 return SSL_CONNECTION_VERSION_TLS1_1
;
113 return SSL_CONNECTION_VERSION_TLS1_2
;
115 return SSL_CONNECTION_VERSION_UNKNOWN
;
119 ScopedX509
OSCertHandleToOpenSSL(
120 X509Certificate::OSCertHandle os_handle
) {
121 #if defined(USE_OPENSSL_CERTS)
122 return ScopedX509(X509Certificate::DupOSCertHandle(os_handle
));
123 #else // !defined(USE_OPENSSL_CERTS)
124 std::string der_encoded
;
125 if (!X509Certificate::GetDEREncoded(os_handle
, &der_encoded
))
127 const uint8_t* bytes
= reinterpret_cast<const uint8_t*>(der_encoded
.data());
128 return ScopedX509(d2i_X509(NULL
, &bytes
, der_encoded
.size()));
129 #endif // defined(USE_OPENSSL_CERTS)
132 ScopedX509Stack
OSCertHandlesToOpenSSL(
133 const X509Certificate::OSCertHandles
& os_handles
) {
134 ScopedX509Stack
stack(sk_X509_new_null());
135 for (size_t i
= 0; i
< os_handles
.size(); i
++) {
136 ScopedX509 x509
= OSCertHandleToOpenSSL(os_handles
[i
]);
138 return ScopedX509Stack();
139 sk_X509_push(stack
.get(), x509
.release());
144 int LogErrorCallback(const char* str
, size_t len
, void* context
) {
145 LOG(ERROR
) << base::StringPiece(str
, len
);
149 bool IsOCSPStaplingSupported() {
151 // CERT_OCSP_RESPONSE_PROP_ID is only implemented on Vista+, but it can be
152 // set on Windows XP without error. There is some overhead from the server
153 // sending the OCSP response if it supports the extension, for the subset of
154 // XP clients who will request it but be unable to use it, but this is an
155 // acceptable trade-off for simplicity of implementation.
164 class SSLClientSocketOpenSSL::SSLContext
{
166 static SSLContext
* GetInstance() { return Singleton
<SSLContext
>::get(); }
167 SSL_CTX
* ssl_ctx() { return ssl_ctx_
.get(); }
168 SSLSessionCacheOpenSSL
* session_cache() { return &session_cache_
; }
170 SSLClientSocketOpenSSL
* GetClientSocketFromSSL(const SSL
* ssl
) {
172 SSLClientSocketOpenSSL
* socket
= static_cast<SSLClientSocketOpenSSL
*>(
173 SSL_get_ex_data(ssl
, ssl_socket_data_index_
));
178 bool SetClientSocketForSSL(SSL
* ssl
, SSLClientSocketOpenSSL
* socket
) {
179 return SSL_set_ex_data(ssl
, ssl_socket_data_index_
, socket
) != 0;
183 friend struct DefaultSingletonTraits
<SSLContext
>;
186 crypto::EnsureOpenSSLInit();
187 ssl_socket_data_index_
= SSL_get_ex_new_index(0, 0, 0, 0, 0);
188 DCHECK_NE(ssl_socket_data_index_
, -1);
189 ssl_ctx_
.reset(SSL_CTX_new(SSLv23_client_method()));
190 session_cache_
.Reset(ssl_ctx_
.get(), kDefaultSessionCacheConfig
);
191 SSL_CTX_set_cert_verify_callback(ssl_ctx_
.get(), CertVerifyCallback
, NULL
);
192 SSL_CTX_set_cert_cb(ssl_ctx_
.get(), ClientCertRequestCallback
, NULL
);
193 SSL_CTX_set_verify(ssl_ctx_
.get(), SSL_VERIFY_PEER
, NULL
);
194 // This stops |SSL_shutdown| from generating the close_notify message, which
195 // is currently not sent on the network.
196 // TODO(haavardm): Remove setting quiet shutdown once 118366 is fixed.
197 SSL_CTX_set_quiet_shutdown(ssl_ctx_
.get(), 1);
198 // TODO(kristianm): Only select this if ssl_config_.next_proto is not empty.
199 // It would be better if the callback were not a global setting,
200 // but that is an OpenSSL issue.
201 SSL_CTX_set_next_proto_select_cb(ssl_ctx_
.get(), SelectNextProtoCallback
,
203 ssl_ctx_
->tlsext_channel_id_enabled_new
= 1;
205 scoped_ptr
<base::Environment
> env(base::Environment::Create());
206 std::string ssl_keylog_file
;
207 if (env
->GetVar("SSLKEYLOGFILE", &ssl_keylog_file
) &&
208 !ssl_keylog_file
.empty()) {
209 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
210 BIO
* bio
= BIO_new_file(ssl_keylog_file
.c_str(), "a");
212 LOG(ERROR
) << "Failed to open " << ssl_keylog_file
;
213 ERR_print_errors_cb(&LogErrorCallback
, NULL
);
215 SSL_CTX_set_keylog_bio(ssl_ctx_
.get(), bio
);
220 static std::string
GetSessionCacheKey(const SSL
* ssl
) {
221 SSLClientSocketOpenSSL
* socket
= GetInstance()->GetClientSocketFromSSL(ssl
);
223 return socket
->GetSessionCacheKey();
226 static SSLSessionCacheOpenSSL::Config kDefaultSessionCacheConfig
;
228 static int ClientCertRequestCallback(SSL
* ssl
, void* arg
) {
229 SSLClientSocketOpenSSL
* socket
= GetInstance()->GetClientSocketFromSSL(ssl
);
231 return socket
->ClientCertRequestCallback(ssl
);
234 static int CertVerifyCallback(X509_STORE_CTX
*store_ctx
, void *arg
) {
235 SSL
* ssl
= reinterpret_cast<SSL
*>(X509_STORE_CTX_get_ex_data(
236 store_ctx
, SSL_get_ex_data_X509_STORE_CTX_idx()));
237 SSLClientSocketOpenSSL
* socket
= GetInstance()->GetClientSocketFromSSL(ssl
);
240 return socket
->CertVerifyCallback(store_ctx
);
243 static int SelectNextProtoCallback(SSL
* ssl
,
244 unsigned char** out
, unsigned char* outlen
,
245 const unsigned char* in
,
246 unsigned int inlen
, void* arg
) {
247 SSLClientSocketOpenSSL
* socket
= GetInstance()->GetClientSocketFromSSL(ssl
);
248 return socket
->SelectNextProtoCallback(out
, outlen
, in
, inlen
);
251 // This is the index used with SSL_get_ex_data to retrieve the owner
252 // SSLClientSocketOpenSSL object from an SSL instance.
253 int ssl_socket_data_index_
;
255 crypto::ScopedOpenSSL
<SSL_CTX
, SSL_CTX_free
>::Type ssl_ctx_
;
256 // |session_cache_| must be destroyed before |ssl_ctx_|.
257 SSLSessionCacheOpenSSL session_cache_
;
260 // PeerCertificateChain is a helper object which extracts the certificate
261 // chain, as given by the server, from an OpenSSL socket and performs the needed
262 // resource management. The first element of the chain is the leaf certificate
263 // and the other elements are in the order given by the server.
264 class SSLClientSocketOpenSSL::PeerCertificateChain
{
266 explicit PeerCertificateChain(STACK_OF(X509
)* chain
) { Reset(chain
); }
267 PeerCertificateChain(const PeerCertificateChain
& other
) { *this = other
; }
268 ~PeerCertificateChain() {}
269 PeerCertificateChain
& operator=(const PeerCertificateChain
& other
);
271 // Resets the PeerCertificateChain to the set of certificates in|chain|,
272 // which may be NULL, indicating to empty the store certificates.
273 // Note: If an error occurs, such as being unable to parse the certificates,
274 // this will behave as if Reset(NULL) was called.
275 void Reset(STACK_OF(X509
)* chain
);
277 // Note that when USE_OPENSSL is defined, OSCertHandle is X509*
278 scoped_refptr
<X509Certificate
> AsOSChain() const;
280 size_t size() const {
281 if (!openssl_chain_
.get())
283 return sk_X509_num(openssl_chain_
.get());
290 X509
* Get(size_t index
) const {
291 DCHECK_LT(index
, size());
292 return sk_X509_value(openssl_chain_
.get(), index
);
296 ScopedX509Stack openssl_chain_
;
299 SSLClientSocketOpenSSL::PeerCertificateChain
&
300 SSLClientSocketOpenSSL::PeerCertificateChain::operator=(
301 const PeerCertificateChain
& other
) {
305 openssl_chain_
.reset(X509_chain_up_ref(other
.openssl_chain_
.get()));
309 void SSLClientSocketOpenSSL::PeerCertificateChain::Reset(
310 STACK_OF(X509
)* chain
) {
311 openssl_chain_
.reset(chain
? X509_chain_up_ref(chain
) : NULL
);
314 scoped_refptr
<X509Certificate
>
315 SSLClientSocketOpenSSL::PeerCertificateChain::AsOSChain() const {
316 #if defined(USE_OPENSSL_CERTS)
317 // When OSCertHandle is typedef'ed to X509, this implementation does a short
318 // cut to avoid converting back and forth between DER and the X509 struct.
319 X509Certificate::OSCertHandles intermediates
;
320 for (size_t i
= 1; i
< sk_X509_num(openssl_chain_
.get()); ++i
) {
321 intermediates
.push_back(sk_X509_value(openssl_chain_
.get(), i
));
324 return make_scoped_refptr(X509Certificate::CreateFromHandle(
325 sk_X509_value(openssl_chain_
.get(), 0), intermediates
));
327 // DER-encode the chain and convert to a platform certificate handle.
