net/socket/ssl_client_socket_pool.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/socket/ssl_client_socket_pool.h"
   6
   7 #include "base/bind.h"
   8 #include "base/bind_helpers.h"
   9 #include "base/metrics/field_trial.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/metrics/sparse_histogram.h"
  12 #include "base/stl_util.h"
  13 #include "base/values.h"
  14 #include "net/base/host_port_pair.h"
  15 #include "net/base/net_errors.h"
  16 #include "net/http/http_proxy_client_socket.h"
  17 #include "net/http/http_proxy_client_socket_pool.h"
  18 #include "net/socket/client_socket_factory.h"
  19 #include "net/socket/client_socket_handle.h"
  20 #include "net/socket/socks_client_socket_pool.h"
  21 #include "net/socket/ssl_client_socket.h"
  22 #include "net/socket/transport_client_socket_pool.h"
  23 #include "net/ssl/ssl_cert_request_info.h"
  24 #include "net/ssl/ssl_connection_status_flags.h"
  25 #include "net/ssl/ssl_info.h"
  26
  27 namespace net {
  28
  29 SSLSocketParams::SSLSocketParams(
  30     const scoped_refptr<TransportSocketParams>& direct_params,
  31     const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
  32     const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
  33     const HostPortPair& host_and_port,
  34     const SSLConfig& ssl_config,
  35     PrivacyMode privacy_mode,
  36     int load_flags,
  37     bool force_spdy_over_ssl,
  38     bool want_spdy_over_npn)
  39     : direct_params_(direct_params),
  40       socks_proxy_params_(socks_proxy_params),
  41       http_proxy_params_(http_proxy_params),
  42       host_and_port_(host_and_port),
  43       ssl_config_(ssl_config),
  44       privacy_mode_(privacy_mode),
  45       load_flags_(load_flags),
  46       force_spdy_over_ssl_(force_spdy_over_ssl),
  47       want_spdy_over_npn_(want_spdy_over_npn),
  48       ignore_limits_(false) {
  49   if (direct_params_) {
  50     DCHECK(!socks_proxy_params_);
  51     DCHECK(!http_proxy_params_);
  52     ignore_limits_ = direct_params_->ignore_limits();
  53   } else if (socks_proxy_params_) {
  54     DCHECK(!http_proxy_params_);
  55     ignore_limits_ = socks_proxy_params_->ignore_limits();
  56   } else {
  57     DCHECK(http_proxy_params_);
  58     ignore_limits_ = http_proxy_params_->ignore_limits();
  59   }
  60 }
  61
  62 SSLSocketParams::~SSLSocketParams() {}
  63
  64 SSLSocketParams::ConnectionType SSLSocketParams::GetConnectionType() const {
  65   if (direct_params_) {
  66     DCHECK(!socks_proxy_params_);
  67     DCHECK(!http_proxy_params_);
  68     return DIRECT;
  69   }
  70
  71   if (socks_proxy_params_) {
  72     DCHECK(!http_proxy_params_);
  73     return SOCKS_PROXY;
  74   }
  75
  76   DCHECK(http_proxy_params_);
  77   return HTTP_PROXY;
  78 }
  79
  80 const scoped_refptr<TransportSocketParams>&
  81 SSLSocketParams::GetDirectConnectionParams() const {
  82   DCHECK_EQ(GetConnectionType(), DIRECT);
  83   return direct_params_;
  84 }
  85
  86 const scoped_refptr<SOCKSSocketParams>&
  87 SSLSocketParams::GetSocksProxyConnectionParams() const {
  88   DCHECK_EQ(GetConnectionType(), SOCKS_PROXY);
  89   return socks_proxy_params_;
  90 }
  91
  92 const scoped_refptr<HttpProxySocketParams>&
  93 SSLSocketParams::GetHttpProxyConnectionParams() const {
  94   DCHECK_EQ(GetConnectionType(), HTTP_PROXY);
  95   return http_proxy_params_;
  96 }
  97
  98 SSLConnectJobMessenger::SocketAndCallback::SocketAndCallback(
  99     SSLClientSocket* ssl_socket,
 100     const base::Closure& job_resumption_callback)
 101     : socket(ssl_socket), callback(job_resumption_callback) {
 102 }
 103
 104 SSLConnectJobMessenger::SocketAndCallback::~SocketAndCallback() {
 105 }
 106
 107 SSLConnectJobMessenger::SSLConnectJobMessenger() : weak_factory_(this) {
 108 }
 109
 110 SSLConnectJobMessenger::~SSLConnectJobMessenger() {
 111 }
 112
 113 void SSLConnectJobMessenger::RemovePendingSocket(SSLClientSocket* ssl_socket) {
 114   // Sockets do not need to be removed from connecting_sockets_ because
 115   // OnSSLHandshakeCompleted will do this.
