net/socket/ssl_client_socket_openssl.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 // OpenSSL binding for SSLClientSocket. The class layout and general principle
   6 // of operation is derived from SSLClientSocketNSS.
   7
   8 #include "net/socket/ssl_client_socket_openssl.h"
   9
  10 #include <errno.h>
  11 #include <openssl/bio.h>
  12 #include <openssl/err.h>
  13 #include <openssl/mem.h>
  14 #include <openssl/ssl.h>
  15 #include <string.h>
  16
  17 #include "base/bind.h"
  18 #include "base/callback_helpers.h"
  19 #include "base/environment.h"
  20 #include "base/lazy_instance.h"
  21 #include "base/memory/singleton.h"
  22 #include "base/metrics/histogram_macros.h"
  23 #include "base/profiler/scoped_tracker.h"
  24 #include "base/stl_util.h"
  25 #include "base/strings/string_piece.h"
  26 #include "base/synchronization/lock.h"
  27 #include "base/threading/sequenced_worker_pool.h"
  28 #include "base/threading/thread_local.h"
  29 #include "base/values.h"
  30 #include "crypto/ec_private_key.h"
  31 #include "crypto/openssl_util.h"
  32 #include "crypto/scoped_openssl_types.h"
  33 #include "net/base/ip_address_number.h"
  34 #include "net/base/net_errors.h"
  35 #include "net/cert/cert_policy_enforcer.h"
  36 #include "net/cert/cert_verifier.h"
  37 #include "net/cert/ct_ev_whitelist.h"
  38 #include "net/cert/ct_verifier.h"
  39 #include "net/cert/x509_certificate_net_log_param.h"
  40 #include "net/cert/x509_util_openssl.h"
  41 #include "net/http/transport_security_state.h"
  42 #include "net/ssl/scoped_openssl_types.h"
  43 #include "net/ssl/ssl_cert_request_info.h"
  44 #include "net/ssl/ssl_client_session_cache_openssl.h"
  45 #include "net/ssl/ssl_connection_status_flags.h"
  46 #include "net/ssl/ssl_failure_state.h"
  47 #include "net/ssl/ssl_info.h"
  48 #include "net/ssl/ssl_private_key.h"
  49
  50 #if defined(OS_WIN)
  51 #include "base/win/windows_version.h"
  52 #endif
  53
  54 #if !defined(OS_NACL)
  55 #include "net/ssl/ssl_platform_key.h"
  56 #endif
  57
  58 namespace net {
  59
  60 namespace {
  61
  62 // Enable this to see logging for state machine state transitions.
  63 #if 0
  64 #define GotoState(s) do { DVLOG(2) << (void *)this << " " << __FUNCTION__ << \
  65                            " jump to state " << s; \
  66                            next_handshake_state_ = s; } while (0)
  67 #else
  68 #define GotoState(s) next_handshake_state_ = s
  69 #endif
  70
  71 // This constant can be any non-negative/non-zero value (eg: it does not
  72 // overlap with any value of the net::Error range, including net::OK).
  73 const int kNoPendingResult = 1;
  74
  75 // If a client doesn't have a list of protocols that it supports, but
  76 // the server supports NPN, choosing "http/1.1" is the best answer.
  77 const char kDefaultSupportedNPNProtocol[] = "http/1.1";
  78
  79 // Default size of the internal BoringSSL buffers.
  80 const int KDefaultOpenSSLBufferSize = 17 * 1024;
  81
  82 void FreeX509Stack(STACK_OF(X509)* ptr) {
  83   sk_X509_pop_free(ptr, X509_free);
  84 }
  85
  86 using ScopedX509Stack = crypto::ScopedOpenSSL<STACK_OF(X509), FreeX509Stack>;
  87
  88 #if OPENSSL_VERSION_NUMBER < 0x1000103fL
  89 // This method doesn't seem to have made it into the OpenSSL headers.
  90 unsigned long SSL_CIPHER_get_id(const SSL_CIPHER* cipher) { return cipher->id; }
  91 #endif
  92
  93 // Used for encoding the |connection_status| field of an SSLInfo object.