328 std::vector
<base::StringPiece
> der_chain
;
329 for (size_t i
= 0; i
< sk_X509_num(openssl_chain_
.get()); ++i
) {
330 X509
* x
= sk_X509_value(openssl_chain_
.get(), i
);
331 base::StringPiece der
;
332 if (!x509_util::GetDER(x
, &der
))
334 der_chain
.push_back(der
);
337 return make_scoped_refptr(X509Certificate::CreateFromDERCertChain(der_chain
));
342 SSLSessionCacheOpenSSL::Config
343 SSLClientSocketOpenSSL::SSLContext::kDefaultSessionCacheConfig
= {
344 &GetSessionCacheKey
, // key_func
346 256, // expiration_check_count
347 60 * 60, // timeout_seconds
351 void SSLClientSocket::ClearSessionCache() {
352 SSLClientSocketOpenSSL::SSLContext
* context
=
353 SSLClientSocketOpenSSL::SSLContext::GetInstance();
354 context
->session_cache()->Flush();
358 uint16
SSLClientSocket::GetMaxSupportedSSLVersion() {
359 return SSL_PROTOCOL_VERSION_TLS1_2
;
362 SSLClientSocketOpenSSL::SSLClientSocketOpenSSL(
363 scoped_ptr
<ClientSocketHandle
> transport_socket
,
364 const HostPortPair
& host_and_port
,
365 const SSLConfig
& ssl_config
,
366 const SSLClientSocketContext
& context
)
367 : transport_send_busy_(false),
368 transport_recv_busy_(false),
369 pending_read_error_(kNoPendingReadResult
),
370 pending_read_ssl_error_(SSL_ERROR_NONE
),
371 transport_read_error_(OK
),
372 transport_write_error_(OK
),
373 server_cert_chain_(new PeerCertificateChain(NULL
)),
374 completed_connect_(false),
375 was_ever_used_(false),
376 client_auth_cert_needed_(false),
377 cert_verifier_(context
.cert_verifier
),
378 cert_transparency_verifier_(context
.cert_transparency_verifier
),
379 channel_id_service_(context
.channel_id_service
),
381 transport_bio_(NULL
),
382 transport_(transport_socket
.Pass()),
383 host_and_port_(host_and_port
),
384 ssl_config_(ssl_config
),
385 ssl_session_cache_shard_(context
.ssl_session_cache_shard
),
386 trying_cached_session_(false),
387 next_handshake_state_(STATE_NONE
),
388 npn_status_(kNextProtoUnsupported
),
389 channel_id_xtn_negotiated_(false),
390 handshake_succeeded_(false),
391 marked_session_as_good_(false),
392 transport_security_state_(context
.transport_security_state
),
393 policy_enforcer_(context
.cert_policy_enforcer
),
394 net_log_(transport_
->socket()->NetLog()),
395 weak_factory_(this) {
398 SSLClientSocketOpenSSL::~SSLClientSocketOpenSSL() {
402 std::string
SSLClientSocketOpenSSL::GetSessionCacheKey() const {
403 std::string result
= host_and_port_
.ToString();
405 result
.append(ssl_session_cache_shard_
);
409 bool SSLClientSocketOpenSSL::InSessionCache() const {
410 SSLContext
* context
= SSLContext::GetInstance();
411 std::string cache_key
= GetSessionCacheKey();
412 return context
->session_cache()->SSLSessionIsInCache(cache_key
);
415 void SSLClientSocketOpenSSL::SetHandshakeCompletionCallback(
416 const base::Closure
& callback
) {
417 handshake_completion_callback_
= callback
;
420 void SSLClientSocketOpenSSL::GetSSLCertRequestInfo(
421 SSLCertRequestInfo
* cert_request_info
) {
422 cert_request_info
->host_and_port
= host_and_port_
;
423 cert_request_info
->cert_authorities
= cert_authorities_
;
424 cert_request_info
->cert_key_types
= cert_key_types_
;
427 SSLClientSocket::NextProtoStatus
SSLClientSocketOpenSSL::GetNextProto(
428 std::string
* proto
) {
434 SSLClientSocketOpenSSL::GetChannelIDService() const {
435 return channel_id_service_
;
438 int SSLClientSocketOpenSSL::ExportKeyingMaterial(
439 const base::StringPiece
& label
,
440 bool has_context
, const base::StringPiece
& context
,
441 unsigned char* out
, unsigned int outlen
) {
442 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
444 int rv
= SSL_export_keying_material(
445 ssl_
, out
, outlen
, label
.data(), label
.size(),
446 reinterpret_cast<const unsigned char*>(context
.data()),
447 context
.length(), context
.length() > 0);
450 int ssl_error
= SSL_get_error(ssl_
, rv
);
451 LOG(ERROR
) << "Failed to export keying material;"
452 << " returned " << rv
453 << ", SSL error code " << ssl_error
;
454 return MapOpenSSLError(ssl_error
, err_tracer
);
459 int SSLClientSocketOpenSSL::GetTLSUniqueChannelBinding(std::string
* out
) {
461 return ERR_NOT_IMPLEMENTED
;
464 int SSLClientSocketOpenSSL::Connect(const CompletionCallback
& callback
) {
465 // It is an error to create an SSLClientSocket whose context has no
466 // TransportSecurityState.
467 DCHECK(transport_security_state_
);
469 net_log_
.BeginEvent(NetLog::TYPE_SSL_CONNECT
);
471 // Set up new ssl object.
474 net_log_
.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT
, rv
);
478 // Set SSL to client mode. Handshake happens in the loop below.
479 SSL_set_connect_state(ssl_
);
481 // Enable fastradio padding.
482 SSL_enable_fastradio_padding(ssl_
,
483 ssl_config_
.fastradio_padding_enabled
&&
484 ssl_config_
.fastradio_padding_eligible
);
486 GotoState(STATE_HANDSHAKE
);
487 rv
= DoHandshakeLoop(OK
);
488 if (rv
== ERR_IO_PENDING
) {
489 user_connect_callback_
= callback
;
491 net_log_
.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT
, rv
);
493 OnHandshakeCompletion();
496 return rv
> OK
? OK
: rv
;
499 void SSLClientSocketOpenSSL::Disconnect() {
500 // If a handshake was pending (Connect() had been called), notify interested
501 // parties that it's been aborted now. If the handshake had already
502 // completed, this is a no-op.
503 OnHandshakeCompletion();
505 // Calling SSL_shutdown prevents the session from being marked as
511 if (transport_bio_
) {
512 BIO_free_all(transport_bio_
);
513 transport_bio_
= NULL
;
516 // Shut down anything that may call us back.
518 transport_
->socket()->Disconnect();
520 // Null all callbacks, delete all buffers.
521 transport_send_busy_
= false;
523 transport_recv_busy_
= false;
526 user_connect_callback_
.Reset();
527 user_read_callback_
.Reset();
528 user_write_callback_
.Reset();
529 user_read_buf_
= NULL
;
530 user_read_buf_len_
= 0;
531 user_write_buf_
= NULL
;
532 user_write_buf_len_
= 0;
534 pending_read_error_
= kNoPendingReadResult
;
535 pending_read_ssl_error_
= SSL_ERROR_NONE
;
536 pending_read_error_info_
= OpenSSLErrorInfo();
538 transport_read_error_
= OK
;
539 transport_write_error_
= OK
;
541 server_cert_verify_result_
.Reset();
542 completed_connect_
= false;
544 cert_authorities_
.clear();
545 cert_key_types_
.clear();
546 client_auth_cert_needed_
= false;
548 start_cert_verification_time_
= base::TimeTicks();
550 npn_status_
= kNextProtoUnsupported
;
553 channel_id_xtn_negotiated_
= false;
554 channel_id_request_handle_
.Cancel();
557 bool SSLClientSocketOpenSSL::IsConnected() const {
558 // If the handshake has not yet completed.
559 if (!completed_connect_
)
561 // If an asynchronous operation is still pending.
562 if (user_read_buf_
.get() || user_write_buf_
.get())
565 return transport_
->socket()->IsConnected();
568 bool SSLClientSocketOpenSSL::IsConnectedAndIdle() const {
569 // If the handshake has not yet completed.
570 if (!completed_connect_
)
572 // If an asynchronous operation is still pending.
573 if (user_read_buf_
.get() || user_write_buf_
.get())
575 // If there is data waiting to be sent, or data read from the network that
576 // has not yet been consumed.
