net/socket/ssl_client_socket_pool.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_
   7
   8 #include <map>
   9 #include <string>
  10 #include <vector>
  11
  12 #include "base/memory/ref_counted.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/time/time.h"
  15 #include "net/base/privacy_mode.h"
  16 #include "net/http/http_response_info.h"
  17 #include "net/socket/client_socket_pool.h"
  18 #include "net/socket/client_socket_pool_base.h"
  19 #include "net/socket/client_socket_pool_histograms.h"
  20 #include "net/socket/ssl_client_socket.h"
  21 #include "net/ssl/ssl_config_service.h"
  22
  23 namespace net {
  24
  25 class CertPolicyEnforcer;
  26 class CertVerifier;
  27 class ClientSocketFactory;
  28 class ConnectJobFactory;
  29 class CTVerifier;
  30 class HostPortPair;
  31 class HttpProxyClientSocketPool;
  32 class HttpProxySocketParams;
  33 class SOCKSClientSocketPool;
  34 class SOCKSSocketParams;
  35 class SSLClientSocket;
  36 class TransportClientSocketPool;
  37 class TransportSecurityState;
  38 class TransportSocketParams;
  39
  40 class NET_EXPORT_PRIVATE SSLSocketParams
  41     : public base::RefCounted<SSLSocketParams> {
  42  public:
  43   enum ConnectionType { DIRECT, SOCKS_PROXY, HTTP_PROXY };
  44
  45   // Exactly one of |direct_params|, |socks_proxy_params|, and
  46   // |http_proxy_params| must be non-NULL.
  47   SSLSocketParams(
  48       const scoped_refptr<TransportSocketParams>& direct_params,
  49       const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
  50       const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
  51       const HostPortPair& host_and_port,
  52       const SSLConfig& ssl_config,
  53       PrivacyMode privacy_mode,
  54       int load_flags,
  55       bool force_spdy_over_ssl,
  56       bool want_spdy_over_npn);
  57
  58   // Returns the type of the underlying connection.
  59   ConnectionType GetConnectionType() const;
  60
  61   // Must be called only when GetConnectionType() returns DIRECT.
  62   const scoped_refptr<TransportSocketParams>&
  63       GetDirectConnectionParams() const;
  64
  65   // Must be called only when GetConnectionType() returns SOCKS_PROXY.
  66   const scoped_refptr<SOCKSSocketParams>&
  67       GetSocksProxyConnectionParams() const;
  68
  69   // Must be called only when GetConnectionType() returns HTTP_PROXY.
  70   const scoped_refptr<HttpProxySocketParams>&
  71       GetHttpProxyConnectionParams() const;
  72
  73   const HostPortPair& host_and_port() const { return host_and_port_; }
  74   const SSLConfig& ssl_config() const { return ssl_config_; }
  75   PrivacyMode privacy_mode() const { return privacy_mode_; }
  76   int load_flags() const { return load_flags_; }
  77   bool force_spdy_over_ssl() const { return force_spdy_over_ssl_; }
  78   bool want_spdy_over_npn() const { return want_spdy_over_npn_; }
  79   bool ignore_limits() const { return ignore_limits_; }
  80
  81  private:
  82   friend class base::RefCounted<SSLSocketParams>;
  83   ~SSLSocketParams();
  84
  85   const scoped_refptr<TransportSocketParams> direct_params_;
  86   const scoped_refptr<SOCKSSocketParams> socks_proxy_params_;
  87   const scoped_refptr<HttpProxySocketParams> http_proxy_params_;
  88   const HostPortPair host_and_port_;
  89   const SSLConfig ssl_config_;
  90   const PrivacyMode privacy_mode_;
  91   const int load_flags_;
  92   const bool force_spdy_over_ssl_;
  93   const bool want_spdy_over_npn_;
  94   bool ignore_limits_;
  95
  96   DISALLOW_COPY_AND_ASSIGN(SSLSocketParams);
  97 };
  98
  99 // SSLConnectJobMessenger handles communication between concurrent
 100 // SSLConnectJobs that share the same SSL session cache key.
 101 //
 102 // SSLConnectJobMessengers tell the session cache when a certain
 103 // connection should be monitored for success or failure, and
 104 // tell SSLConnectJobs when to pause or resume their connections.