  94 int EncodeSSLConnectionStatus(uint16 cipher_suite,
  95                               int compression,
  96                               int version) {
  97   return cipher_suite |
  98          ((compression & SSL_CONNECTION_COMPRESSION_MASK) <<
  99           SSL_CONNECTION_COMPRESSION_SHIFT) |
 100          ((version & SSL_CONNECTION_VERSION_MASK) <<
 101           SSL_CONNECTION_VERSION_SHIFT);
 102 }
 103
 104 // Returns the net SSL version number (see ssl_connection_status_flags.h) for
 105 // this SSL connection.
 106 int GetNetSSLVersion(SSL* ssl) {
 107   switch (SSL_version(ssl)) {
 108     case TLS1_VERSION:
 109       return SSL_CONNECTION_VERSION_TLS1;
 110     case TLS1_1_VERSION:
 111       return SSL_CONNECTION_VERSION_TLS1_1;
 112     case TLS1_2_VERSION:
 113       return SSL_CONNECTION_VERSION_TLS1_2;
 114     default:
 115       NOTREACHED();
 116       return SSL_CONNECTION_VERSION_UNKNOWN;
 117   }
 118 }
 119
 120 ScopedX509 OSCertHandleToOpenSSL(
 121     X509Certificate::OSCertHandle os_handle) {
 122 #if defined(USE_OPENSSL_CERTS)
 123   return ScopedX509(X509Certificate::DupOSCertHandle(os_handle));
 124 #else  // !defined(USE_OPENSSL_CERTS)
 125   std::string der_encoded;
 126   if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded))
 127     return ScopedX509();
 128   const uint8_t* bytes = reinterpret_cast<const uint8_t*>(der_encoded.data());
 129   return ScopedX509(d2i_X509(NULL, &bytes, der_encoded.size()));
 130 #endif  // defined(USE_OPENSSL_CERTS)
 131 }
 132
 133 ScopedX509Stack OSCertHandlesToOpenSSL(
 134     const X509Certificate::OSCertHandles& os_handles) {
 135   ScopedX509Stack stack(sk_X509_new_null());
 136   for (size_t i = 0; i < os_handles.size(); i++) {
 137     ScopedX509 x509 = OSCertHandleToOpenSSL(os_handles[i]);
 138     if (!x509)
 139       return ScopedX509Stack();
 140     sk_X509_push(stack.get(), x509.release());
 141   }
 142   return stack.Pass();
 143 }
 144
 145 int LogErrorCallback(const char* str, size_t len, void* context) {
 146   LOG(ERROR) << base::StringPiece(str, len);
 147   return 1;
 148 }
 149
 150 bool EVP_MDToPrivateKeyHash(const EVP_MD* md, SSLPrivateKey::Hash* hash) {
 151   switch (EVP_MD_type(md)) {
 152     case NID_md5_sha1:
 153       *hash = SSLPrivateKey::Hash::MD5_SHA1;
 154       return true;
 155     case NID_sha1:
 156       *hash = SSLPrivateKey::Hash::SHA1;
 157       return true;
 158     case NID_sha256:
 159       *hash = SSLPrivateKey::Hash::SHA256;
 160       return true;
 161     case NID_sha384:
 162       *hash = SSLPrivateKey::Hash::SHA384;
 163       return true;
 164     case NID_sha512:
 165       *hash = SSLPrivateKey::Hash::SHA512;
 166       return true;
 167     default:
 168       return false;
 169   }
 170 }
 171
 172 #if !defined(OS_NACL)
 173 class PlatformKeyTaskRunner {
 174  public:
 175   PlatformKeyTaskRunner() {
 176     // Serialize all the private key operations on a single background
 177     // thread to avoid problems with buggy smartcards.