 116   for (SSLPendingSocketsAndCallbacks::iterator it =
 117            pending_sockets_and_callbacks_.begin();
 118        it != pending_sockets_and_callbacks_.end();
 119        ++it) {
 120     if (it->socket == ssl_socket) {
 121       pending_sockets_and_callbacks_.erase(it);
 122       return;
 123     }
 124   }
 125 }
 126
 127 bool SSLConnectJobMessenger::CanProceed(SSLClientSocket* ssl_socket) {
 128   // If the session is in the session cache, or there are no connecting
 129   // sockets, allow the connection to proceed.
 130   return ssl_socket->InSessionCache() || connecting_sockets_.empty();
 131 }
 132
 133 void SSLConnectJobMessenger::MonitorConnectionResult(
 134     SSLClientSocket* ssl_socket) {
 135   connecting_sockets_.push_back(ssl_socket);
 136   ssl_socket->SetHandshakeCompletionCallback(
 137       base::Bind(&SSLConnectJobMessenger::OnSSLHandshakeCompleted,
 138                  weak_factory_.GetWeakPtr()));
 139 }
 140
 141 void SSLConnectJobMessenger::AddPendingSocket(SSLClientSocket* ssl_socket,
 142                                               const base::Closure& callback) {
 143   DCHECK(!connecting_sockets_.empty());
 144   pending_sockets_and_callbacks_.push_back(
 145       SocketAndCallback(ssl_socket, callback));
 146 }
 147
 148 void SSLConnectJobMessenger::OnSSLHandshakeCompleted() {
 149   connecting_sockets_.clear();
 150   SSLPendingSocketsAndCallbacks temp_list;
 151   temp_list.swap(pending_sockets_and_callbacks_);
 152   RunAllCallbacks(temp_list);
 153 }
 154
 155 void SSLConnectJobMessenger::RunAllCallbacks(
 156     const SSLPendingSocketsAndCallbacks& pending_sockets_and_callbacks) {
 157   for (std::vector<SocketAndCallback>::const_iterator it =
 158            pending_sockets_and_callbacks.begin();
 159        it != pending_sockets_and_callbacks.end();
 160        ++it) {
 161     it->callback.Run();
 162   }
 163 }
 164
 165 // Timeout for the SSL handshake portion of the connect.
 166 static const int kSSLHandshakeTimeoutInSeconds = 30;
 167
 168 SSLConnectJob::SSLConnectJob(const std::string& group_name,
 169                              RequestPriority priority,
 170                              const scoped_refptr<SSLSocketParams>& params,
 171                              const base::TimeDelta& timeout_duration,
 172                              TransportClientSocketPool* transport_pool,
 173                              SOCKSClientSocketPool* socks_pool,
 174                              HttpProxyClientSocketPool* http_proxy_pool,
 175                              ClientSocketFactory* client_socket_factory,
 176                              HostResolver* host_resolver,
 177                              const SSLClientSocketContext& context,
 178                              SSLConnectJobMessenger* messenger,
 179                              Delegate* delegate,
 180                              NetLog* net_log)
 181     : ConnectJob(group_name,
 182                  timeout_duration,
 183                  priority,
 184                  delegate,
 185                  BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
 186       params_(params),
 187       transport_pool_(transport_pool),
 188       socks_pool_(socks_pool),
 189       http_proxy_pool_(http_proxy_pool),
 190       client_socket_factory_(client_socket_factory),
 191       host_resolver_(host_resolver),
 192       context_(context.cert_verifier,
 193                context.channel_id_service,
 194                context.transport_security_state,
 195                context.cert_transparency_verifier,
 196                (params->privacy_mode() == PRIVACY_MODE_ENABLED
 197                     ? "pm/" + context.ssl_session_cache_shard
 198                     : context.ssl_session_cache_shard)),
 199       io_callback_(
 200           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
 201       messenger_(messenger),
 202       weak_factory_(this) {
 203 }
 204
 205 SSLConnectJob::~SSLConnectJob() {
 206   if (ssl_socket_.get() && messenger_)
 207     messenger_->RemovePendingSocket(ssl_socket_.get());
 208 }
 209
 210 LoadState SSLConnectJob::GetLoadState() const {
 211   switch (next_state_) {
 212     case STATE_TUNNEL_CONNECT_COMPLETE:
 213       if (transport_socket_handle_->socket())
 214         return LOAD_STATE_ESTABLISHING_PROXY_TUNNEL;
 215       // else, fall through.
