net/socket/ssl_client_socket_nss.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
   7
   8 #include <certt.h>
   9 #include <keyt.h>
  10 #include <nspr.h>
  11 #include <nss.h>
  12
  13 #include <string>
  14 #include <vector>
  15
  16 #include "base/memory/scoped_ptr.h"
  17 #include "base/synchronization/lock.h"
  18 #include "base/threading/platform_thread.h"
  19 #include "base/time/time.h"
  20 #include "net/base/completion_callback.h"
  21 #include "net/base/host_port_pair.h"
  22 #include "net/base/net_export.h"
  23 #include "net/base/net_log.h"
  24 #include "net/base/nss_memio.h"
  25 #include "net/cert/cert_verify_result.h"
  26 #include "net/cert/ct_verify_result.h"
  27 #include "net/cert/x509_certificate.h"
  28 #include "net/socket/ssl_client_socket.h"
  29 #include "net/ssl/channel_id_service.h"
  30 #include "net/ssl/ssl_config_service.h"
  31
  32 namespace base {
  33 class SequencedTaskRunner;
  34 }
  35
  36 namespace net {
  37
  38 class BoundNetLog;
  39 class CertPolicyEnforcer;
  40 class CertVerifier;
  41 class ChannelIDService;
  42 class CTVerifier;
  43 class ClientSocketHandle;
  44 class SingleRequestCertVerifier;
  45 class TransportSecurityState;
  46 class X509Certificate;
  47
  48 // An SSL client socket implemented with Mozilla NSS.
  49 class SSLClientSocketNSS : public SSLClientSocket {
  50  public:
  51   // Takes ownership of the |transport_socket|, which must already be connected.
  52   // The hostname specified in |host_and_port| will be compared with the name(s)
  53   // in the server's certificate during the SSL handshake.  If SSL client
  54   // authentication is requested, the host_and_port field of SSLCertRequestInfo
  55   // will be populated with |host_and_port|.  |ssl_config| specifies
  56   // the SSL settings.
  57   //
  58   // Because calls to NSS may block, such as due to needing to access slow
  59   // hardware or needing to synchronously unlock protected tokens, calls to
  60   // NSS may optionally be run on a dedicated thread. If synchronous/blocking
  61   // behaviour is desired, for performance or compatibility, the current task
  62   // runner should be supplied instead.
  63   SSLClientSocketNSS(base::SequencedTaskRunner* nss_task_runner,
  64                      scoped_ptr<ClientSocketHandle> transport_socket,
  65                      const HostPortPair& host_and_port,
  66                      const SSLConfig& ssl_config,
  67                      const SSLClientSocketContext& context);
  68   ~SSLClientSocketNSS() override;
  69
  70   // SSLClientSocket implementation.
  71   std::string GetSessionCacheKey() const override;
  72   bool InSessionCache() const override;
  73   void SetHandshakeCompletionCallback(const base::Closure& callback) override;
  74   void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info) override;
  75   NextProtoStatus GetNextProto(std::string* proto) override;
  76
  77   // SSLSocket implementation.
  78   int ExportKeyingMaterial(const base::StringPiece& label,
  79                            bool has_context,
  80                            const base::StringPiece& context,
  81                            unsigned char* out,
  82                            unsigned int outlen) override;
  83   int GetTLSUniqueChannelBinding(std::string* out) override;
  84
  85   // StreamSocket implementation.
  86   int Connect(const CompletionCallback& callback) override;
  87   void Disconnect() override;
  88   bool IsConnected() const override;
  89   bool IsConnectedAndIdle() const override;
  90   int GetPeerAddress(IPEndPoint* address) const override;
  91   int GetLocalAddress(IPEndPoint* address) const override;
  92   const BoundNetLog& NetLog() const override;
  93   void SetSubresourceSpeculation() override;
  94   void SetOmniboxSpeculation() override;
  95   bool WasEverUsed() const override;
  96   bool UsingTCPFastOpen() const override;
  97   bool GetSSLInfo(SSLInfo* ssl_info) override;
  98
  99   // Socket implementation.
 100   int Read(IOBuffer* buf,
 101            int buf_len,
 102            const CompletionCallback& callback) override;
 103   int Write(IOBuffer* buf,
 104             int buf_len,
 105             const CompletionCallback& callback) override;
 106   int SetReceiveBufferSize(int32 size) override;
 107   int SetSendBufferSize(int32 size) override;
 108   ChannelIDService* GetChannelIDService() const override;
 109
 110  protected:
 111   // SSLClientSocket implementation.