 178     worker_pool_ = new base::SequencedWorkerPool(1, "Platform Key Thread");
 179     task_runner_ = worker_pool_->GetSequencedTaskRunnerWithShutdownBehavior(
 180         worker_pool_->GetSequenceToken(),
 181         base::SequencedWorkerPool::CONTINUE_ON_SHUTDOWN);
 182   }
 183
 184   scoped_refptr<base::SequencedTaskRunner> task_runner() {
 185     return task_runner_;
 186   }
 187
 188  private:
 189   scoped_refptr<base::SequencedWorkerPool> worker_pool_;
 190   scoped_refptr<base::SequencedTaskRunner> task_runner_;
 191
 192   DISALLOW_COPY_AND_ASSIGN(PlatformKeyTaskRunner);
 193 };
 194
 195 base::LazyInstance<PlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
 196     LAZY_INSTANCE_INITIALIZER;
 197 #endif
 198
 199 }  // namespace
 200
 201 class SSLClientSocketOpenSSL::SSLContext {
 202  public:
 203   static SSLContext* GetInstance() {
 204     return base::Singleton<SSLContext>::get();
 205   }
 206   SSL_CTX* ssl_ctx() { return ssl_ctx_.get(); }
 207   SSLClientSessionCacheOpenSSL* session_cache() { return &session_cache_; }
 208
 209   SSLClientSocketOpenSSL* GetClientSocketFromSSL(const SSL* ssl) {
 210     DCHECK(ssl);
 211     SSLClientSocketOpenSSL* socket = static_cast<SSLClientSocketOpenSSL*>(
 212         SSL_get_ex_data(ssl, ssl_socket_data_index_));
 213     DCHECK(socket);
 214     return socket;
 215   }
 216
 217   bool SetClientSocketForSSL(SSL* ssl, SSLClientSocketOpenSSL* socket) {
 218     return SSL_set_ex_data(ssl, ssl_socket_data_index_, socket) != 0;
 219   }
 220
 221   static const SSL_PRIVATE_KEY_METHOD kPrivateKeyMethod;
 222
 223  private:
 224   friend struct base::DefaultSingletonTraits<SSLContext>;
 225
 226   SSLContext() : session_cache_(SSLClientSessionCacheOpenSSL::Config()) {
 227     crypto::EnsureOpenSSLInit();
 228     ssl_socket_data_index_ = SSL_get_ex_new_index(0, 0, 0, 0, 0);
 229     DCHECK_NE(ssl_socket_data_index_, -1);
 230     ssl_ctx_.reset(SSL_CTX_new(SSLv23_client_method()));
 231     SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(), CertVerifyCallback, NULL);
 232     SSL_CTX_set_cert_cb(ssl_ctx_.get(), ClientCertRequestCallback, NULL);
 233     SSL_CTX_set_verify(ssl_ctx_.get(), SSL_VERIFY_PEER, NULL);
 234     // This stops |SSL_shutdown| from generating the close_notify message, which
 235     // is currently not sent on the network.
 236     // TODO(haavardm): Remove setting quiet shutdown once 118366 is fixed.
 237     SSL_CTX_set_quiet_shutdown(ssl_ctx_.get(), 1);
 238     // TODO(kristianm): Only select this if ssl_config_.next_proto is not empty.
 239     // It would be better if the callback were not a global setting,
 240     // but that is an OpenSSL issue.
 241     SSL_CTX_set_next_proto_select_cb(ssl_ctx_.get(), SelectNextProtoCallback,
 242                                      NULL);
 243
 244     // Disable the internal session cache. Session caching is handled
 245     // externally (i.e. by SSLClientSessionCacheOpenSSL).
 246     SSL_CTX_set_session_cache_mode(
 247         ssl_ctx_.get(), SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
 248     SSL_CTX_sess_set_new_cb(ssl_ctx_.get(), NewSessionCallback);
 249
 250     scoped_ptr<base::Environment> env(base::Environment::Create());
 251     std::string ssl_keylog_file;
 252     if (env->GetVar("SSLKEYLOGFILE", &ssl_keylog_file) &&
 253         !ssl_keylog_file.empty()) {
 254       crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 255       BIO* bio = BIO_new_file(ssl_keylog_file.c_str(), "a");
 256       if (!bio) {
 257         LOG(ERROR) << "Failed to open " << ssl_keylog_file;
 258         ERR_print_errors_cb(&LogErrorCallback, NULL);
 259       } else {
 260         SSL_CTX_set_keylog_bio(ssl_ctx_.get(), bio);
 261       }
 262     }
 263   }
 264
 265   static int ClientCertRequestCallback(SSL* ssl, void* arg) {
 266     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 267     DCHECK(socket);
 268     return socket->ClientCertRequestCallback(ssl);
 269   }
 270
 271   static int CertVerifyCallback(X509_STORE_CTX *store_ctx, void *arg) {
 272     SSL* ssl = reinterpret_cast<SSL*>(X509_STORE_CTX_get_ex_data(
 273         store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
 274     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 275     CHECK(socket);
 276
