net/socket/ssl_client_socket.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/socket/ssl_client_socket.h"
   6
   7 #include "base/metrics/histogram.h"
   8 #include "base/strings/string_util.h"
   9 #include "crypto/ec_private_key.h"
  10 #include "net/ssl/server_bound_cert_service.h"
  11 #include "net/ssl/ssl_config_service.h"
  12
  13 namespace net {
  14
  15 SSLClientSocket::SSLClientSocket()
  16     : was_npn_negotiated_(false),
  17       was_spdy_negotiated_(false),
  18       protocol_negotiated_(kProtoUnknown),
  19       channel_id_sent_(false) {
  20 }
  21
  22 // static
  23 NextProto SSLClientSocket::NextProtoFromString(
  24     const std::string& proto_string) {
  25   if (proto_string == "http1.1" || proto_string == "http/1.1") {
  26     return kProtoHTTP11;
  27   } else if (proto_string == "spdy/2") {
  28     return kProtoDeprecatedSPDY2;
  29   } else if (proto_string == "spdy/3") {
  30     return kProtoSPDY3;
  31   } else if (proto_string == "spdy/3.1") {
  32     return kProtoSPDY31;
  33   } else if (proto_string == "spdy/4a2") {
  34     return kProtoSPDY4a2;
  35   } else if (proto_string == "HTTP-draft-04/2.0") {
  36     return kProtoHTTP2Draft04;
  37   } else if (proto_string == "quic/1+spdy/3") {
  38     return kProtoQUIC1SPDY3;
  39   } else {
  40     return kProtoUnknown;
  41   }
  42 }
  43
  44 // static
  45 const char* SSLClientSocket::NextProtoToString(NextProto next_proto) {
  46   switch (next_proto) {
  47     case kProtoHTTP11:
  48       return "http/1.1";
  49     case kProtoDeprecatedSPDY2:
  50       return "spdy/2";
  51     case kProtoSPDY3:
  52       return "spdy/3";
  53     case kProtoSPDY31:
  54       return "spdy/3.1";
  55     case kProtoSPDY4a2:
  56       return "spdy/4a2";
  57     case kProtoHTTP2Draft04:
  58       return "HTTP-draft-04/2.0";
  59     case kProtoQUIC1SPDY3:
  60       return "quic/1+spdy/3";
  61     case kProtoUnknown:
  62       break;
  63   }
  64   return "unknown";
  65 }
  66
  67 // static
  68 const char* SSLClientSocket::NextProtoStatusToString(
  69     const SSLClientSocket::NextProtoStatus status) {
  70   switch (status) {
  71     case kNextProtoUnsupported:
  72       return "unsupported";
  73     case kNextProtoNegotiated:
  74       return "negotiated";
  75     case kNextProtoNoOverlap:
  76       return "no-overlap";
  77   }
  78   return NULL;
  79 }
  80
  81 // static
  82 std::string SSLClientSocket::ServerProtosToString(
  83     const std::string& server_protos) {
  84   const char* protos = server_protos.c_str();
  85   size_t protos_len = server_protos.length();
  86   std::vector<std::string> server_protos_with_commas;
  87   for (size_t i = 0; i < protos_len; ) {
  88     const size_t len = protos[i];
  89     std::string proto_str(&protos[i + 1], len);
  90     server_protos_with_commas.push_back(proto_str);
  91     i += len + 1;
  92   }
  93   return JoinString(server_protos_with_commas, ',');
  94 }
  95
  96 bool SSLClientSocket::WasNpnNegotiated() const {
  97   return was_npn_negotiated_;
  98 }
  99
 100 NextProto SSLClientSocket::GetNegotiatedProtocol() const {
 101   return protocol_negotiated_;
 102 }
 103
 104 bool SSLClientSocket::IgnoreCertError(int error, int load_flags) {