577 if (BIO_pending(transport_bio_
) > 0 ||
578 BIO_wpending(transport_bio_
) > 0) {
582 return transport_
->socket()->IsConnectedAndIdle();
585 int SSLClientSocketOpenSSL::GetPeerAddress(IPEndPoint
* addressList
) const {
586 return transport_
->socket()->GetPeerAddress(addressList
);
589 int SSLClientSocketOpenSSL::GetLocalAddress(IPEndPoint
* addressList
) const {
590 return transport_
->socket()->GetLocalAddress(addressList
);
593 const BoundNetLog
& SSLClientSocketOpenSSL::NetLog() const {
597 void SSLClientSocketOpenSSL::SetSubresourceSpeculation() {
598 if (transport_
.get() && transport_
->socket()) {
599 transport_
->socket()->SetSubresourceSpeculation();
605 void SSLClientSocketOpenSSL::SetOmniboxSpeculation() {
606 if (transport_
.get() && transport_
->socket()) {
607 transport_
->socket()->SetOmniboxSpeculation();
613 bool SSLClientSocketOpenSSL::WasEverUsed() const {
614 return was_ever_used_
;
617 bool SSLClientSocketOpenSSL::UsingTCPFastOpen() const {
618 if (transport_
.get() && transport_
->socket())
619 return transport_
->socket()->UsingTCPFastOpen();
625 bool SSLClientSocketOpenSSL::GetSSLInfo(SSLInfo
* ssl_info
) {
627 if (server_cert_chain_
->empty())
630 ssl_info
->cert
= server_cert_verify_result_
.verified_cert
;
631 ssl_info
->cert_status
= server_cert_verify_result_
.cert_status
;
632 ssl_info
->is_issued_by_known_root
=
633 server_cert_verify_result_
.is_issued_by_known_root
;
634 ssl_info
->public_key_hashes
=
635 server_cert_verify_result_
.public_key_hashes
;
636 ssl_info
->client_cert_sent
=
637 ssl_config_
.send_client_cert
&& ssl_config_
.client_cert
.get();
638 ssl_info
->channel_id_sent
= WasChannelIDSent();
639 ssl_info
->pinning_failure_log
= pinning_failure_log_
;
641 AddSCTInfoToSSLInfo(ssl_info
);
643 const SSL_CIPHER
* cipher
= SSL_get_current_cipher(ssl_
);
645 ssl_info
->security_bits
= SSL_CIPHER_get_bits(cipher
, NULL
);
647 ssl_info
->connection_status
= EncodeSSLConnectionStatus(
648 static_cast<uint16
>(SSL_CIPHER_get_id(cipher
)), 0 /* no compression */,
649 GetNetSSLVersion(ssl_
));
651 if (!SSL_get_secure_renegotiation_support(ssl_
))
652 ssl_info
->connection_status
|= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION
;
654 if (ssl_config_
.version_fallback
)
655 ssl_info
->connection_status
|= SSL_CONNECTION_VERSION_FALLBACK
;
657 ssl_info
->handshake_type
= SSL_session_reused(ssl_
) ?
658 SSLInfo::HANDSHAKE_RESUME
: SSLInfo::HANDSHAKE_FULL
;
660 DVLOG(3) << "Encoded connection status: cipher suite = "
661 << SSLConnectionStatusToCipherSuite(ssl_info
->connection_status
)
663 << SSLConnectionStatusToVersion(ssl_info
->connection_status
);
667 int SSLClientSocketOpenSSL::Read(IOBuffer
* buf
,
669 const CompletionCallback
& callback
) {
670 user_read_buf_
= buf
;
671 user_read_buf_len_
= buf_len
;
673 int rv
= DoReadLoop();
675 if (rv
== ERR_IO_PENDING
) {
676 user_read_callback_
= callback
;
679 was_ever_used_
= true;
680 user_read_buf_
= NULL
;
681 user_read_buf_len_
= 0;
683 // Failure of a read attempt may indicate a failed false start
685 OnHandshakeCompletion();
692 int SSLClientSocketOpenSSL::Write(IOBuffer
* buf
,
694 const CompletionCallback
& callback
) {
695 user_write_buf_
= buf
;
696 user_write_buf_len_
= buf_len
;
698 int rv
= DoWriteLoop();
700 if (rv
== ERR_IO_PENDING
) {
701 user_write_callback_
= callback
;
704 was_ever_used_
= true;
705 user_write_buf_
= NULL
;
706 user_write_buf_len_
= 0;
708 // Failure of a write attempt may indicate a failed false start
710 OnHandshakeCompletion();
717 int SSLClientSocketOpenSSL::SetReceiveBufferSize(int32 size
) {
718 return transport_
->socket()->SetReceiveBufferSize(size
);
721 int SSLClientSocketOpenSSL::SetSendBufferSize(int32 size
) {
722 return transport_
->socket()->SetSendBufferSize(size
);
725 int SSLClientSocketOpenSSL::Init() {
727 DCHECK(!transport_bio_
);
729 SSLContext
* context
= SSLContext::GetInstance();
730 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
732 ssl_
= SSL_new(context
->ssl_ctx());
733 if (!ssl_
|| !context
->SetClientSocketForSSL(ssl_
, this))
734 return ERR_UNEXPECTED
;
736 if (!SSL_set_tlsext_host_name(ssl_
, host_and_port_
.host().c_str()))
737 return ERR_UNEXPECTED
;
739 // Set an OpenSSL callback to monitor this SSL*'s connection.
740 SSL_set_info_callback(ssl_
, &InfoCallback
);
742 trying_cached_session_
= context
->session_cache()->SetSSLSessionWithKey(
743 ssl_
, GetSessionCacheKey());
745 send_buffer_
= new GrowableIOBuffer();
746 send_buffer_
->SetCapacity(KDefaultOpenSSLBufferSize
);
747 recv_buffer_
= new GrowableIOBuffer();
748 recv_buffer_
->SetCapacity(KDefaultOpenSSLBufferSize
);
752 // SSLClientSocketOpenSSL retains ownership of the BIO buffers.
753 if (!BIO_new_bio_pair_external_buf(
754 &ssl_bio
, send_buffer_
->capacity(),
755 reinterpret_cast<uint8_t*>(send_buffer_
->data()), &transport_bio_
,
756 recv_buffer_
->capacity(),
757 reinterpret_cast<uint8_t*>(recv_buffer_
->data())))
758 return ERR_UNEXPECTED
;
760 DCHECK(transport_bio_
);
762 // Install a callback on OpenSSL's end to plumb transport errors through.
763 BIO_set_callback(ssl_bio
, BIOCallback
);
764 BIO_set_callback_arg(ssl_bio
, reinterpret_cast<char*>(this));
766 SSL_set_bio(ssl_
, ssl_bio
, ssl_bio
);
768 // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
769 // set everything we care about to an absolute value.
770 SslSetClearMask options
;
771 options
.ConfigureFlag(SSL_OP_NO_SSLv2
, true);
772 bool ssl3_enabled
= (ssl_config_
.version_min
== SSL_PROTOCOL_VERSION_SSL3
);
773 options
.ConfigureFlag(SSL_OP_NO_SSLv3
, !ssl3_enabled
);
774 bool tls1_enabled
= (ssl_config_
.version_min
<= SSL_PROTOCOL_VERSION_TLS1
&&
775 ssl_config_
.version_max
>= SSL_PROTOCOL_VERSION_TLS1
);
776 options
.ConfigureFlag(SSL_OP_NO_TLSv1
, !tls1_enabled
);
777 bool tls1_1_enabled
=
778 (ssl_config_
.version_min
<= SSL_PROTOCOL_VERSION_TLS1_1
&&
779 ssl_config_
.version_max
>= SSL_PROTOCOL_VERSION_TLS1_1
);
780 options
.ConfigureFlag(SSL_OP_NO_TLSv1_1
, !tls1_1_enabled
);
781 bool tls1_2_enabled
=
782 (ssl_config_
.version_min
<= SSL_PROTOCOL_VERSION_TLS1_2
&&
783 ssl_config_
.version_max
>= SSL_PROTOCOL_VERSION_TLS1_2
);
784 options
.ConfigureFlag(SSL_OP_NO_TLSv1_2
, !tls1_2_enabled
);
786 options
.ConfigureFlag(SSL_OP_NO_COMPRESSION
, true);
788 // TODO(joth): Set this conditionally, see http://crbug.com/55410
789 options
.ConfigureFlag(SSL_OP_LEGACY_SERVER_CONNECT
, true);
791 SSL_set_options(ssl_
, options
.set_mask
);
792 SSL_clear_options(ssl_
, options
.clear_mask
);
794 // Same as above, this time for the SSL mode.
795 SslSetClearMask mode
;
797 mode
.ConfigureFlag(SSL_MODE_RELEASE_BUFFERS
, true);
798 mode
.ConfigureFlag(SSL_MODE_CBC_RECORD_SPLITTING
, true);
800 mode
.ConfigureFlag(SSL_MODE_HANDSHAKE_CUTTHROUGH
,
801 ssl_config_
.false_start_enabled
);
803 SSL_set_mode(ssl_
, mode
.set_mask
);
804 SSL_clear_mode(ssl_
, mode
.clear_mask
);
806 // Removing ciphers by ID from OpenSSL is a bit involved as we must use the
807 // textual name with SSL_set_cipher_list because there is no public API to
808 // directly remove a cipher by ID.
809 STACK_OF(SSL_CIPHER
)* ciphers
= SSL_get_ciphers(ssl_
);
811 // See SSLConfig::disabled_cipher_suites for description of the suites
812 // disabled by default. Note that !SHA256 and !SHA384 only remove HMAC-SHA256
813 // and HMAC-SHA384 cipher suites, not GCM cipher suites with SHA256 or SHA384
814 // as the handshake hash.
816 "DEFAULT:!NULL:!aNULL:!SHA256:!SHA384:!aECDH:!AESGCM+AES256:!aPSK");
817 // Walk through all the installed ciphers, seeing if any need to be
818 // appended to the cipher removal |command|.
819 for (size_t i
= 0; i
< sk_SSL_CIPHER_num(ciphers
); ++i
) {
820 const SSL_CIPHER
* cipher
= sk_SSL_CIPHER_value(ciphers
, i
);
821 const uint16 id
= static_cast<uint16
>(SSL_CIPHER_get_id(cipher
));
822 // Remove any ciphers with a strength of less than 80 bits. Note the NSS
823 // implementation uses "effective" bits here but OpenSSL does not provide
824 // this detail. This only impacts Triple DES: reports 112 vs. 168 bits,
825 // both of which are greater than 80 anyway.