 277     return socket->CertVerifyCallback(store_ctx);
 278   }
 279
 280   static int SelectNextProtoCallback(SSL* ssl,
 281                                      unsigned char** out, unsigned char* outlen,
 282                                      const unsigned char* in,
 283                                      unsigned int inlen, void* arg) {
 284     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 285     return socket->SelectNextProtoCallback(out, outlen, in, inlen);
 286   }
 287
 288   static int NewSessionCallback(SSL* ssl, SSL_SESSION* session) {
 289     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 290     return socket->NewSessionCallback(session);
 291   }
 292
 293   static int PrivateKeyTypeCallback(SSL* ssl) {
 294     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 295     return socket->PrivateKeyTypeCallback();
 296   }
 297
 298   static int PrivateKeySupportsDigestCallback(SSL* ssl, const EVP_MD* md) {
 299     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 300     return socket->PrivateKeySupportsDigestCallback(md);
 301   }
 302
 303   static size_t PrivateKeyMaxSignatureLenCallback(SSL* ssl) {
 304     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 305     return socket->PrivateKeyMaxSignatureLenCallback();
 306   }
 307
 308   static ssl_private_key_result_t PrivateKeySignCallback(SSL* ssl,
 309                                                          uint8_t* out,
 310                                                          size_t* out_len,
 311                                                          size_t max_out,
 312                                                          const EVP_MD* md,
 313                                                          const uint8_t* in,
 314                                                          size_t in_len) {
 315     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 316     return socket->PrivateKeySignCallback(out, out_len, max_out, md, in,
 317                                           in_len);
 318   }
 319
 320   static ssl_private_key_result_t PrivateKeySignCompleteCallback(
 321       SSL* ssl,
 322       uint8_t* out,
 323       size_t* out_len,
 324       size_t max_out) {
 325     SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl);
 326     return socket->PrivateKeySignCompleteCallback(out, out_len, max_out);
 327   }
 328
 329   // This is the index used with SSL_get_ex_data to retrieve the owner
 330   // SSLClientSocketOpenSSL object from an SSL instance.
 331   int ssl_socket_data_index_;
 332
 333   ScopedSSL_CTX ssl_ctx_;
 334
 335   // TODO(davidben): Use a separate cache per URLRequestContext.
 336   // https://crbug.com/458365
 337   //
 338   // TODO(davidben): Sessions should be invalidated on fatal
 339   // alerts. https://crbug.com/466352
 340   SSLClientSessionCacheOpenSSL session_cache_;
 341 };
 342
 343 const SSL_PRIVATE_KEY_METHOD
 344     SSLClientSocketOpenSSL::SSLContext::kPrivateKeyMethod = {
 345         &SSLClientSocketOpenSSL::SSLContext::PrivateKeyTypeCallback,
 346         &SSLClientSocketOpenSSL::SSLContext::PrivateKeySupportsDigestCallback,
 347         &SSLClientSocketOpenSSL::SSLContext::PrivateKeyMaxSignatureLenCallback,
 348         &SSLClientSocketOpenSSL::SSLContext::PrivateKeySignCallback,
 349         &SSLClientSocketOpenSSL::SSLContext::PrivateKeySignCompleteCallback,
 350 };
 351
 352 // PeerCertificateChain is a helper object which extracts the certificate
 353 // chain, as given by the server, from an OpenSSL socket and performs the needed
 354 // resource management. The first element of the chain is the leaf certificate
 355 // and the other elements are in the order given by the server.
 356 class SSLClientSocketOpenSSL::PeerCertificateChain {
 357  public:
 358   explicit PeerCertificateChain(STACK_OF(X509)* chain) { Reset(chain); }
 359   PeerCertificateChain(const PeerCertificateChain& other) { *this = other; }
 360   ~PeerCertificateChain() {}
 361   PeerCertificateChain& operator=(const PeerCertificateChain& other);
 362
 363   // Resets the PeerCertificateChain to the set of certificates in|chain|,
 364   // which may be NULL, indicating to empty the store certificates.
 365   // Note: If an error occurs, such as being unable to parse the certificates,
 366   // this will behave as if Reset(NULL) was called.