 216     case STATE_TRANSPORT_CONNECT:
 217     case STATE_TRANSPORT_CONNECT_COMPLETE:
 218     case STATE_SOCKS_CONNECT:
 219     case STATE_SOCKS_CONNECT_COMPLETE:
 220     case STATE_TUNNEL_CONNECT:
 221       return transport_socket_handle_->GetLoadState();
 222     case STATE_CREATE_SSL_SOCKET:
 223     case STATE_CHECK_FOR_RESUME:
 224     case STATE_SSL_CONNECT:
 225     case STATE_SSL_CONNECT_COMPLETE:
 226       return LOAD_STATE_SSL_HANDSHAKE;
 227     default:
 228       NOTREACHED();
 229       return LOAD_STATE_IDLE;
 230   }
 231 }
 232
 233 void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle* handle) {
 234   // Headers in |error_response_info_| indicate a proxy tunnel setup
 235   // problem. See DoTunnelConnectComplete.
 236   if (error_response_info_.headers.get()) {
 237     handle->set_pending_http_proxy_connection(
 238         transport_socket_handle_.release());
 239   }
 240   handle->set_ssl_error_response_info(error_response_info_);
 241   if (!connect_timing_.ssl_start.is_null())
 242     handle->set_is_ssl_error(true);
 243 }
 244
 245 void SSLConnectJob::OnIOComplete(int result) {
 246   int rv = DoLoop(result);
 247   if (rv != ERR_IO_PENDING)
 248     NotifyDelegateOfCompletion(rv);  // Deletes |this|.
 249 }
 250
 251 int SSLConnectJob::DoLoop(int result) {
 252   DCHECK_NE(next_state_, STATE_NONE);
 253
 254   int rv = result;
 255   do {
 256     State state = next_state_;
 257     next_state_ = STATE_NONE;
 258     switch (state) {
 259       case STATE_TRANSPORT_CONNECT:
 260         DCHECK_EQ(OK, rv);
 261         rv = DoTransportConnect();
 262         break;
 263       case STATE_TRANSPORT_CONNECT_COMPLETE:
 264         rv = DoTransportConnectComplete(rv);
 265         break;
 266       case STATE_SOCKS_CONNECT:
 267         DCHECK_EQ(OK, rv);
 268         rv = DoSOCKSConnect();
 269         break;
 270       case STATE_SOCKS_CONNECT_COMPLETE:
 271         rv = DoSOCKSConnectComplete(rv);
 272         break;
 273       case STATE_TUNNEL_CONNECT:
 274         DCHECK_EQ(OK, rv);
 275         rv = DoTunnelConnect();
 276         break;
 277       case STATE_TUNNEL_CONNECT_COMPLETE:
 278         rv = DoTunnelConnectComplete(rv);
 279         break;
 280       case STATE_CREATE_SSL_SOCKET:
 281         rv = DoCreateSSLSocket();
 282         break;
 283       case STATE_CHECK_FOR_RESUME:
 284         rv = DoCheckForResume();
 285         break;
 286       case STATE_SSL_CONNECT:
 287         DCHECK_EQ(OK, rv);
 288         rv = DoSSLConnect();
 289         break;
 290       case STATE_SSL_CONNECT_COMPLETE:
 291         rv = DoSSLConnectComplete(rv);
 292         break;
 293       default:
 294         NOTREACHED() << "bad state";
 295         rv = ERR_FAILED;
 296         break;
 297     }
 298   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 299
 300   return rv;
 301 }
 302
 303 int SSLConnectJob::DoTransportConnect() {
 304   DCHECK(transport_pool_);
 305
 306   next_state_ = STATE_TRANSPORT_CONNECT_COMPLETE;
 307   transport_socket_handle_.reset(new ClientSocketHandle());
 308   scoped_refptr<TransportSocketParams> direct_params =
 309       params_->GetDirectConnectionParams();
 310   return transport_socket_handle_->Init(group_name(),
 311                                         direct_params,
 312                                         priority(),
 313                                         io_callback_,
 314                                         transport_pool_,
 315                                         net_log());
 316 }
 317
 318 int SSLConnectJob::DoTransportConnectComplete(int result) {
 319   if (result == OK)
 320     next_state_ = STATE_CREATE_SSL_SOCKET;
 321
 322   return result;
 323 }
 324
 325 int SSLConnectJob::DoSOCKSConnect() {
 326   DCHECK(socks_pool_);
 327   next_state_ = STATE_SOCKS_CONNECT_COMPLETE;