 105 class SSLConnectJobMessenger {
 106  public:
 107   struct SocketAndCallback {
 108     SocketAndCallback(SSLClientSocket* ssl_socket,
 109                       const base::Closure& job_resumption_callback);
 110     ~SocketAndCallback();
 111
 112     SSLClientSocket* socket;
 113     base::Closure callback;
 114   };
 115
 116   typedef std::vector<SocketAndCallback> SSLPendingSocketsAndCallbacks;
 117
 118   // |messenger_finished_callback| is run when a connection monitored by the
 119   // SSLConnectJobMessenger has completed and we are finished with the
 120   // SSLConnectJobMessenger.
 121   explicit SSLConnectJobMessenger(
 122       const base::Closure& messenger_finished_callback);
 123   ~SSLConnectJobMessenger();
 124
 125   // Removes |socket| from the set of sockets being monitored. This
 126   // guarantees that |job_resumption_callback| will not be called for
 127   // the socket.
 128   void RemovePendingSocket(SSLClientSocket* ssl_socket);
 129
 130   // Returns true if |ssl_socket|'s Connect() method should be called.
 131   bool CanProceed(SSLClientSocket* ssl_socket);
 132
 133   // Configures the SSLConnectJobMessenger to begin monitoring |ssl_socket|'s
 134   // connection status. After a successful connection, or an error,
 135   // the messenger will determine which sockets that have been added
 136   // via AddPendingSocket() to allow to proceed.
 137   void MonitorConnectionResult(SSLClientSocket* ssl_socket);
 138
 139   // Adds |socket| to the list of sockets waiting to Connect(). When
 140   // the messenger has determined that it's an appropriate time for |socket|
 141   // to connect, it will invoke |callback|.
 142   //
 143   // Note: It is an error to call AddPendingSocket() without having first
 144   // called MonitorConnectionResult() and configuring a socket that WILL
 145   // have Connect() called on it.
 146   void AddPendingSocket(SSLClientSocket* ssl_socket,
 147                         const base::Closure& callback);
 148
 149  private:
 150   // Processes pending callbacks when a socket completes its SSL handshake --
 151   // either successfully or unsuccessfully.
 152   void OnSSLHandshakeCompleted();
 153
 154   // Runs all callbacks stored in |pending_sockets_and_callbacks_|.
 155   void RunAllCallbacks(
 156       const SSLPendingSocketsAndCallbacks& pending_socket_and_callbacks);
 157
 158   SSLPendingSocketsAndCallbacks pending_sockets_and_callbacks_;
 159   // Note: this field is a vector to allow for future design changes. Currently,
 160   // this vector should only ever have one entry.
 161   std::vector<SSLClientSocket*> connecting_sockets_;
 162
 163   base::Closure messenger_finished_callback_;
 164
 165   base::WeakPtrFactory<SSLConnectJobMessenger> weak_factory_;
 166 };
 167
 168 // SSLConnectJob handles the SSL handshake after setting up the underlying
 169 // connection as specified in the params.
 170 class SSLConnectJob : public ConnectJob {
 171  public:
 172   // Callback to allow the SSLConnectJob to obtain an SSLConnectJobMessenger to
 173   // coordinate connecting. The SSLConnectJob will supply a unique identifer
 174   // (ex: the SSL session cache key), with the expectation that the same
 175   // Messenger will be returned for all such ConnectJobs.
 176   //
 177   // Note: It will only be called for situations where the SSL session cache
 178   // does not already have a candidate session to resume.
 179   typedef base::Callback<SSLConnectJobMessenger*(const std::string&)>
 180       GetMessengerCallback;
 181
 182   // Note: the SSLConnectJob does not own |messenger| so it must outlive the
 183   // job.
 184   SSLConnectJob(const std::string& group_name,
 185                 RequestPriority priority,
 186                 const scoped_refptr<SSLSocketParams>& params,
 187                 const base::TimeDelta& timeout_duration,
 188                 TransportClientSocketPool* transport_pool,
 189                 SOCKSClientSocketPool* socks_pool,
 190                 HttpProxyClientSocketPool* http_proxy_pool,
 191                 ClientSocketFactory* client_socket_factory,
 192                 const SSLClientSocketContext& context,
 193                 const GetMessengerCallback& get_messenger_callback,
 194                 Delegate* delegate,
 195                 NetLog* net_log);
 196   ~SSLConnectJob() override;
 197
 198   // ConnectJob methods.
