net/socket/ssl_client_socket.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
   7
   8 #include <string>
   9
  10 #include "net/base/completion_callback.h"
  11 #include "net/base/load_flags.h"
  12 #include "net/base/net_errors.h"
  13 #include "net/socket/ssl_socket.h"
  14 #include "net/socket/stream_socket.h"
  15
  16 namespace net {
  17
  18 class CertVerifier;
  19 class ServerBoundCertService;
  20 class SSLCertRequestInfo;
  21 struct SSLConfig;
  22 class SSLInfo;
  23 class TransportSecurityState;
  24
  25 // This struct groups together several fields which are used by various
  26 // classes related to SSLClientSocket.
  27 struct SSLClientSocketContext {
  28   SSLClientSocketContext()
  29       : cert_verifier(NULL),
  30         server_bound_cert_service(NULL),
  31         transport_security_state(NULL) {}
  32
  33   SSLClientSocketContext(CertVerifier* cert_verifier_arg,
  34                          ServerBoundCertService* server_bound_cert_service_arg,
  35                          TransportSecurityState* transport_security_state_arg,
  36                          const std::string& ssl_session_cache_shard_arg)
  37       : cert_verifier(cert_verifier_arg),
  38         server_bound_cert_service(server_bound_cert_service_arg),
  39         transport_security_state(transport_security_state_arg),
  40         ssl_session_cache_shard(ssl_session_cache_shard_arg) {}
  41
  42   CertVerifier* cert_verifier;
  43   ServerBoundCertService* server_bound_cert_service;
  44   TransportSecurityState* transport_security_state;
  45   // ssl_session_cache_shard is an opaque string that identifies a shard of the
  46   // SSL session cache. SSL sockets with the same ssl_session_cache_shard may
  47   // resume each other's SSL sessions but we'll never sessions between shards.
  48   const std::string ssl_session_cache_shard;
  49 };
  50
  51 // A client socket that uses SSL as the transport layer.
  52 //
  53 // NOTE: The SSL handshake occurs within the Connect method after a TCP
  54 // connection is established.  If a SSL error occurs during the handshake,
  55 // Connect will fail.
  56 //
  57 class NET_EXPORT SSLClientSocket : public SSLSocket {
  58  public:
  59   SSLClientSocket();
  60
  61   // Next Protocol Negotiation (NPN) allows a TLS client and server to come to
  62   // an agreement about the application level protocol to speak over a
  63   // connection.
  64   enum NextProtoStatus {
  65     // WARNING: These values are serialized to disk. Don't change them.
  66
  67     kNextProtoUnsupported = 0,  // The server doesn't support NPN.
  68     kNextProtoNegotiated = 1,   // We agreed on a protocol.
  69     kNextProtoNoOverlap = 2,    // No protocols in common. We requested
  70                                 // the first protocol in our list.
  71   };
  72
  73   // StreamSocket:
  74   virtual bool WasNpnNegotiated() const OVERRIDE;
  75   virtual NextProto GetNegotiatedProtocol() const OVERRIDE;
  76
  77   // Gets the SSL CertificateRequest info of the socket after Connect failed
  78   // with ERR_SSL_CLIENT_AUTH_CERT_NEEDED.
  79   virtual void GetSSLCertRequestInfo(
  80       SSLCertRequestInfo* cert_request_info) = 0;
  81
  82   // Get the application level protocol that we negotiated with the server.
  83   // *proto is set to the resulting protocol (n.b. that the string may have
  84   // embedded NULs).
  85   //   kNextProtoUnsupported: *proto is cleared.
  86   //   kNextProtoNegotiated:  *proto is set to the negotiated protocol.
  87   //   kNextProtoNoOverlap:   *proto is set to the first protocol in the
  88   //                          supported list.
  89   // *server_protos is set to the server advertised protocols.
  90   virtual NextProtoStatus GetNextProto(std::string* proto,
  91                                        std::string* server_protos) = 0;
  92
  93   static NextProto NextProtoFromString(const std::string& proto_string);
  94
  95   static const char* NextProtoToString(NextProto next_proto);
  96
  97   static const char* NextProtoStatusToString(const NextProtoStatus status);
  98
  99   // Can be used with the second argument(|server_protos|) of |GetNextProto| to
 100   // construct a comma separated string of server advertised protocols.
 101   static std::string ServerProtosToString(const std::string& server_protos);
 102
 103   static bool IgnoreCertError(int error, int load_flags);
 104
 105   // ClearSessionCache clears the SSL session cache, used to resume SSL
 106   // sessions.
 107   static void ClearSessionCache();
 108
 109   virtual bool set_was_npn_negotiated(bool negotiated);
 110
 111   virtual bool was_spdy_negotiated() const;
 112
 113   virtual bool set_was_spdy_negotiated(bool negotiated);
 114
 115   virtual void set_protocol_negotiated(NextProto protocol_negotiated);
 116
 117   // Returns the ServerBoundCertService used by this socket, or NULL if
 118   // server bound certificates are not supported.
 119   virtual ServerBoundCertService* GetServerBoundCertService() const = 0;
 120
 121   // Returns true if a channel ID was sent on this connection.
 122   // This may be useful for protocols, like SPDY, which allow the same
 123   // connection to be shared between multiple domains, each of which need
 124   // a channel ID.
 125   //
 126   // Public for ssl_client_socket_openssl_unittest.cc.
 127   virtual bool WasChannelIDSent() const;
 128
 129  protected:
 130   virtual void set_channel_id_sent(bool channel_id_sent);
 131
 132   // Records histograms for channel id support during full handshakes - resumed
 133   // handshakes are ignored.
 134   static void RecordChannelIDSupport(
 135       ServerBoundCertService* server_bound_cert_service,
 136       bool negotiated_channel_id,
 137       bool channel_id_enabled,
 138       bool supports_ecc);
 139
 140   // Returns whether TLS channel ID is enabled.
 141   static bool IsChannelIDEnabled(
 142       const SSLConfig& ssl_config,
 143       ServerBoundCertService* server_bound_cert_service);
 144
 145  private:
 146   // True if NPN was responded to, independent of selecting SPDY or HTTP.
 147   bool was_npn_negotiated_;
 148   // True if NPN successfully negotiated SPDY.
 149   bool was_spdy_negotiated_;
 150   // Protocol that we negotiated with the server.
 151   NextProto protocol_negotiated_;
 152   // True if a channel ID was sent.
 153   bool channel_id_sent_;
 154 };
 155
 156 }  // namespace net
 157
 158 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_