826 bool disable
= SSL_CIPHER_get_bits(cipher
, NULL
) < 80;
828 disable
= std::find(ssl_config_
.disabled_cipher_suites
.begin(),
829 ssl_config_
.disabled_cipher_suites
.end(), id
) !=
830 ssl_config_
.disabled_cipher_suites
.end();
833 const char* name
= SSL_CIPHER_get_name(cipher
);
834 DVLOG(3) << "Found cipher to remove: '" << name
<< "', ID: " << id
835 << " strength: " << SSL_CIPHER_get_bits(cipher
, NULL
);
836 command
.append(":!");
837 command
.append(name
);
841 // Disable ECDSA cipher suites on platforms that do not support ECDSA
842 // signed certificates, as servers may use the presence of such
843 // ciphersuites as a hint to send an ECDSA certificate.
845 if (base::win::GetVersion() < base::win::VERSION_VISTA
)
846 command
.append(":!ECDSA");
849 int rv
= SSL_set_cipher_list(ssl_
, command
.c_str());
850 // If this fails (rv = 0) it means there are no ciphers enabled on this SSL.
851 // This will almost certainly result in the socket failing to complete the
852 // handshake at which point the appropriate error is bubbled up to the client.
853 LOG_IF(WARNING
, rv
!= 1) << "SSL_set_cipher_list('" << command
<< "') "
856 if (ssl_config_
.version_fallback
)
857 SSL_enable_fallback_scsv(ssl_
);
860 if (IsChannelIDEnabled(ssl_config_
, channel_id_service_
)) {
861 SSL_enable_tls_channel_id(ssl_
);
864 if (!ssl_config_
.next_protos
.empty()) {
865 // Get list of ciphers that are enabled.
866 STACK_OF(SSL_CIPHER
)* enabled_ciphers
= SSL_get_ciphers(ssl_
);
867 DCHECK(enabled_ciphers
);
868 std::vector
<uint16
> enabled_ciphers_vector
;
869 for (size_t i
= 0; i
< sk_SSL_CIPHER_num(enabled_ciphers
); ++i
) {
870 const SSL_CIPHER
* cipher
= sk_SSL_CIPHER_value(enabled_ciphers
, i
);
871 const uint16 id
= static_cast<uint16
>(SSL_CIPHER_get_id(cipher
));
872 enabled_ciphers_vector
.push_back(id
);
875 std::vector
<uint8_t> wire_protos
=
876 SerializeNextProtos(ssl_config_
.next_protos
,
877 HasCipherAdequateForHTTP2(enabled_ciphers_vector
) &&
878 IsTLSVersionAdequateForHTTP2(ssl_config_
));
879 SSL_set_alpn_protos(ssl_
, wire_protos
.empty() ? NULL
: &wire_protos
[0],
883 if (ssl_config_
.signed_cert_timestamps_enabled
) {
884 SSL_enable_signed_cert_timestamps(ssl_
);
885 SSL_enable_ocsp_stapling(ssl_
);
888 if (IsOCSPStaplingSupported())
889 SSL_enable_ocsp_stapling(ssl_
);
894 void SSLClientSocketOpenSSL::DoReadCallback(int rv
) {
895 // Since Run may result in Read being called, clear |user_read_callback_|
898 was_ever_used_
= true;
899 user_read_buf_
= NULL
;
900 user_read_buf_len_
= 0;
902 // Failure of a read attempt may indicate a failed false start
904 OnHandshakeCompletion();
906 base::ResetAndReturn(&user_read_callback_
).Run(rv
);
909 void SSLClientSocketOpenSSL::DoWriteCallback(int rv
) {
910 // Since Run may result in Write being called, clear |user_write_callback_|
913 was_ever_used_
= true;
914 user_write_buf_
= NULL
;
915 user_write_buf_len_
= 0;
917 // Failure of a write attempt may indicate a failed false start
919 OnHandshakeCompletion();
921 base::ResetAndReturn(&user_write_callback_
).Run(rv
);
924 void SSLClientSocketOpenSSL::OnHandshakeCompletion() {
925 if (!handshake_completion_callback_
.is_null())
926 base::ResetAndReturn(&handshake_completion_callback_
).Run();
929 bool SSLClientSocketOpenSSL::DoTransportIO() {
930 bool network_moved
= false;
932 // Read and write as much data as possible. The loop is necessary because
933 // Write() may return synchronously.
936 if (rv
!= ERR_IO_PENDING
&& rv
!= 0)
937 network_moved
= true;
939 if (transport_read_error_
== OK
&& BufferRecv() != ERR_IO_PENDING
)
940 network_moved
= true;
941 return network_moved
;
944 // TODO(vadimt): Remove including "base/threading/thread_local.h" and
945 // g_first_run_completed once crbug.com/424386 is fixed.
946 base::LazyInstance
<base::ThreadLocalBoolean
>::Leaky g_first_run_completed
=
947 LAZY_INSTANCE_INITIALIZER
;
949 int SSLClientSocketOpenSSL::DoHandshake() {
950 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
955 // TODO(vadimt): Leave only 1 call to SSL_do_handshake once crbug.com/424386
957 if (ssl_config_
.send_client_cert
&& ssl_config_
.client_cert
.get()) {
958 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
959 tracked_objects::ScopedTracker
tracking_profile1(
960 FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 DoHandshake_WithCert"));
962 rv
= SSL_do_handshake(ssl_
);
964 if (g_first_run_completed
.Get().Get()) {
965 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is
967 tracked_objects::ScopedTracker
tracking_profile1(
968 FROM_HERE_WITH_EXPLICIT_FUNCTION(
969 "424386 DoHandshake_WithoutCert Not First"));
971 rv
= SSL_do_handshake(ssl_
);
973 g_first_run_completed
.Get().Set(true);
975 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is
977 tracked_objects::ScopedTracker
tracking_profile1(
978 FROM_HERE_WITH_EXPLICIT_FUNCTION(
979 "424386 DoHandshake_WithoutCert First"));
981 rv
= SSL_do_handshake(ssl_
);
985 if (client_auth_cert_needed_
) {
986 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
987 tracked_objects::ScopedTracker
tracking_profile2(
988 FROM_HERE_WITH_EXPLICIT_FUNCTION(
989 "424386 SSLClientSocketOpenSSL::DoHandshake2"));
991 net_error
= ERR_SSL_CLIENT_AUTH_CERT_NEEDED
;
992 // If the handshake already succeeded (because the server requests but
993 // doesn't require a client cert), we need to invalidate the SSL session
994 // so that we won't try to resume the non-client-authenticated session in
995 // the next handshake. This will cause the server to ask for a client
998 // Remove from session cache but don't clear this connection.
999 SSL_SESSION
* session
= SSL_get_session(ssl_
);
1001 int rv
= SSL_CTX_remove_session(SSL_get_SSL_CTX(ssl_
), session
);
1002 LOG_IF(WARNING
, !rv
) << "Couldn't invalidate SSL session: " << session
;
1005 } else if (rv
== 1) {
1006 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1007 tracked_objects::ScopedTracker
tracking_profile3(
1008 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1009 "424386 SSLClientSocketOpenSSL::DoHandshake3"));
1011 if (trying_cached_session_
&& logging::DEBUG_MODE
) {
1012 DVLOG(2) << "Result of session reuse for " << host_and_port_
.ToString()
1013 << " is: " << (SSL_session_reused(ssl_
) ? "Success" : "Fail");
1016 if (ssl_config_
.version_fallback
&&
1017 ssl_config_
.version_max
< ssl_config_
.version_fallback_min
) {
1018 return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION
;
1021 // SSL handshake is completed. If NPN wasn't negotiated, see if ALPN was.
1022 if (npn_status_
== kNextProtoUnsupported
) {
1023 const uint8_t* alpn_proto
= NULL
;
1024 unsigned alpn_len
= 0;
1025 SSL_get0_alpn_selected(ssl_
, &alpn_proto
, &alpn_len
);
1027 npn_proto_
.assign(reinterpret_cast<const char*>(alpn_proto
), alpn_len
);
1028 npn_status_
= kNextProtoNegotiated
;
1029 set_negotiation_extension(kExtensionALPN
);
1033 RecordChannelIDSupport(channel_id_service_
,
1034 channel_id_xtn_negotiated_
,
1035 ssl_config_
.channel_id_enabled
,
1036 crypto::ECPrivateKey::IsSupported());
1038 // Only record OCSP histograms if OCSP was requested.
1039 if (ssl_config_
.signed_cert_timestamps_enabled
||
1040 IsOCSPStaplingSupported()) {
1041 const uint8_t* ocsp_response
;
1042 size_t ocsp_response_len
;
1043 SSL_get0_ocsp_response(ssl_
, &ocsp_response
, &ocsp_response_len
);
1045 set_stapled_ocsp_response_received(ocsp_response_len
!= 0);
1046 UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_response_len
!= 0);
1049 const uint8_t* sct_list
;
1050 size_t sct_list_len
;
1051 SSL_get0_signed_cert_timestamp_list(ssl_
, &sct_list
, &sct_list_len
);
1052 set_signed_cert_timestamps_received(sct_list_len
!= 0);
1054 // Verify the certificate.