 199   LoadState GetLoadState() const override;
 200
 201   void GetAdditionalErrorState(ClientSocketHandle* handle) override;
 202
 203  private:
 204   enum State {
 205     STATE_TRANSPORT_CONNECT,
 206     STATE_TRANSPORT_CONNECT_COMPLETE,
 207     STATE_SOCKS_CONNECT,
 208     STATE_SOCKS_CONNECT_COMPLETE,
 209     STATE_TUNNEL_CONNECT,
 210     STATE_TUNNEL_CONNECT_COMPLETE,
 211     STATE_CREATE_SSL_SOCKET,
 212     STATE_CHECK_FOR_RESUME,
 213     STATE_SSL_CONNECT,
 214     STATE_SSL_CONNECT_COMPLETE,
 215     STATE_NONE,
 216   };
 217
 218   void OnIOComplete(int result);
 219
 220   // Runs the state transition loop.
 221   int DoLoop(int result);
 222
 223   int DoTransportConnect();
 224   int DoTransportConnectComplete(int result);
 225   int DoSOCKSConnect();
 226   int DoSOCKSConnectComplete(int result);
 227   int DoTunnelConnect();
 228   int DoTunnelConnectComplete(int result);
 229   int DoCreateSSLSocket();
 230   int DoCheckForResume();
 231   int DoSSLConnect();
 232   int DoSSLConnectComplete(int result);
 233
 234   // Tells a waiting SSLConnectJob to resume its SSL connection.
 235   void ResumeSSLConnection();
 236
 237   // Returns the initial state for the state machine based on the
 238   // |connection_type|.
 239   static State GetInitialState(SSLSocketParams::ConnectionType connection_type);
 240
 241   // Starts the SSL connection process.  Returns OK on success and
 242   // ERR_IO_PENDING if it cannot immediately service the request.
 243   // Otherwise, it returns a net error code.
 244   int ConnectInternal() override;
 245
 246   scoped_refptr<SSLSocketParams> params_;
 247   TransportClientSocketPool* const transport_pool_;
 248   SOCKSClientSocketPool* const socks_pool_;
 249   HttpProxyClientSocketPool* const http_proxy_pool_;
 250   ClientSocketFactory* const client_socket_factory_;
 251
 252   const SSLClientSocketContext context_;
 253
 254   State next_state_;
 255   CompletionCallback io_callback_;
 256   scoped_ptr<ClientSocketHandle> transport_socket_handle_;
 257   scoped_ptr<SSLClientSocket> ssl_socket_;
 258
 259   SSLConnectJobMessenger* messenger_;
 260   HttpResponseInfo error_response_info_;
 261
 262   GetMessengerCallback get_messenger_callback_;
 263
 264   base::WeakPtrFactory<SSLConnectJob> weak_factory_;
 265
 266   DISALLOW_COPY_AND_ASSIGN(SSLConnectJob);
 267 };
 268
 269 class NET_EXPORT_PRIVATE SSLClientSocketPool
 270     : public ClientSocketPool,
 271       public HigherLayeredPool,
 272       public SSLConfigService::Observer {
 273  public:
 274   typedef SSLSocketParams SocketParams;
 275
 276   // Only the pools that will be used are required. i.e. if you never
 277   // try to create an SSL over SOCKS socket, |socks_pool| may be NULL.
 278   SSLClientSocketPool(int max_sockets,
 279                       int max_sockets_per_group,
 280                       ClientSocketPoolHistograms* histograms,
 281                       CertVerifier* cert_verifier,
 282                       ChannelIDService* channel_id_service,
 283                       TransportSecurityState* transport_security_state,
 284                       CTVerifier* cert_transparency_verifier,
 285                       CertPolicyEnforcer* cert_policy_enforcer,
 286                       const std::string& ssl_session_cache_shard,
 287                       ClientSocketFactory* client_socket_factory,
 288                       TransportClientSocketPool* transport_pool,
 289                       SOCKSClientSocketPool* socks_pool,
 290                       HttpProxyClientSocketPool* http_proxy_pool,
 291                       SSLConfigService* ssl_config_service,
 292                       bool enable_ssl_connect_job_waiting,
 293                       NetLog* net_log);
 294
 295   ~SSLClientSocketPool() override;
 296
 297   // ClientSocketPool implementation.