 112   scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
 113       const override;
 114
 115  private:
 116   // Helper class to handle marshalling any NSS interaction to and from the
 117   // NSS and network task runners. Not every call needs to happen on the Core
 118   class Core;
 119
 120   enum State {
 121     STATE_NONE,
 122     STATE_HANDSHAKE,
 123     STATE_HANDSHAKE_COMPLETE,
 124     STATE_VERIFY_CERT,
 125     STATE_VERIFY_CERT_COMPLETE,
 126   };
 127
 128   int Init();
 129   void InitCore();
 130
 131   // Initializes NSS SSL options.  Returns a net error code.
 132   int InitializeSSLOptions();
 133
 134   // Initializes the socket peer name in SSL.  Returns a net error code.
 135   int InitializeSSLPeerName();
 136
 137   void DoConnectCallback(int result);
 138   void OnHandshakeIOComplete(int result);
 139
 140   int DoHandshakeLoop(int last_io_result);
 141   int DoHandshake();
 142   int DoHandshakeComplete(int result);
 143   int DoVerifyCert(int result);
 144   int DoVerifyCertComplete(int result);
 145
 146   void VerifyCT();
 147
 148   // The following methods are for debugging bug 65948. Will remove this code
 149   // after fixing bug 65948.
 150   void EnsureThreadIdAssigned() const;
 151   bool CalledOnValidThread() const;
 152
 153   // Adds the SignedCertificateTimestamps from ct_verify_result_ to |ssl_info|.
 154   // SCTs are held in three separate vectors in ct_verify_result, each
 155   // vetor representing a particular verification state, this method associates
 156   // each of the SCTs with the corresponding SCTVerifyStatus as it adds it to
 157   // the |ssl_info|.signed_certificate_timestamps list.
 158   void AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const;
 159
 160   // The task runner used to perform NSS operations.
 161   scoped_refptr<base::SequencedTaskRunner> nss_task_runner_;
 162   scoped_ptr<ClientSocketHandle> transport_;
 163   HostPortPair host_and_port_;
 164   SSLConfig ssl_config_;
 165
 166   scoped_refptr<Core> core_;
 167
 168   CompletionCallback user_connect_callback_;
 169
 170   CertVerifyResult server_cert_verify_result_;
 171
 172   CertVerifier* const cert_verifier_;
 173   scoped_ptr<SingleRequestCertVerifier> verifier_;
 174
 175   // Certificate Transparency: Verifier and result holder.
 176   ct::CTVerifyResult ct_verify_result_;
 177   CTVerifier* cert_transparency_verifier_;
 178
 179   // The service for retrieving Channel ID keys.  May be NULL.
 180   ChannelIDService* channel_id_service_;
 181
 182   // ssl_session_cache_shard_ is an opaque string that partitions the SSL
 183   // session cache. i.e. sessions created with one value will not attempt to
 184   // resume on the socket with a different value.
 185   const std::string ssl_session_cache_shard_;
 186
 187   // True if the SSL handshake has been completed.
 188   bool completed_handshake_;
 189
 190   State next_handshake_state_;
 191
 192   // The NSS SSL state machine. This is owned by |core_|.
 193   // TODO(rsleevi): http://crbug.com/130616 - Remove this member once
 194   // ExportKeyingMaterial is updated to be asynchronous.
 195   PRFileDesc* nss_fd_;
 196
 197   BoundNetLog net_log_;
 198
 199   base::TimeTicks start_cert_verification_time_;
 200
 201   TransportSecurityState* transport_security_state_;
 202
 203   CertPolicyEnforcer* const policy_enforcer_;
 204
 205   // pinning_failure_log contains a message produced by
 206   // TransportSecurityState::CheckPublicKeyPins in the event of a
 207   // pinning failure. It is a (somewhat) human-readable string.
 208   std::string pinning_failure_log_;
 209
 210   // The following two variables are added for debugging bug 65948. Will
 211   // remove this code after fixing bug 65948.
 212   // Added the following code Debugging in release mode.
 213   mutable base::Lock lock_;
 214   // This is mutable so that CalledOnValidThread can set it.
 215   // It's guarded by |lock_|.
 216   mutable base::PlatformThreadId valid_thread_id_;
 217 };
 218
 219 }  // namespace net
 220
 221 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_