net/socket/ssl_client_socket_openssl.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
   7
   8 #include <string>
   9
  10 #include "base/compiler_specific.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/memory/weak_ptr.h"
  13 #include "net/base/completion_callback.h"
  14 #include "net/base/io_buffer.h"
  15 #include "net/cert/cert_verify_result.h"
  16 #include "net/socket/client_socket_handle.h"
  17 #include "net/socket/ssl_client_socket.h"
  18 #include "net/ssl/channel_id_service.h"
  19 #include "net/ssl/ssl_client_cert_type.h"
  20 #include "net/ssl/ssl_config_service.h"
  21
  22 // Avoid including misc OpenSSL headers, i.e.:
  23 // <openssl/bio.h>
  24 typedef struct bio_st BIO;
  25 // <openssl/evp.h>
  26 typedef struct evp_pkey_st EVP_PKEY;
  27 // <openssl/ssl.h>
  28 typedef struct ssl_st SSL;
  29 // <openssl/x509.h>
  30 typedef struct x509_st X509;
  31 // <openssl/ossl_type.h>
  32 typedef struct x509_store_ctx_st X509_STORE_CTX;
  33
  34 namespace net {
  35
  36 class CertVerifier;
  37 class SingleRequestCertVerifier;
  38 class SSLCertRequestInfo;
  39 class SSLInfo;
  40
  41 // An SSL client socket implemented with OpenSSL.
  42 class SSLClientSocketOpenSSL : public SSLClientSocket {
  43  public:
  44   // Takes ownership of the transport_socket, which may already be connected.
  45   // The given hostname will be compared with the name(s) in the server's
  46   // certificate during the SSL handshake.  ssl_config specifies the SSL
  47   // settings.
  48   SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket,
  49                          const HostPortPair& host_and_port,
  50                          const SSLConfig& ssl_config,
  51                          const SSLClientSocketContext& context);
  52   virtual ~SSLClientSocketOpenSSL();
  53
  54   const HostPortPair& host_and_port() const { return host_and_port_; }
  55   const std::string& ssl_session_cache_shard() const {
  56     return ssl_session_cache_shard_;
  57   }
  58
  59   // SSLClientSocket implementation.
  60   virtual bool InSessionCache() const OVERRIDE;
  61   virtual void SetHandshakeCompletionCallback(
  62       const base::Closure& callback) OVERRIDE;
  63   virtual void GetSSLCertRequestInfo(
  64       SSLCertRequestInfo* cert_request_info) OVERRIDE;
  65   virtual NextProtoStatus GetNextProto(std::string* proto) OVERRIDE;
  66   virtual ChannelIDService* GetChannelIDService() const OVERRIDE;
  67
  68   // SSLSocket implementation.
  69   virtual int ExportKeyingMaterial(const base::StringPiece& label,
  70                                    bool has_context,
  71                                    const base::StringPiece& context,
  72                                    unsigned char* out,
  73                                    unsigned int outlen) OVERRIDE;
  74   virtual int GetTLSUniqueChannelBinding(std::string* out) OVERRIDE;
  75
  76   // StreamSocket implementation.
  77   virtual int Connect(const CompletionCallback& callback) OVERRIDE;
  78   virtual void Disconnect() OVERRIDE;
  79   virtual bool IsConnected() const OVERRIDE;
  80   virtual bool IsConnectedAndIdle() const OVERRIDE;
  81   virtual int GetPeerAddress(IPEndPoint* address) const OVERRIDE;
  82   virtual int GetLocalAddress(IPEndPoint* address) const OVERRIDE;
  83   virtual const BoundNetLog& NetLog() const OVERRIDE;
  84   virtual void SetSubresourceSpeculation() OVERRIDE;
  85   virtual void SetOmniboxSpeculation() OVERRIDE;
  86   virtual bool WasEverUsed() const OVERRIDE;
  87   virtual bool UsingTCPFastOpen() const OVERRIDE;
  88   virtual bool GetSSLInfo(SSLInfo* ssl_info) OVERRIDE;
  89
  90   // Socket implementation.