1056 GotoState(STATE_VERIFY_CERT
);
1058 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1059 tracked_objects::ScopedTracker
tracking_profile4(
1060 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1061 "424386 SSLClientSocketOpenSSL::DoHandshake4"));
1063 int ssl_error
= SSL_get_error(ssl_
, rv
);
1065 if (ssl_error
== SSL_ERROR_WANT_CHANNEL_ID_LOOKUP
) {
1066 // The server supports channel ID. Stop to look one up before returning to
1068 channel_id_xtn_negotiated_
= true;
1069 GotoState(STATE_CHANNEL_ID_LOOKUP
);
1073 OpenSSLErrorInfo error_info
;
1074 net_error
= MapOpenSSLErrorWithDetails(ssl_error
, err_tracer
, &error_info
);
1076 // If not done, stay in this state
1077 if (net_error
== ERR_IO_PENDING
) {
1078 GotoState(STATE_HANDSHAKE
);
1080 LOG(ERROR
) << "handshake failed; returned " << rv
1081 << ", SSL error code " << ssl_error
1082 << ", net_error " << net_error
;
1084 NetLog::TYPE_SSL_HANDSHAKE_ERROR
,
1085 CreateNetLogOpenSSLErrorCallback(net_error
, ssl_error
, error_info
));
1091 int SSLClientSocketOpenSSL::DoChannelIDLookup() {
1092 GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE
);
1093 return channel_id_service_
->GetOrCreateChannelID(
1094 host_and_port_
.host(),
1095 &channel_id_private_key_
,
1097 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete
,
1098 base::Unretained(this)),
1099 &channel_id_request_handle_
);
1102 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result
) {
1106 DCHECK_LT(0u, channel_id_private_key_
.size());
1108 std::vector
<uint8
> encrypted_private_key_info
;
1109 std::vector
<uint8
> subject_public_key_info
;
1110 encrypted_private_key_info
.assign(
1111 channel_id_private_key_
.data(),
1112 channel_id_private_key_
.data() + channel_id_private_key_
.size());
1113 subject_public_key_info
.assign(
1114 channel_id_cert_
.data(),
1115 channel_id_cert_
.data() + channel_id_cert_
.size());
1116 scoped_ptr
<crypto::ECPrivateKey
> ec_private_key(
1117 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo(
1118 ChannelIDService::kEPKIPassword
,
1119 encrypted_private_key_info
,
1120 subject_public_key_info
));
1121 if (!ec_private_key
) {
1122 LOG(ERROR
) << "Failed to import Channel ID.";
1123 return ERR_CHANNEL_ID_IMPORT_FAILED
;
1126 // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key
1128 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
1129 int rv
= SSL_set1_tls_channel_id(ssl_
, ec_private_key
->key());
1131 LOG(ERROR
) << "Failed to set Channel ID.";
1132 int err
= SSL_get_error(ssl_
, rv
);
1133 return MapOpenSSLError(err
, err_tracer
);
1136 // Return to the handshake.
1137 set_channel_id_sent(true);
1138 GotoState(STATE_HANDSHAKE
);
1142 int SSLClientSocketOpenSSL::DoVerifyCert(int result
) {
1143 DCHECK(!server_cert_chain_
->empty());
1144 DCHECK(start_cert_verification_time_
.is_null());
1146 GotoState(STATE_VERIFY_CERT_COMPLETE
);
1148 // If the certificate is bad and has been previously accepted, use
1149 // the previous status and bypass the error.
1150 base::StringPiece der_cert
;
1151 if (!x509_util::GetDER(server_cert_chain_
->Get(0), &der_cert
)) {
1153 return ERR_CERT_INVALID
;
1155 CertStatus cert_status
;
1156 if (ssl_config_
.IsAllowedBadCert(der_cert
, &cert_status
)) {
1157 VLOG(1) << "Received an expected bad cert with status: " << cert_status
;
1158 server_cert_verify_result_
.Reset();
1159 server_cert_verify_result_
.cert_status
= cert_status
;
1160 server_cert_verify_result_
.verified_cert
= server_cert_
;
1164 // When running in a sandbox, it may not be possible to create an
1165 // X509Certificate*, as that may depend on OS functionality blocked
1167 if (!server_cert_
.get()) {
1168 server_cert_verify_result_
.Reset();
1169 server_cert_verify_result_
.cert_status
= CERT_STATUS_INVALID
;
1170 return ERR_CERT_INVALID
;
1173 start_cert_verification_time_
= base::TimeTicks::Now();
1176 if (ssl_config_
.rev_checking_enabled
)
1177 flags
|= CertVerifier::VERIFY_REV_CHECKING_ENABLED
;
1178 if (ssl_config_
.verify_ev_cert
)
1179 flags
|= CertVerifier::VERIFY_EV_CERT
;
1180 if (ssl_config_
.cert_io_enabled
)
1181 flags
|= CertVerifier::VERIFY_CERT_IO_ENABLED
;
1182 if (ssl_config_
.rev_checking_required_local_anchors
)
1183 flags
|= CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS
;
1184 verifier_
.reset(new SingleRequestCertVerifier(cert_verifier_
));
1185 return verifier_
->Verify(
1187 host_and_port_
.host(),
1189 // TODO(davidben): Route the CRLSet through SSLConfig so
1190 // SSLClientSocket doesn't depend on SSLConfigService.
1191 SSLConfigService::GetCRLSet().get(),
1192 &server_cert_verify_result_
,
1193 base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete
,
1194 base::Unretained(this)),
1198 int SSLClientSocketOpenSSL::DoVerifyCertComplete(int result
) {
1201 if (!start_cert_verification_time_
.is_null()) {
1202 base::TimeDelta verify_time
=
1203 base::TimeTicks::Now() - start_cert_verification_time_
;
1205 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTime", verify_time
);
1207 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTimeError", verify_time
);
1212 RecordConnectionTypeMetrics(GetNetSSLVersion(ssl_
));
1214 if (SSL_session_reused(ssl_
)) {
1215 // Record whether or not the server tried to resume a session for a
1216 // different version. See https://crbug.com/441456.
1217 UMA_HISTOGRAM_BOOLEAN(
1218 "Net.SSLSessionVersionMatch",
1219 SSL_version(ssl_
) == SSL_get_session(ssl_
)->ssl_version
);
1223 const CertStatus cert_status
= server_cert_verify_result_
.cert_status
;
1224 if (transport_security_state_
&&
1226 (IsCertificateError(result
) && IsCertStatusMinorError(cert_status
))) &&
1227 !transport_security_state_
->CheckPublicKeyPins(
1228 host_and_port_
.host(),
1229 server_cert_verify_result_
.is_issued_by_known_root
,
1230 server_cert_verify_result_
.public_key_hashes
,
1231 &pinning_failure_log_
)) {
1232 result
= ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN
;
1236 // Only check Certificate Transparency if there were no other errors with
1240 // TODO(joth): Work out if we need to remember the intermediate CA certs
1241 // when the server sends them to us, and do so here.
1242 SSLContext::GetInstance()->session_cache()->MarkSSLSessionAsGood(ssl_
);
1243 marked_session_as_good_
= true;
1244 CheckIfHandshakeFinished();
1246 DVLOG(1) << "DoVerifyCertComplete error " << ErrorToString(result
)
1247 << " (" << result
<< ")";
1250 completed_connect_
= true;
1252 // Exit DoHandshakeLoop and return the result to the caller to Connect.
1253 DCHECK_EQ(STATE_NONE
, next_handshake_state_
);
1257 void SSLClientSocketOpenSSL::DoConnectCallback(int rv
) {
1259 OnHandshakeCompletion();
1260 if (!user_connect_callback_
.is_null()) {
1261 CompletionCallback c
= user_connect_callback_
;
1262 user_connect_callback_
.Reset();
1263 c
.Run(rv
> OK
? OK
: rv
);
1267 void SSLClientSocketOpenSSL::UpdateServerCert() {
1268 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1269 tracked_objects::ScopedTracker
tracking_profile(
1270 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1271 "424386 SSLClientSocketOpenSSL::UpdateServerCert"));
1273 server_cert_chain_
->Reset(SSL_get_peer_cert_chain(ssl_
));
1275 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1276 tracked_objects::ScopedTracker
tracking_profile1(
1277 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1278 "424386 SSLClientSocketOpenSSL::UpdateServerCert1"));
1279 server_cert_
= server_cert_chain_
->AsOSChain();
1281 if (server_cert_
.get()) {
1283 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED
,
1284 base::Bind(&NetLogX509CertificateCallback
,
1285 base::Unretained(server_cert_
.get())));
1287 // TODO(rsleevi): Plumb an OCSP response into the Mac system library and
1288 // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714
1289 if (IsOCSPStaplingSupported()) {
1291 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is
1293 tracked_objects::ScopedTracker
tracking_profile2(
1294 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1295 "424386 SSLClientSocketOpenSSL::UpdateServerCert2"));
1297 const uint8_t* ocsp_response_raw
;
1298 size_t ocsp_response_len
;
1299 SSL_get0_ocsp_response(ssl_
, &ocsp_response_raw
, &ocsp_response_len
);
1301 CRYPT_DATA_BLOB ocsp_response_blob
;
1302 ocsp_response_blob
.cbData
= ocsp_response_len
;
1303 ocsp_response_blob
.pbData
= const_cast<BYTE
*>(ocsp_response_raw
);
1304 BOOL ok
= CertSetCertificateContextProperty(
1305 server_cert_
->os_cert_handle(),
1306 CERT_OCSP_RESPONSE_PROP_ID
,
1307 CERT_SET_PROPERTY_IGNORE_PERSIST_ERROR_FLAG
,
1308 &ocsp_response_blob
);
1310 VLOG(1) << "Failed to set OCSP response property: "
1320 void SSLClientSocketOpenSSL::VerifyCT() {
1321 if (!cert_transparency_verifier_
)
1324 const uint8_t* ocsp_response_raw
;
1325 size_t ocsp_response_len
;
1326 SSL_get0_ocsp_response(ssl_
, &ocsp_response_raw
, &ocsp_response_len
);
1327 std::string ocsp_response
;
1328 if (ocsp_response_len
> 0) {
1329 ocsp_response
.assign(reinterpret_cast<const char*>(ocsp_response_raw
),
1333 const uint8_t* sct_list_raw
;
1334 size_t sct_list_len
;
1335 SSL_get0_signed_cert_timestamp_list(ssl_
, &sct_list_raw
, &sct_list_len
);
1336 std::string sct_list
;
1337 if (sct_list_len
> 0)
1338 sct_list
.assign(reinterpret_cast<const char*>(sct_list_raw
), sct_list_len
);
1340 // Note that this is a completely synchronous operation: The CT Log Verifier
1341 // gets all the data it needs for SCT verification and does not do any
1342 // external communication.