 105   if (error == OK || load_flags & LOAD_IGNORE_ALL_CERT_ERRORS)
 106     return true;
 107
 108   if (error == ERR_CERT_COMMON_NAME_INVALID &&
 109       (load_flags & LOAD_IGNORE_CERT_COMMON_NAME_INVALID))
 110     return true;
 111
 112   if (error == ERR_CERT_DATE_INVALID &&
 113       (load_flags & LOAD_IGNORE_CERT_DATE_INVALID))
 114     return true;
 115
 116   if (error == ERR_CERT_AUTHORITY_INVALID &&
 117       (load_flags & LOAD_IGNORE_CERT_AUTHORITY_INVALID))
 118     return true;
 119
 120   return false;
 121 }
 122
 123 bool SSLClientSocket::set_was_npn_negotiated(bool negotiated) {
 124   return was_npn_negotiated_ = negotiated;
 125 }
 126
 127 bool SSLClientSocket::was_spdy_negotiated() const {
 128   return was_spdy_negotiated_;
 129 }
 130
 131 bool SSLClientSocket::set_was_spdy_negotiated(bool negotiated) {
 132   return was_spdy_negotiated_ = negotiated;
 133 }
 134
 135 void SSLClientSocket::set_protocol_negotiated(NextProto protocol_negotiated) {
 136   protocol_negotiated_ = protocol_negotiated;
 137 }
 138
 139 bool SSLClientSocket::WasChannelIDSent() const {
 140   return channel_id_sent_;
 141 }
 142
 143 void SSLClientSocket::set_channel_id_sent(bool channel_id_sent) {
 144   channel_id_sent_ = channel_id_sent;
 145 }
 146
 147 // static
 148 void SSLClientSocket::RecordChannelIDSupport(
 149     ServerBoundCertService* server_bound_cert_service,
 150     bool negotiated_channel_id,
 151     bool channel_id_enabled,
 152     bool supports_ecc) {
 153   // Since this enum is used for a histogram, do not change or re-use values.
 154   enum {
 155     DISABLED = 0,
 156     CLIENT_ONLY = 1,
 157     CLIENT_AND_SERVER = 2,
 158     CLIENT_NO_ECC = 3,
 159     CLIENT_BAD_SYSTEM_TIME = 4,
 160     CLIENT_NO_SERVER_BOUND_CERT_SERVICE = 5,
 161     DOMAIN_BOUND_CERT_USAGE_MAX
 162   } supported = DISABLED;
 163   if (negotiated_channel_id) {
 164     supported = CLIENT_AND_SERVER;
 165   } else if (channel_id_enabled) {
 166     if (!server_bound_cert_service)
 167       supported = CLIENT_NO_SERVER_BOUND_CERT_SERVICE;
 168     else if (!supports_ecc)
 169       supported = CLIENT_NO_ECC;
 170     else if (!server_bound_cert_service->IsSystemTimeValid())
 171       supported = CLIENT_BAD_SYSTEM_TIME;
 172     else
 173       supported = CLIENT_ONLY;
 174   }
 175   UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.Support", supported,
 176                             DOMAIN_BOUND_CERT_USAGE_MAX);
 177 }
 178
 179 // static
 180 bool SSLClientSocket::IsChannelIDEnabled(
 181     const SSLConfig& ssl_config,
 182     ServerBoundCertService* server_bound_cert_service) {
 183   if (!ssl_config.channel_id_enabled)
 184     return false;
 185   if (!server_bound_cert_service) {
 186     DVLOG(1) << "NULL server_bound_cert_service_, not enabling channel ID.";
 187     return false;
 188   }
 189   if (!crypto::ECPrivateKey::IsSupported()) {
 190     DVLOG(1) << "Elliptic Curve not supported, not enabling channel ID.";
 191     return false;
 192   }
 193   if (!server_bound_cert_service->IsSystemTimeValid()) {
 194     DVLOG(1) << "System time is not within the supported range for certificate "
 195                 "generation, not enabling channel ID.";
 196     return false;
 197   }
 198   return true;
 199 }
 200
 201 }  // namespace net