  91   virtual int Read(IOBuffer* buf, int buf_len,
  92                    const CompletionCallback& callback) OVERRIDE;
  93   virtual int Write(IOBuffer* buf, int buf_len,
  94                     const CompletionCallback& callback) OVERRIDE;
  95   virtual int SetReceiveBufferSize(int32 size) OVERRIDE;
  96   virtual int SetSendBufferSize(int32 size) OVERRIDE;
  97
  98  protected:
  99   // SSLClientSocket implementation.
 100   virtual scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
 101       const OVERRIDE;
 102
 103  private:
 104   class PeerCertificateChain;
 105   class SSLContext;
 106   friend class SSLClientSocket;
 107   friend class SSLContext;
 108
 109   int Init();
 110   void DoReadCallback(int result);
 111   void DoWriteCallback(int result);
 112
 113   // Compute a unique key string for the SSL session cache.
 114   std::string GetSessionCacheKey() const;
 115   void OnHandshakeCompletion();
 116
 117   bool DoTransportIO();
 118   int DoHandshake();
 119   int DoChannelIDLookup();
 120   int DoChannelIDLookupComplete(int result);
 121   int DoVerifyCert(int result);
 122   int DoVerifyCertComplete(int result);
 123   void DoConnectCallback(int result);
 124   X509Certificate* UpdateServerCert();
 125
 126   void OnHandshakeIOComplete(int result);
 127   void OnSendComplete(int result);
 128   void OnRecvComplete(int result);
 129
 130   int DoHandshakeLoop(int last_io_result);
 131   int DoReadLoop(int result);
 132   int DoWriteLoop(int result);
 133   int DoPayloadRead();
 134   int DoPayloadWrite();
 135
 136   int BufferSend();
 137   int BufferRecv();
 138   void BufferSendComplete(int result);
 139   void BufferRecvComplete(int result);
 140   void TransportWriteComplete(int result);
 141   int TransportReadComplete(int result);
 142
 143   // Callback from the SSL layer that indicates the remote server is requesting
 144   // a certificate for this client.
 145   int ClientCertRequestCallback(SSL* ssl, X509** x509, EVP_PKEY** pkey);
 146
 147   // CertVerifyCallback is called to verify the server's certificates. We do
 148   // verification after the handshake so this function only enforces that the
 149   // certificates don't change during renegotiation.
 150   int CertVerifyCallback(X509_STORE_CTX *store_ctx);
 151
 152   // Callback from the SSL layer to check which NPN protocol we are supporting
 153   int SelectNextProtoCallback(unsigned char** out, unsigned char* outlen,
 154                               const unsigned char* in, unsigned int inlen);
 155
 156   // Called during an operation on |transport_bio_|'s peer. Checks saved
 157   // transport error state and, if appropriate, returns an error through
 158   // OpenSSL's error system.
 159   long MaybeReplayTransportError(BIO *bio,
 160                                  int cmd,
 161                                  const char *argp, int argi, long argl,
 162                                  long retvalue);
 163
 164   // Callback from the SSL layer when an operation is performed on
 165   // |transport_bio_|'s peer.
 166   static long BIOCallback(BIO *bio,
 167                           int cmd,
 168                           const char *argp, int argi, long argl,
 169                           long retvalue);
 170
 171   bool transport_send_busy_;
 172   bool transport_recv_busy_;
 173
 174   scoped_refptr<DrainableIOBuffer> send_buffer_;
 175   scoped_refptr<IOBuffer> recv_buffer_;
 176
 177   CompletionCallback user_connect_callback_;
 178   CompletionCallback user_read_callback_;
 179   CompletionCallback user_write_callback_;
 180
 181   base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_;
 182
 183   // Used by Read function.
 184   scoped_refptr<IOBuffer> user_read_buf_;
 185   int user_read_buf_len_;
 186
 187   // Used by Write function.