 328   transport_socket_handle_.reset(new ClientSocketHandle());
 329   scoped_refptr<SOCKSSocketParams> socks_proxy_params =
 330       params_->GetSocksProxyConnectionParams();
 331   return transport_socket_handle_->Init(group_name(),
 332                                         socks_proxy_params,
 333                                         priority(),
 334                                         io_callback_,
 335                                         socks_pool_,
 336                                         net_log());
 337 }
 338
 339 int SSLConnectJob::DoSOCKSConnectComplete(int result) {
 340   if (result == OK)
 341     next_state_ = STATE_CREATE_SSL_SOCKET;
 342
 343   return result;
 344 }
 345
 346 int SSLConnectJob::DoTunnelConnect() {
 347   DCHECK(http_proxy_pool_);
 348   next_state_ = STATE_TUNNEL_CONNECT_COMPLETE;
 349
 350   transport_socket_handle_.reset(new ClientSocketHandle());
 351   scoped_refptr<HttpProxySocketParams> http_proxy_params =
 352       params_->GetHttpProxyConnectionParams();
 353   return transport_socket_handle_->Init(group_name(),
 354                                         http_proxy_params,
 355                                         priority(),
 356                                         io_callback_,
 357                                         http_proxy_pool_,
 358                                         net_log());
 359 }
 360
 361 int SSLConnectJob::DoTunnelConnectComplete(int result) {
 362   // Extract the information needed to prompt for appropriate proxy
 363   // authentication so that when ClientSocketPoolBaseHelper calls
 364   // |GetAdditionalErrorState|, we can easily set the state.
 365   if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 366     error_response_info_ = transport_socket_handle_->ssl_error_response_info();
 367   } else if (result == ERR_PROXY_AUTH_REQUESTED ||
 368              result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
 369     StreamSocket* socket = transport_socket_handle_->socket();
 370     HttpProxyClientSocket* tunnel_socket =
 371         static_cast<HttpProxyClientSocket*>(socket);
 372     error_response_info_ = *tunnel_socket->GetConnectResponseInfo();
 373   }
 374   if (result < 0)
 375     return result;
 376   next_state_ = STATE_CREATE_SSL_SOCKET;
 377   return result;
 378 }
 379
 380 int SSLConnectJob::DoCreateSSLSocket() {
 381   next_state_ = STATE_CHECK_FOR_RESUME;
 382
 383   // Reset the timeout to just the time allowed for the SSL handshake.
 384   ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
 385
 386   // If the handle has a fresh socket, get its connect start and DNS times.
 387   // This should always be the case.
 388   const LoadTimingInfo::ConnectTiming& socket_connect_timing =
 389       transport_socket_handle_->connect_timing();
 390   if (!transport_socket_handle_->is_reused() &&
 391       !socket_connect_timing.connect_start.is_null()) {
 392     // Overwriting |connect_start| serves two purposes - it adjusts timing so
 393     // |connect_start| doesn't include dns times, and it adjusts the time so
 394     // as not to include time spent waiting for an idle socket.
 395     connect_timing_.connect_start = socket_connect_timing.connect_start;
 396     connect_timing_.dns_start = socket_connect_timing.dns_start;
 397     connect_timing_.dns_end = socket_connect_timing.dns_end;
 398   }
 399
 400   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
 401       transport_socket_handle_.Pass(),
 402       params_->host_and_port(),
 403       params_->ssl_config(),
 404       context_);
 405   return OK;
 406 }
 407
 408 int SSLConnectJob::DoCheckForResume() {
 409   next_state_ = STATE_SSL_CONNECT;
 410   if (!messenger_)
 411     return OK;
 412
 413   // TODO(mshelley): Remove duplicate InSessionCache() calls.