1343 cert_transparency_verifier_
->Verify(
1344 server_cert_verify_result_
.verified_cert
.get(), ocsp_response
, sct_list
,
1345 &ct_verify_result_
, net_log_
);
1347 if (!policy_enforcer_
) {
1348 server_cert_verify_result_
.cert_status
&= ~CERT_STATUS_IS_EV
;
1350 if (server_cert_verify_result_
.cert_status
& CERT_STATUS_IS_EV
) {
1351 scoped_refptr
<ct::EVCertsWhitelist
> ev_whitelist
=
1352 SSLConfigService::GetEVCertsWhitelist();
1353 if (!policy_enforcer_
->DoesConformToCTEVPolicy(
1354 server_cert_verify_result_
.verified_cert
.get(),
1355 ev_whitelist
.get(), ct_verify_result_
, net_log_
)) {
1356 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766
1357 VLOG(1) << "EV certificate for "
1358 << server_cert_verify_result_
.verified_cert
->subject()
1360 << " does not conform to CT policy, removing EV status.";
1361 server_cert_verify_result_
.cert_status
&= ~CERT_STATUS_IS_EV
;
1367 void SSLClientSocketOpenSSL::OnHandshakeIOComplete(int result
) {
1368 int rv
= DoHandshakeLoop(result
);
1369 if (rv
!= ERR_IO_PENDING
) {
1370 net_log_
.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT
, rv
);
1371 DoConnectCallback(rv
);
1375 void SSLClientSocketOpenSSL::OnSendComplete(int result
) {
1376 if (next_handshake_state_
== STATE_HANDSHAKE
) {
1377 // In handshake phase.
1378 OnHandshakeIOComplete(result
);
1382 // OnSendComplete may need to call DoPayloadRead while the renegotiation
1383 // handshake is in progress.
1384 int rv_read
= ERR_IO_PENDING
;
1385 int rv_write
= ERR_IO_PENDING
;
1388 if (user_read_buf_
.get())
1389 rv_read
= DoPayloadRead();
1390 if (user_write_buf_
.get())
1391 rv_write
= DoPayloadWrite();
1392 network_moved
= DoTransportIO();
1393 } while (rv_read
== ERR_IO_PENDING
&& rv_write
== ERR_IO_PENDING
&&
1394 (user_read_buf_
.get() || user_write_buf_
.get()) && network_moved
);
1396 // Performing the Read callback may cause |this| to be deleted. If this
1397 // happens, the Write callback should not be invoked. Guard against this by
1398 // holding a WeakPtr to |this| and ensuring it's still valid.
1399 base::WeakPtr
<SSLClientSocketOpenSSL
> guard(weak_factory_
.GetWeakPtr());
1400 if (user_read_buf_
.get() && rv_read
!= ERR_IO_PENDING
)
1401 DoReadCallback(rv_read
);
1406 if (user_write_buf_
.get() && rv_write
!= ERR_IO_PENDING
)
1407 DoWriteCallback(rv_write
);
1410 void SSLClientSocketOpenSSL::OnRecvComplete(int result
) {
1411 if (next_handshake_state_
== STATE_HANDSHAKE
) {
1412 // In handshake phase.
1413 OnHandshakeIOComplete(result
);
1417 // Network layer received some data, check if client requested to read
1419 if (!user_read_buf_
.get())
1422 int rv
= DoReadLoop();
1423 if (rv
!= ERR_IO_PENDING
)
1427 int SSLClientSocketOpenSSL::DoHandshakeLoop(int last_io_result
) {
1428 int rv
= last_io_result
;
1430 // Default to STATE_NONE for next state.
1431 // (This is a quirk carried over from the windows
1432 // implementation. It makes reading the logs a bit harder.)
1433 // State handlers can and often do call GotoState just
1434 // to stay in the current state.
1435 State state
= next_handshake_state_
;
1436 GotoState(STATE_NONE
);
1438 case STATE_HANDSHAKE
:
1441 case STATE_CHANNEL_ID_LOOKUP
:
1443 rv
= DoChannelIDLookup();
1445 case STATE_CHANNEL_ID_LOOKUP_COMPLETE
:
1446 rv
= DoChannelIDLookupComplete(rv
);
1448 case STATE_VERIFY_CERT
:
1450 rv
= DoVerifyCert(rv
);
1452 case STATE_VERIFY_CERT_COMPLETE
:
1453 rv
= DoVerifyCertComplete(rv
);
1457 rv
= ERR_UNEXPECTED
;
1458 NOTREACHED() << "unexpected state" << state
;
1462 bool network_moved
= DoTransportIO();
1463 if (network_moved
&& next_handshake_state_
== STATE_HANDSHAKE
) {
1464 // In general we exit the loop if rv is ERR_IO_PENDING. In this
1465 // special case we keep looping even if rv is ERR_IO_PENDING because
1466 // the transport IO may allow DoHandshake to make progress.
1467 rv
= OK
; // This causes us to stay in the loop.
1469 } while (rv
!= ERR_IO_PENDING
&& next_handshake_state_
!= STATE_NONE
);
1474 int SSLClientSocketOpenSSL::DoReadLoop() {
1478 rv
= DoPayloadRead();
1479 network_moved
= DoTransportIO();
1480 } while (rv
== ERR_IO_PENDING
&& network_moved
);
1485 int SSLClientSocketOpenSSL::DoWriteLoop() {
1489 rv
= DoPayloadWrite();
1490 network_moved
= DoTransportIO();
1491 } while (rv
== ERR_IO_PENDING
&& network_moved
);
1496 int SSLClientSocketOpenSSL::DoPayloadRead() {
1497 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
1500 if (pending_read_error_
!= kNoPendingReadResult
) {
1501 rv
= pending_read_error_
;
1502 pending_read_error_
= kNoPendingReadResult
;
1504 net_log_
.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED
,
1505 rv
, user_read_buf_
->data());
1508 NetLog::TYPE_SSL_READ_ERROR
,
1509 CreateNetLogOpenSSLErrorCallback(rv
, pending_read_ssl_error_
,
1510 pending_read_error_info_
));
1512 pending_read_ssl_error_
= SSL_ERROR_NONE
;
1513 pending_read_error_info_
= OpenSSLErrorInfo();
1517 int total_bytes_read
= 0;
1519 rv
= SSL_read(ssl_
, user_read_buf_
->data() + total_bytes_read
,
1520 user_read_buf_len_
- total_bytes_read
);
1522 total_bytes_read
+= rv
;
1523 } while (total_bytes_read
< user_read_buf_len_
&& rv
> 0);
1525 if (total_bytes_read
== user_read_buf_len_
) {
1526 rv
= total_bytes_read
;
1528 // Otherwise, an error occurred (rv <= 0). The error needs to be handled
1529 // immediately, while the OpenSSL errors are still available in
1530 // thread-local storage. However, the handled/remapped error code should
1531 // only be returned if no application data was already read; if it was, the
1532 // error code should be deferred until the next call of DoPayloadRead.
1534 // If no data was read, |*next_result| will point to the return value of
1535 // this function. If at least some data was read, |*next_result| will point
1536 // to |pending_read_error_|, to be returned in a future call to
1537 // DoPayloadRead() (e.g.: after the current data is handled).
1538 int *next_result
= &rv
;
1539 if (total_bytes_read
> 0) {
1540 pending_read_error_
= rv
;
1541 rv
= total_bytes_read
;
1542 next_result
= &pending_read_error_
;
1545 if (client_auth_cert_needed_
) {
1546 *next_result
= ERR_SSL_CLIENT_AUTH_CERT_NEEDED
;
1547 } else if (*next_result
< 0) {
1548 pending_read_ssl_error_
= SSL_get_error(ssl_
, *next_result
);
1549 *next_result
= MapOpenSSLErrorWithDetails(pending_read_ssl_error_
,
1551 &pending_read_error_info_
);
1553 // Many servers do not reliably send a close_notify alert when shutting
1554 // down a connection, and instead terminate the TCP connection. This is
1555 // reported as ERR_CONNECTION_CLOSED. Because of this, map the unclean
1556 // shutdown to a graceful EOF, instead of treating it as an error as it
1558 if (*next_result
== ERR_CONNECTION_CLOSED
)
1561 if (rv
> 0 && *next_result
== ERR_IO_PENDING
) {
1562 // If at least some data was read from SSL_read(), do not treat
1563 // insufficient data as an error to return in the next call to
1564 // DoPayloadRead() - instead, let the call fall through to check
1565 // SSL_read() again. This is because DoTransportIO() may complete
1566 // in between the next call to DoPayloadRead(), and thus it is
1567 // important to check SSL_read() on subsequent invocations to see
1568 // if a complete record may now be read.