 298   int RequestSocket(const std::string& group_name,
 299                     const void* connect_params,
 300                     RequestPriority priority,
 301                     ClientSocketHandle* handle,
 302                     const CompletionCallback& callback,
 303                     const BoundNetLog& net_log) override;
 304
 305   void RequestSockets(const std::string& group_name,
 306                       const void* params,
 307                       int num_sockets,
 308                       const BoundNetLog& net_log) override;
 309
 310   void CancelRequest(const std::string& group_name,
 311                      ClientSocketHandle* handle) override;
 312
 313   void ReleaseSocket(const std::string& group_name,
 314                      scoped_ptr<StreamSocket> socket,
 315                      int id) override;
 316
 317   void FlushWithError(int error) override;
 318
 319   void CloseIdleSockets() override;
 320
 321   int IdleSocketCount() const override;
 322
 323   int IdleSocketCountInGroup(const std::string& group_name) const override;
 324
 325   LoadState GetLoadState(const std::string& group_name,
 326                          const ClientSocketHandle* handle) const override;
 327
 328   base::DictionaryValue* GetInfoAsValue(
 329       const std::string& name,
 330       const std::string& type,
 331       bool include_nested_pools) const override;
 332
 333   base::TimeDelta ConnectionTimeout() const override;
 334
 335   ClientSocketPoolHistograms* histograms() const override;
 336
 337   // LowerLayeredPool implementation.
 338   bool IsStalled() const override;
 339
 340   void AddHigherLayeredPool(HigherLayeredPool* higher_pool) override;
 341
 342   void RemoveHigherLayeredPool(HigherLayeredPool* higher_pool) override;
 343
 344   // HigherLayeredPool implementation.
 345   bool CloseOneIdleConnection() override;
 346
 347   // Gets the SSLConnectJobMessenger for the given ssl session |cache_key|. If
 348   // none exits, it creates one and stores it in |messenger_map_|.
 349   SSLConnectJobMessenger* GetOrCreateSSLConnectJobMessenger(
 350       const std::string& cache_key);
 351   void DeleteSSLConnectJobMessenger(const std::string& cache_key);
 352
 353  private:
 354   typedef ClientSocketPoolBase<SSLSocketParams> PoolBase;
 355   // Maps SSLConnectJob cache keys to SSLConnectJobMessenger objects.
 356   typedef std::map<std::string, SSLConnectJobMessenger*> MessengerMap;
 357
 358   // SSLConfigService::Observer implementation.
 359
 360   // When the user changes the SSL config, we flush all idle sockets so they
 361   // won't get re-used.
 362   void OnSSLConfigChanged() override;
 363
 364   class SSLConnectJobFactory : public PoolBase::ConnectJobFactory {
 365    public:
 366     SSLConnectJobFactory(
 367         TransportClientSocketPool* transport_pool,
 368         SOCKSClientSocketPool* socks_pool,
 369         HttpProxyClientSocketPool* http_proxy_pool,
 370         ClientSocketFactory* client_socket_factory,
 371         const SSLClientSocketContext& context,
 372         const SSLConnectJob::GetMessengerCallback& get_messenger_callback,
 373         NetLog* net_log);
 374
 375     ~SSLConnectJobFactory() override;
 376
 377     // ClientSocketPoolBase::ConnectJobFactory methods.
 378     scoped_ptr<ConnectJob> NewConnectJob(
 379         const std::string& group_name,
 380         const PoolBase::Request& request,
 381         ConnectJob::Delegate* delegate) const override;
 382
 383     base::TimeDelta ConnectionTimeout() const override;
 384
 385    private:
 386     TransportClientSocketPool* const transport_pool_;
 387     SOCKSClientSocketPool* const socks_pool_;
 388     HttpProxyClientSocketPool* const http_proxy_pool_;
 389     ClientSocketFactory* const client_socket_factory_;
 390     const SSLClientSocketContext context_;
 391     base::TimeDelta timeout_;
 392     SSLConnectJob::GetMessengerCallback get_messenger_callback_;
 393     NetLog* net_log_;
 394
 395     DISALLOW_COPY_AND_ASSIGN(SSLConnectJobFactory);
 396   };
 397
 398   TransportClientSocketPool* const transport_pool_;
 399   SOCKSClientSocketPool* const socks_pool_;
 400   HttpProxyClientSocketPool* const http_proxy_pool_;
 401   PoolBase base_;
 402   const scoped_refptr<SSLConfigService> ssl_config_service_;
 403   MessengerMap messenger_map_;
 404   bool enable_ssl_connect_job_waiting_;
 405
 406   DISALLOW_COPY_AND_ASSIGN(SSLClientSocketPool);
 407 };
 408
 409 }  // namespace net
 410
 411 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_POOL_H_