 414   if (messenger_->CanProceed(ssl_socket_.get())) {
 415     if (!ssl_socket_->InSessionCache())
 416       messenger_->MonitorConnectionResult(ssl_socket_.get());
 417     return OK;
 418   }
 419   messenger_->AddPendingSocket(ssl_socket_.get(),
 420                                base::Bind(&SSLConnectJob::ResumeSSLConnection,
 421                                           weak_factory_.GetWeakPtr()));
 422   return ERR_IO_PENDING;
 423 }
 424
 425 int SSLConnectJob::DoSSLConnect() {
 426   next_state_ = STATE_SSL_CONNECT_COMPLETE;
 427
 428   connect_timing_.ssl_start = base::TimeTicks::Now();
 429
 430   return ssl_socket_->Connect(io_callback_);
 431 }
 432
 433 int SSLConnectJob::DoSSLConnectComplete(int result) {
 434   connect_timing_.ssl_end = base::TimeTicks::Now();
 435
 436   SSLClientSocket::NextProtoStatus status =
 437       SSLClientSocket::kNextProtoUnsupported;
 438   std::string proto;
 439   // GetNextProto will fail and and trigger a NOTREACHED if we pass in a socket
 440   // that hasn't had SSL_ImportFD called on it. If we get a certificate error
 441   // here, then we know that we called SSL_ImportFD.
 442   if (result == OK || IsCertificateError(result))
 443     status = ssl_socket_->GetNextProto(&proto);
 444
 445   // If we want spdy over npn, make sure it succeeded.
 446   if (status == SSLClientSocket::kNextProtoNegotiated) {
 447     ssl_socket_->set_was_npn_negotiated(true);
 448     NextProto protocol_negotiated =
 449         SSLClientSocket::NextProtoFromString(proto);
 450     ssl_socket_->set_protocol_negotiated(protocol_negotiated);
 451     // If we negotiated a SPDY version, it must have been present in
 452     // SSLConfig::next_protos.
 453     // TODO(mbelshe): Verify this.
 454     if (protocol_negotiated >= kProtoSPDYMinimumVersion &&
 455         protocol_negotiated <= kProtoSPDYMaximumVersion) {
 456       ssl_socket_->set_was_spdy_negotiated(true);
 457     }
 458   }
 459   if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated())
 460     return ERR_NPN_NEGOTIATION_FAILED;
 461
 462   // Spdy might be turned on by default, or it might be over npn.
 463   bool using_spdy = params_->force_spdy_over_ssl() ||
 464       params_->want_spdy_over_npn();
 465
 466   if (result == OK ||
 467       ssl_socket_->IgnoreCertError(result, params_->load_flags())) {
 468     DCHECK(!connect_timing_.ssl_start.is_null());
 469     base::TimeDelta connect_duration =
 470         connect_timing_.ssl_end - connect_timing_.ssl_start;
 471     if (using_spdy) {
 472       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency_2",
 473                                  connect_duration,
 474                                  base::TimeDelta::FromMilliseconds(1),
 475                                  base::TimeDelta::FromMinutes(1),
 476                                  100);
 477     }
 478 #if defined(SPDY_PROXY_AUTH_ORIGIN)
 479     bool using_data_reduction_proxy = params_->host_and_port().Equals(
 480         HostPortPair::FromURL(GURL(SPDY_PROXY_AUTH_ORIGIN)));
 481     if (using_data_reduction_proxy) {
 482       UMA_HISTOGRAM_CUSTOM_TIMES(
 483           "Net.SSL_Connection_Latency_DataReductionProxy",
 484           connect_duration,
 485           base::TimeDelta::FromMilliseconds(1),
 486           base::TimeDelta::FromMinutes(1),
 487           100);
 488     }
 489 #endif
 490
 491     UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_2",
 492                                connect_duration,
 493                                base::TimeDelta::FromMilliseconds(1),
 494                                base::TimeDelta::FromMinutes(1),
 495                                100);
 496
 497     SSLInfo ssl_info;
 498     ssl_socket_->GetSSLInfo(&ssl_info);
 499
 500     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite",
 501                                 SSLConnectionStatusToCipherSuite(
 502                                     ssl_info.connection_status));
 503
 504     if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 505       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Resume_Handshake",
 506                                  connect_duration,
 507                                  base::TimeDelta::FromMilliseconds(1),
 508                                  base::TimeDelta::FromMinutes(1),
 509                                  100);
 510     } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 511       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Full_Handshake",