1569 *next_result
= kNoPendingReadResult
;
1575 net_log_
.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED
, rv
,
1576 user_read_buf_
->data());
1577 } else if (rv
!= ERR_IO_PENDING
) {
1579 NetLog::TYPE_SSL_READ_ERROR
,
1580 CreateNetLogOpenSSLErrorCallback(rv
, pending_read_ssl_error_
,
1581 pending_read_error_info_
));
1582 pending_read_ssl_error_
= SSL_ERROR_NONE
;
1583 pending_read_error_info_
= OpenSSLErrorInfo();
1588 int SSLClientSocketOpenSSL::DoPayloadWrite() {
1589 crypto::OpenSSLErrStackTracer
err_tracer(FROM_HERE
);
1590 int rv
= SSL_write(ssl_
, user_write_buf_
->data(), user_write_buf_len_
);
1592 net_log_
.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT
, rv
,
1593 user_write_buf_
->data());
1597 int ssl_error
= SSL_get_error(ssl_
, rv
);
1598 OpenSSLErrorInfo error_info
;
1599 int net_error
= MapOpenSSLErrorWithDetails(ssl_error
, err_tracer
,
1602 if (net_error
!= ERR_IO_PENDING
) {
1604 NetLog::TYPE_SSL_WRITE_ERROR
,
1605 CreateNetLogOpenSSLErrorCallback(net_error
, ssl_error
, error_info
));
1610 int SSLClientSocketOpenSSL::BufferSend(void) {
1611 if (transport_send_busy_
)
1612 return ERR_IO_PENDING
;
1614 size_t buffer_read_offset
;
1617 int status
= BIO_zero_copy_get_read_buf(transport_bio_
, &read_buf
,
1618 &buffer_read_offset
, &max_read
);
1619 DCHECK_EQ(status
, 1); // Should never fail.
1621 return 0; // Nothing pending in the OpenSSL write BIO.
1622 CHECK_EQ(read_buf
, reinterpret_cast<uint8_t*>(send_buffer_
->StartOfBuffer()));
1623 CHECK_LT(buffer_read_offset
, static_cast<size_t>(send_buffer_
->capacity()));
1624 send_buffer_
->set_offset(buffer_read_offset
);
1626 int rv
= transport_
->socket()->Write(
1627 send_buffer_
.get(), max_read
,
1628 base::Bind(&SSLClientSocketOpenSSL::BufferSendComplete
,
1629 base::Unretained(this)));
1630 if (rv
== ERR_IO_PENDING
) {
1631 transport_send_busy_
= true;
1633 TransportWriteComplete(rv
);
1638 int SSLClientSocketOpenSSL::BufferRecv(void) {
1639 if (transport_recv_busy_
)
1640 return ERR_IO_PENDING
;
1642 // Determine how much was requested from |transport_bio_| that was not
1643 // actually available.
1644 size_t requested
= BIO_ctrl_get_read_request(transport_bio_
);
1645 if (requested
== 0) {
1646 // This is not a perfect match of error codes, as no operation is
1647 // actually pending. However, returning 0 would be interpreted as
1648 // a possible sign of EOF, which is also an inappropriate match.
1649 return ERR_IO_PENDING
;
1652 // Known Issue: While only reading |requested| data is the more correct
1653 // implementation, it has the downside of resulting in frequent reads:
1654 // One read for the SSL record header (~5 bytes) and one read for the SSL
1655 // record body. Rather than issuing these reads to the underlying socket
1656 // (and constantly allocating new IOBuffers), a single Read() request to
1657 // fill |transport_bio_| is issued. As long as an SSL client socket cannot
1658 // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL
1659 // traffic, this over-subscribed Read()ing will not cause issues.
1661 size_t buffer_write_offset
;
1664 int status
= BIO_zero_copy_get_write_buf(transport_bio_
, &write_buf
,
1665 &buffer_write_offset
, &max_write
);
1666 DCHECK_EQ(status
, 1); // Should never fail.
1668 return ERR_IO_PENDING
;
1671 reinterpret_cast<uint8_t*>(recv_buffer_
->StartOfBuffer()));
1672 CHECK_LT(buffer_write_offset
, static_cast<size_t>(recv_buffer_
->capacity()));
1674 recv_buffer_
->set_offset(buffer_write_offset
);
1675 int rv
= transport_
->socket()->Read(
1678 base::Bind(&SSLClientSocketOpenSSL::BufferRecvComplete
,
1679 base::Unretained(this)));
1680 if (rv
== ERR_IO_PENDING
) {
1681 transport_recv_busy_
= true;
1683 rv
= TransportReadComplete(rv
);
1688 void SSLClientSocketOpenSSL::BufferSendComplete(int result
) {
1689 TransportWriteComplete(result
);
1690 OnSendComplete(result
);
1693 void SSLClientSocketOpenSSL::BufferRecvComplete(int result
) {
1694 result
= TransportReadComplete(result
);
1695 OnRecvComplete(result
);
1698 void SSLClientSocketOpenSSL::TransportWriteComplete(int result
) {
1699 DCHECK(ERR_IO_PENDING
!= result
);
1700 int bytes_written
= 0;
1702 // Record the error. Save it to be reported in a future read or write on
1703 // transport_bio_'s peer.
1704 transport_write_error_
= result
;
1706 bytes_written
= result
;
1708 DCHECK_GE(send_buffer_
->RemainingCapacity(), bytes_written
);
1709 int ret
= BIO_zero_copy_get_read_buf_done(transport_bio_
, bytes_written
);
1711 transport_send_busy_
= false;
1714 int SSLClientSocketOpenSSL::TransportReadComplete(int result
) {
1715 DCHECK(ERR_IO_PENDING
!= result
);
1716 // If an EOF, canonicalize to ERR_CONNECTION_CLOSED here so MapOpenSSLError
1717 // does not report success.
1719 result
= ERR_CONNECTION_CLOSED
;
1722 DVLOG(1) << "TransportReadComplete result " << result
;
1723 // Received an error. Save it to be reported in a future read on
1724 // transport_bio_'s peer.
1725 transport_read_error_
= result
;
1727 bytes_read
= result
;
1729 DCHECK_GE(recv_buffer_
->RemainingCapacity(), bytes_read
);
1730 int ret
= BIO_zero_copy_get_write_buf_done(transport_bio_
, bytes_read
);
1732 transport_recv_busy_
= false;
1736 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL
* ssl
) {
1737 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1738 tracked_objects::ScopedTracker
tracking_profile(
1739 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1740 "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback"));
1742 DVLOG(3) << "OpenSSL ClientCertRequestCallback called";
1743 DCHECK(ssl
== ssl_
);
1745 net_log_
.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED
);
1747 // Clear any currently configured certificates.
1748 SSL_certs_clear(ssl_
);
1751 // TODO(droger): Support client auth on iOS. See http://crbug.com/145954).
1752 LOG(WARNING
) << "Client auth is not supported";
1753 #else // !defined(OS_IOS)
1754 if (!ssl_config_
.send_client_cert
) {
1755 // First pass: we know that a client certificate is needed, but we do not
1756 // have one at hand.
1757 client_auth_cert_needed_
= true;
1758 STACK_OF(X509_NAME
) *authorities
= SSL_get_client_CA_list(ssl
);
1759 for (size_t i
= 0; i
< sk_X509_NAME_num(authorities
); i
++) {
1760 X509_NAME
*ca_name
= (X509_NAME
*)sk_X509_NAME_value(authorities
, i
);
1761 unsigned char* str
= NULL
;
1762 int length
= i2d_X509_NAME(ca_name
, &str
);
1763 cert_authorities_
.push_back(std::string(
1764 reinterpret_cast<const char*>(str
),
1765 static_cast<size_t>(length
)));
1769 const unsigned char* client_cert_types
;
1770 size_t num_client_cert_types
=
1771 SSL_get0_certificate_types(ssl
, &client_cert_types
);
1772 for (size_t i
= 0; i
< num_client_cert_types
; i
++) {
1773 cert_key_types_
.push_back(
1774 static_cast<SSLClientCertType
>(client_cert_types
[i
]));
1777 return -1; // Suspends handshake.
1780 // Second pass: a client certificate should have been selected.
1781 if (ssl_config_
.client_cert
.get()) {
1782 ScopedX509 leaf_x509
=
1783 OSCertHandleToOpenSSL(ssl_config_
.client_cert
->os_cert_handle());
1785 LOG(WARNING
) << "Failed to import certificate";
1786 OpenSSLPutNetError(FROM_HERE
, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT
);
1790 ScopedX509Stack chain
= OSCertHandlesToOpenSSL(
1791 ssl_config_
.client_cert
->GetIntermediateCertificates());
1793 LOG(WARNING
) << "Failed to import intermediate certificates";
1794 OpenSSLPutNetError(FROM_HERE
, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT
);
1798 // TODO(davidben): With Linux client auth support, this should be
1799 // conditioned on OS_ANDROID and then, with https://crbug.com/394131,
1800 // removed altogether. OpenSSLClientKeyStore is mostly an artifact of the
1801 // net/ client auth API lacking a private key handle.