 188   scoped_refptr<IOBuffer> user_write_buf_;
 189   int user_write_buf_len_;
 190
 191   // Used by DoPayloadRead() when attempting to fill the caller's buffer with
 192   // as much data as possible without blocking.
 193   // If DoPayloadRead() encounters an error after having read some data, stores
 194   // the result to return on the *next* call to DoPayloadRead().  A value > 0
 195   // indicates there is no pending result, otherwise 0 indicates EOF and < 0
 196   // indicates an error.
 197   int pending_read_error_;
 198
 199   // Used by TransportReadComplete() to signify an error reading from the
 200   // transport socket. A value of OK indicates the socket is still
 201   // readable. EOFs are mapped to ERR_CONNECTION_CLOSED.
 202   int transport_read_error_;
 203
 204   // Used by TransportWriteComplete() and TransportReadComplete() to signify an
 205   // error writing to the transport socket. A value of OK indicates no error.
 206   int transport_write_error_;
 207
 208   // Set when handshake finishes.
 209   scoped_ptr<PeerCertificateChain> server_cert_chain_;
 210   scoped_refptr<X509Certificate> server_cert_;
 211   CertVerifyResult server_cert_verify_result_;
 212   bool completed_handshake_;
 213
 214   // Set when Read() or Write() successfully reads or writes data to or from the
 215   // network.
 216   bool was_ever_used_;
 217
 218   // Stores client authentication information between ClientAuthHandler and
 219   // GetSSLCertRequestInfo calls.
 220   bool client_auth_cert_needed_;
 221   // List of DER-encoded X.509 DistinguishedName of certificate authorities
 222   // allowed by the server.
 223   std::vector<std::string> cert_authorities_;
 224   // List of SSLClientCertType values for client certificates allowed by the
 225   // server.
 226   std::vector<SSLClientCertType> cert_key_types_;
 227
 228   CertVerifier* const cert_verifier_;
 229   scoped_ptr<SingleRequestCertVerifier> verifier_;
 230
 231   // The service for retrieving Channel ID keys.  May be NULL.
 232   ChannelIDService* channel_id_service_;
 233
 234   // Callback that is invoked when the connection finishes.
 235   //
 236   // Note: this callback will be run in Disconnect(). It will not alter
 237   // any member variables of the SSLClientSocketOpenSSL.
 238   base::Closure handshake_completion_callback_;
 239
 240   // OpenSSL stuff
 241   SSL* ssl_;
 242   BIO* transport_bio_;
 243
 244   scoped_ptr<ClientSocketHandle> transport_;
 245   const HostPortPair host_and_port_;
 246   SSLConfig ssl_config_;
 247   // ssl_session_cache_shard_ is an opaque string that partitions the SSL
 248   // session cache. i.e. sessions created with one value will not attempt to
 249   // resume on the socket with a different value.
 250   const std::string ssl_session_cache_shard_;
 251
 252   // Used for session cache diagnostics.
 253   bool trying_cached_session_;
 254
 255   enum State {
 256     STATE_NONE,
 257     STATE_HANDSHAKE,
 258     STATE_CHANNEL_ID_LOOKUP,
 259     STATE_CHANNEL_ID_LOOKUP_COMPLETE,
 260     STATE_VERIFY_CERT,
 261     STATE_VERIFY_CERT_COMPLETE,
 262   };
 263   State next_handshake_state_;
 264   NextProtoStatus npn_status_;
 265   std::string npn_proto_;
 266   // Written by the |channel_id_service_|.
 267   std::string channel_id_private_key_;
 268   std::string channel_id_cert_;
 269   // True if channel ID extension was negotiated.
 270   bool channel_id_xtn_negotiated_;
 271   // The request handle for |channel_id_service_|.
 272   ChannelIDService::RequestHandle channel_id_request_handle_;
 273   BoundNetLog net_log_;
 274 };
 275
 276 }  // namespace net
 277
 278 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_