 512                                  connect_duration,
 513                                  base::TimeDelta::FromMilliseconds(1),
 514                                  base::TimeDelta::FromMinutes(1),
 515                                  100);
 516     }
 517
 518     const std::string& host = params_->host_and_port().host();
 519     bool is_google =
 520         host == "google.com" ||
 521         (host.size() > 11 && host.rfind(".google.com") == host.size() - 11);
 522     if (is_google) {
 523       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google2",
 524                                  connect_duration,
 525                                  base::TimeDelta::FromMilliseconds(1),
 526                                  base::TimeDelta::FromMinutes(1),
 527                                  100);
 528       if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 529         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 530                                        "Resume_Handshake",
 531                                    connect_duration,
 532                                    base::TimeDelta::FromMilliseconds(1),
 533                                    base::TimeDelta::FromMinutes(1),
 534                                    100);
 535       } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 536         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 537                                        "Full_Handshake",
 538                                    connect_duration,
 539                                    base::TimeDelta::FromMilliseconds(1),
 540                                    base::TimeDelta::FromMinutes(1),
 541                                    100);
 542       }
 543     }
 544   }
 545
 546   if (result == OK || IsCertificateError(result)) {
 547     SetSocket(ssl_socket_.PassAs<StreamSocket>());
 548   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 549     error_response_info_.cert_request_info = new SSLCertRequestInfo;
 550     ssl_socket_->GetSSLCertRequestInfo(
 551         error_response_info_.cert_request_info.get());
 552   }
 553
 554   return result;
 555 }
 556
 557 void SSLConnectJob::ResumeSSLConnection() {
 558   DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
 559   OnIOComplete(OK);
 560 }
 561
 562 SSLConnectJob::State SSLConnectJob::GetInitialState(
 563     SSLSocketParams::ConnectionType connection_type) {
 564   switch (connection_type) {
 565     case SSLSocketParams::DIRECT:
 566       return STATE_TRANSPORT_CONNECT;
 567     case SSLSocketParams::HTTP_PROXY:
 568       return STATE_TUNNEL_CONNECT;
 569     case SSLSocketParams::SOCKS_PROXY:
 570       return STATE_SOCKS_CONNECT;
 571   }
 572   NOTREACHED();
 573   return STATE_NONE;
 574 }
 575
 576 int SSLConnectJob::ConnectInternal() {
 577   next_state_ = GetInitialState(params_->GetConnectionType());
 578   return DoLoop(OK);
 579 }
 580
 581 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
 582     TransportClientSocketPool* transport_pool,
 583     SOCKSClientSocketPool* socks_pool,
 584     HttpProxyClientSocketPool* http_proxy_pool,
 585     ClientSocketFactory* client_socket_factory,
 586     HostResolver* host_resolver,
 587     const SSLClientSocketContext& context,
 588     bool enable_ssl_connect_job_waiting,
 589     NetLog* net_log)
 590     : transport_pool_(transport_pool),
 591       socks_pool_(socks_pool),
 592       http_proxy_pool_(http_proxy_pool),
 593       client_socket_factory_(client_socket_factory),
 594       host_resolver_(host_resolver),
 595       context_(context),
 596       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting),
 597       net_log_(net_log),
 598       messenger_map_(new MessengerMap) {
 599   base::TimeDelta max_transport_timeout = base::TimeDelta();
 600   base::TimeDelta pool_timeout;
 601   if (transport_pool_)
 602     max_transport_timeout = transport_pool_->ConnectionTimeout();
 603   if (socks_pool_) {
 604     pool_timeout = socks_pool_->ConnectionTimeout();
 605     if (pool_timeout > max_transport_timeout)
 606       max_transport_timeout = pool_timeout;
 607   }
 608   if (http_proxy_pool_) {
 609     pool_timeout = http_proxy_pool_->ConnectionTimeout();
 610     if (pool_timeout > max_transport_timeout)
 611       max_transport_timeout = pool_timeout;
 612   }
 613   timeout_ = max_transport_timeout +