1802 #if defined(USE_OPENSSL_CERTS)
1803 crypto::ScopedEVP_PKEY privkey
=
1804 OpenSSLClientKeyStore::GetInstance()->FetchClientCertPrivateKey(
1805 ssl_config_
.client_cert
.get());
1806 #else // !defined(USE_OPENSSL_CERTS)
1807 crypto::ScopedEVP_PKEY privkey
=
1808 FetchClientCertPrivateKey(ssl_config_
.client_cert
.get());
1809 #endif // defined(USE_OPENSSL_CERTS)
1811 // Could not find the private key. Fail the handshake and surface an
1812 // appropriate error to the caller.
1813 LOG(WARNING
) << "Client cert found without private key";
1814 OpenSSLPutNetError(FROM_HERE
, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY
);
1818 if (!SSL_use_certificate(ssl_
, leaf_x509
.get()) ||
1819 !SSL_use_PrivateKey(ssl_
, privkey
.get()) ||
1820 !SSL_set1_chain(ssl_
, chain
.get())) {
1821 LOG(WARNING
) << "Failed to set client certificate";
1825 int cert_count
= 1 + sk_X509_num(chain
.get());
1826 net_log_
.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED
,
1827 NetLog::IntegerCallback("cert_count", cert_count
));
1830 #endif // defined(OS_IOS)
1832 // Send no client certificate.
1833 net_log_
.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED
,
1834 NetLog::IntegerCallback("cert_count", 0));
1838 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX
* store_ctx
) {
1839 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1840 tracked_objects::ScopedTracker
tracking_profile(
1841 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1842 "424386 SSLClientSocketOpenSSL::CertVerifyCallback"));
1844 if (!completed_connect_
) {
1845 // If the first handshake hasn't completed then we accept any certificates
1846 // because we verify after the handshake.
1850 // Disallow the server certificate to change in a renegotiation.
1851 if (server_cert_chain_
->empty()) {
1852 LOG(ERROR
) << "Received invalid certificate chain between handshakes";
1855 base::StringPiece old_der
, new_der
;
1856 if (store_ctx
->cert
== NULL
||
1857 !x509_util::GetDER(server_cert_chain_
->Get(0), &old_der
) ||
1858 !x509_util::GetDER(store_ctx
->cert
, &new_der
)) {
1859 LOG(ERROR
) << "Failed to encode certificates";
1862 if (old_der
!= new_der
) {
1863 LOG(ERROR
) << "Server certificate changed between handshakes";
1870 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the
1871 // server supports NPN, selects a protocol from the list that the server
1872 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the
1873 // callback can assume that |in| is syntactically valid.
1874 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out
,
1875 unsigned char* outlen
,
1876 const unsigned char* in
,
1877 unsigned int inlen
) {
1878 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1879 tracked_objects::ScopedTracker
tracking_profile(
1880 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1881 "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback"));
1883 if (ssl_config_
.next_protos
.empty()) {
1884 *out
= reinterpret_cast<uint8
*>(
1885 const_cast<char*>(kDefaultSupportedNPNProtocol
));
1886 *outlen
= arraysize(kDefaultSupportedNPNProtocol
) - 1;
1887 npn_status_
= kNextProtoUnsupported
;
1888 return SSL_TLSEXT_ERR_OK
;
1891 // Assume there's no overlap between our protocols and the server's list.
1892 npn_status_
= kNextProtoNoOverlap
;
1894 // For each protocol in server preference order, see if we support it.
1895 for (unsigned int i
= 0; i
< inlen
; i
+= in
[i
] + 1) {
1896 for (NextProto next_proto
: ssl_config_
.next_protos
) {
1897 const std::string proto
= NextProtoToString(next_proto
);
1898 if (in
[i
] == proto
.size() &&
1899 memcmp(&in
[i
+ 1], proto
.data(), in
[i
]) == 0) {
1900 // We found a match.
1901 *out
= const_cast<unsigned char*>(in
) + i
+ 1;
1903 npn_status_
= kNextProtoNegotiated
;
1907 if (npn_status_
== kNextProtoNegotiated
)
1911 // If we didn't find a protocol, we select the first one from our list.
1912 if (npn_status_
== kNextProtoNoOverlap
) {
1913 // NextProtoToString returns a pointer to a static string.
1914 const char* proto
= NextProtoToString(ssl_config_
.next_protos
[0]);
1915 *out
= reinterpret_cast<unsigned char*>(const_cast<char*>(proto
));
1916 *outlen
= strlen(proto
);
1919 npn_proto_
.assign(reinterpret_cast<const char*>(*out
), *outlen
);
1920 DVLOG(2) << "next protocol: '" << npn_proto_
<< "' status: " << npn_status_
;
1921 set_negotiation_extension(kExtensionNPN
);
1922 return SSL_TLSEXT_ERR_OK
;
1925 long SSLClientSocketOpenSSL::MaybeReplayTransportError(
1928 const char *argp
, int argi
, long argl
,
1930 if (cmd
== (BIO_CB_READ
|BIO_CB_RETURN
) && retvalue
<= 0) {
1931 // If there is no more data in the buffer, report any pending errors that
1932 // were observed. Note that both the readbuf and the writebuf are checked
1933 // for errors, since the application may have encountered a socket error
1934 // while writing that would otherwise not be reported until the application
1935 // attempted to write again - which it may never do. See
1936 // https://crbug.com/249848.
1937 if (transport_read_error_
!= OK
) {
1938 OpenSSLPutNetError(FROM_HERE
, transport_read_error_
);
1941 if (transport_write_error_
!= OK
) {
1942 OpenSSLPutNetError(FROM_HERE
, transport_write_error_
);
1945 } else if (cmd
== BIO_CB_WRITE
) {
1946 // Because of the write buffer, this reports a failure from the previous
1947 // write payload. If the current payload fails to write, the error will be
1948 // reported in a future write or read to |bio|.
1949 if (transport_write_error_
!= OK
) {
1950 OpenSSLPutNetError(FROM_HERE
, transport_write_error_
);
1958 long SSLClientSocketOpenSSL::BIOCallback(
1961 const char *argp
, int argi
, long argl
,
1963 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1964 tracked_objects::ScopedTracker
tracking_profile(
1965 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1966 "424386 SSLClientSocketOpenSSL::BIOCallback"));
1968 SSLClientSocketOpenSSL
* socket
= reinterpret_cast<SSLClientSocketOpenSSL
*>(
1969 BIO_get_callback_arg(bio
));
1971 return socket
->MaybeReplayTransportError(
1972 bio
, cmd
, argp
, argi
, argl
, retvalue
);
1976 void SSLClientSocketOpenSSL::InfoCallback(const SSL
* ssl
,
1979 // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed.
1980 tracked_objects::ScopedTracker
tracking_profile(
1981 FROM_HERE_WITH_EXPLICIT_FUNCTION(
1982 "424386 SSLClientSocketOpenSSL::InfoCallback"));
1984 if (type
== SSL_CB_HANDSHAKE_DONE
) {
1985 SSLClientSocketOpenSSL
* ssl_socket
=
1986 SSLContext::GetInstance()->GetClientSocketFromSSL(ssl
);
1987 ssl_socket
->handshake_succeeded_
= true;
1988 ssl_socket
->CheckIfHandshakeFinished();
1992 // Determines if both the handshake and certificate verification have completed
1993 // successfully, and calls the handshake completion callback if that is the
1996 // CheckIfHandshakeFinished is called twice per connection: once after
1997 // MarkSSLSessionAsGood, when the certificate has been verified, and
1998 // once via an OpenSSL callback when the handshake has completed. On the
1999 // second call, when the certificate has been verified and the handshake
2000 // has completed, the connection's handshake completion callback is run.
2001 void SSLClientSocketOpenSSL::CheckIfHandshakeFinished() {
2002 if (handshake_succeeded_
&& marked_session_as_good_
)
2003 OnHandshakeCompletion();
2006 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo
* ssl_info
) const {
2007 for (ct::SCTList::const_iterator iter
=
2008 ct_verify_result_
.verified_scts
.begin();
2009 iter
!= ct_verify_result_
.verified_scts
.end(); ++iter
) {
2010 ssl_info
->signed_certificate_timestamps
.push_back(
2011 SignedCertificateTimestampAndStatus(*iter
, ct::SCT_STATUS_OK
));
2013 for (ct::SCTList::const_iterator iter
=
2014 ct_verify_result_
.invalid_scts
.begin();
2015 iter
!= ct_verify_result_
.invalid_scts
.end(); ++iter
) {
2016 ssl_info
->signed_certificate_timestamps
.push_back(
2017 SignedCertificateTimestampAndStatus(*iter
, ct::SCT_STATUS_INVALID
));
2019 for (ct::SCTList::const_iterator iter
=
2020 ct_verify_result_
.unknown_logs_scts
.begin();
2021 iter
!= ct_verify_result_
.unknown_logs_scts
.end(); ++iter
) {
2022 ssl_info
->signed_certificate_timestamps
.push_back(
2023 SignedCertificateTimestampAndStatus(*iter
,
2024 ct::SCT_STATUS_LOG_UNKNOWN
));
2028 scoped_refptr
<X509Certificate
>
2029 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
2030 return server_cert_
;