 614       base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds);
 615 }
 616
 617 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
 618   STLDeleteValues(messenger_map_.get());
 619 }
 620
 621 SSLClientSocketPool::SSLClientSocketPool(
 622     int max_sockets,
 623     int max_sockets_per_group,
 624     ClientSocketPoolHistograms* histograms,
 625     HostResolver* host_resolver,
 626     CertVerifier* cert_verifier,
 627     ChannelIDService* channel_id_service,
 628     TransportSecurityState* transport_security_state,
 629     CTVerifier* cert_transparency_verifier,
 630     const std::string& ssl_session_cache_shard,
 631     ClientSocketFactory* client_socket_factory,
 632     TransportClientSocketPool* transport_pool,
 633     SOCKSClientSocketPool* socks_pool,
 634     HttpProxyClientSocketPool* http_proxy_pool,
 635     SSLConfigService* ssl_config_service,
 636     bool enable_ssl_connect_job_waiting,
 637     NetLog* net_log)
 638     : transport_pool_(transport_pool),
 639       socks_pool_(socks_pool),
 640       http_proxy_pool_(http_proxy_pool),
 641       base_(this,
 642             max_sockets,
 643             max_sockets_per_group,
 644             histograms,
 645             ClientSocketPool::unused_idle_socket_timeout(),
 646             ClientSocketPool::used_idle_socket_timeout(),
 647             new SSLConnectJobFactory(
 648                 transport_pool,
 649                 socks_pool,
 650                 http_proxy_pool,
 651                 client_socket_factory,
 652                 host_resolver,
 653                 SSLClientSocketContext(cert_verifier,
 654                                        channel_id_service,
 655                                        transport_security_state,
 656                                        cert_transparency_verifier,
 657                                        ssl_session_cache_shard),
 658                 enable_ssl_connect_job_waiting,
 659                 net_log)),
 660       ssl_config_service_(ssl_config_service) {
 661   if (ssl_config_service_.get())
 662     ssl_config_service_->AddObserver(this);
 663   if (transport_pool_)
 664     base_.AddLowerLayeredPool(transport_pool_);
 665   if (socks_pool_)
 666     base_.AddLowerLayeredPool(socks_pool_);
 667   if (http_proxy_pool_)
 668     base_.AddLowerLayeredPool(http_proxy_pool_);
 669 }
 670
 671 SSLClientSocketPool::~SSLClientSocketPool() {
 672   if (ssl_config_service_.get())
 673     ssl_config_service_->RemoveObserver(this);
 674 }
 675
 676 scoped_ptr<ConnectJob>
 677 SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
 678     const std::string& group_name,
 679     const PoolBase::Request& request,
 680     ConnectJob::Delegate* delegate) const {
 681   SSLConnectJobMessenger* messenger = NULL;
 682   if (enable_ssl_connect_job_waiting_) {
 683     std::string cache_key = SSLClientSocket::CreateSessionCacheKey(
 684         request.params()->host_and_port(), context_.ssl_session_cache_shard);
 685     MessengerMap::const_iterator it = messenger_map_->find(cache_key);
 686     if (it == messenger_map_->end()) {
 687       std::pair<MessengerMap::iterator, bool> iter = messenger_map_->insert(
 688           MessengerMap::value_type(cache_key, new SSLConnectJobMessenger()));
 689       it = iter.first;
 690     }
 691     messenger = it->second;
 692   }
 693
 694   return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
 695                                                   request.priority(),
 696                                                   request.params(),
 697                                                   ConnectionTimeout(),
 698                                                   transport_pool_,
 699                                                   socks_pool_,
 700                                                   http_proxy_pool_,
 701                                                   client_socket_factory_,
 702                                                   host_resolver_,
 703                                                   context_,
 704                                                   messenger,
 705                                                   delegate,
 706                                                   net_log_));
 707 }
 708
 709 base::TimeDelta
 710 SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout() const {
 711   return timeout_;
 712 }
 713
 714 int SSLClientSocketPool::RequestSocket(const std::string& group_name,
 715                                        const void* socket_params,
 716                                        RequestPriority priority,
 717                                        ClientSocketHandle* handle,
 718                                        const CompletionCallback& callback,
 719                                        const BoundNetLog& net_log) {
 720   const scoped_refptr<SSLSocketParams>* casted_socket_params =
 721       static_cast<const scoped_refptr<SSLSocketParams>*>(socket_params);
 722
 723   return base_.RequestSocket(group_name, *casted_socket_params, priority,
 724                              handle, callback, net_log);
 725 }
 726
 727 void SSLClientSocketPool::RequestSockets(
 728     const std::string& group_name,
 729     const void* params,
 730     int num_sockets,
 731     const BoundNetLog& net_log) {
 732   const scoped_refptr<SSLSocketParams>* casted_params =
 733       static_cast<const scoped_refptr<SSLSocketParams>*>(params);
 734
 735   base_.RequestSockets(group_name, *casted_params, num_sockets, net_log);
 736 }
 737
 738 void SSLClientSocketPool::CancelRequest(const std::string& group_name,
 739                                         ClientSocketHandle* handle) {
 740   base_.CancelRequest(group_name, handle);
 741 }
 742
 743 void SSLClientSocketPool::ReleaseSocket(const std::string& group_name,
 744                                         scoped_ptr<StreamSocket> socket,
 745                                         int id) {
 746   base_.ReleaseSocket(group_name, socket.Pass(), id);
 747 }
 748
 749 void SSLClientSocketPool::FlushWithError(int error) {
 750   base_.FlushWithError(error);
 751 }
 752
 753 void SSLClientSocketPool::CloseIdleSockets() {
 754   base_.CloseIdleSockets();
 755 }
 756
 757 int SSLClientSocketPool::IdleSocketCount() const {
 758   return base_.idle_socket_count();
 759 }
 760
 761 int SSLClientSocketPool::IdleSocketCountInGroup(
 762     const std::string& group_name) const {
 763   return base_.IdleSocketCountInGroup(group_name);
 764 }
 765
 766 LoadState SSLClientSocketPool::GetLoadState(
 767     const std::string& group_name, const ClientSocketHandle* handle) const {
 768   return base_.GetLoadState(group_name, handle);
 769 }
 770
 771 base::DictionaryValue* SSLClientSocketPool::GetInfoAsValue(
 772     const std::string& name,
 773     const std::string& type,
 774     bool include_nested_pools) const {
 775   base::DictionaryValue* dict = base_.GetInfoAsValue(name, type);
 776   if (include_nested_pools) {
 777     base::ListValue* list = new base::ListValue();
 778     if (transport_pool_) {
 779       list->Append(transport_pool_->GetInfoAsValue("transport_socket_pool",
 780                                                    "transport_socket_pool",
 781                                                    false));
 782     }
 783     if (socks_pool_) {
 784       list->Append(socks_pool_->GetInfoAsValue("socks_pool",
 785                                                "socks_pool",
 786                                                true));
 787     }
 788     if (http_proxy_pool_) {
 789       list->Append(http_proxy_pool_->GetInfoAsValue("http_proxy_pool",
 790                                                     "http_proxy_pool",
 791                                                     true));
 792     }
 793     dict->Set("nested_pools", list);
 794   }
 795   return dict;
 796 }
 797
 798 base::TimeDelta SSLClientSocketPool::ConnectionTimeout() const {
 799   return base_.ConnectionTimeout();
 800 }
 801
 802 ClientSocketPoolHistograms* SSLClientSocketPool::histograms() const {
 803   return base_.histograms();
 804 }
 805
 806 bool SSLClientSocketPool::IsStalled() const {
 807   return base_.IsStalled();
 808 }
 809
 810 void SSLClientSocketPool::AddHigherLayeredPool(HigherLayeredPool* higher_pool) {
 811   base_.AddHigherLayeredPool(higher_pool);
 812 }
 813
 814 void SSLClientSocketPool::RemoveHigherLayeredPool(
 815     HigherLayeredPool* higher_pool) {
 816   base_.RemoveHigherLayeredPool(higher_pool);
 817 }
 818
 819 bool SSLClientSocketPool::CloseOneIdleConnection() {
 820   if (base_.CloseOneIdleSocket())
 821     return true;
 822   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 823 }
 824
 825 void SSLClientSocketPool::OnSSLConfigChanged() {
 826   FlushWithError(ERR_NETWORK_CHANGED);
 827 }
 828
 829 }  // namespace net