 367   void Reset(STACK_OF(X509)* chain);
 368
 369   // Note that when USE_OPENSSL is defined, OSCertHandle is X509*
 370   scoped_refptr<X509Certificate> AsOSChain() const;
 371
 372   size_t size() const {
 373     if (!openssl_chain_.get())
 374       return 0;
 375     return sk_X509_num(openssl_chain_.get());
 376   }
 377
 378   bool empty() const {
 379     return size() == 0;
 380   }
 381
 382   X509* Get(size_t index) const {
 383     DCHECK_LT(index, size());
 384     return sk_X509_value(openssl_chain_.get(), index);
 385   }
 386
 387  private:
 388   ScopedX509Stack openssl_chain_;
 389 };
 390
 391 SSLClientSocketOpenSSL::PeerCertificateChain&
 392 SSLClientSocketOpenSSL::PeerCertificateChain::operator=(
 393     const PeerCertificateChain& other) {
 394   if (this == &other)
 395     return *this;
 396
 397   openssl_chain_.reset(X509_chain_up_ref(other.openssl_chain_.get()));
 398   return *this;
 399 }
 400
 401 void SSLClientSocketOpenSSL::PeerCertificateChain::Reset(
 402     STACK_OF(X509)* chain) {
 403   openssl_chain_.reset(chain ? X509_chain_up_ref(chain) : NULL);
 404 }
 405
 406 scoped_refptr<X509Certificate>
 407 SSLClientSocketOpenSSL::PeerCertificateChain::AsOSChain() const {
 408 #if defined(USE_OPENSSL_CERTS)
 409   // When OSCertHandle is typedef'ed to X509, this implementation does a short
 410   // cut to avoid converting back and forth between DER and the X509 struct.
 411   X509Certificate::OSCertHandles intermediates;
 412   for (size_t i = 1; i < sk_X509_num(openssl_chain_.get()); ++i) {
 413     intermediates.push_back(sk_X509_value(openssl_chain_.get(), i));
 414   }
 415
 416   return make_scoped_refptr(X509Certificate::CreateFromHandle(
 417       sk_X509_value(openssl_chain_.get(), 0), intermediates));
 418 #else
 419   // DER-encode the chain and convert to a platform certificate handle.
 420   std::vector<base::StringPiece> der_chain;
 421   for (size_t i = 0; i < sk_X509_num(openssl_chain_.get()); ++i) {
 422     X509* x = sk_X509_value(openssl_chain_.get(), i);
 423     base::StringPiece der;
 424     if (!x509_util::GetDER(x, &der))
 425       return NULL;
 426     der_chain.push_back(der);
 427   }
 428
 429   return make_scoped_refptr(X509Certificate::CreateFromDERCertChain(der_chain));
 430 #endif
 431 }
 432
 433 // static
 434 void SSLClientSocket::ClearSessionCache() {
 435   SSLClientSocketOpenSSL::SSLContext* context =
 436       SSLClientSocketOpenSSL::SSLContext::GetInstance();
 437   context->session_cache()->Flush();
 438 }
 439
 440 // static
 441 uint16 SSLClientSocket::GetMaxSupportedSSLVersion() {
 442   return SSL_PROTOCOL_VERSION_TLS1_2;
 443 }
 444
 445 SSLClientSocketOpenSSL::SSLClientSocketOpenSSL(
 446     scoped_ptr<ClientSocketHandle> transport_socket,
 447     const HostPortPair& host_and_port,
 448     const SSLConfig& ssl_config,
 449     const SSLClientSocketContext& context)
 450     : transport_send_busy_(false),
 451       transport_recv_busy_(false),
 452       pending_read_error_(kNoPendingResult),
 453       pending_read_ssl_error_(SSL_ERROR_NONE),
 454       transport_read_error_(OK),
 455       transport_write_error_(OK),
 456       server_cert_chain_(new PeerCertificateChain(NULL)),
 457       completed_connect_(false),
 458       was_ever_used_(false),
 459       cert_verifier_(context.cert_verifier),
 460       cert_transparency_verifier_(context.cert_transparency_verifier),
 461       channel_id_service_(context.channel_id_service),
 462       ssl_(NULL),
 463       transport_bio_(NULL),
 464       transport_(transport_socket.Pass()),
 465       host_and_port_(host_and_port),
 466       ssl_config_(ssl_config),
 467       ssl_session_cache_shard_(context.ssl_session_cache_shard),
 468       next_handshake_state_(STATE_NONE),
 469       disconnected_(false),
 470       npn_status_(kNextProtoUnsupported),
 471       channel_id_sent_(false),
 472       session_pending_(false),
 473       certificate_verified_(false),
 474       ssl_failure_state_(SSL_FAILURE_NONE),
 475       signature_result_(kNoPendingResult),
 476       transport_security_state_(context.transport_security_state),
 477       policy_enforcer_(context.cert_policy_enforcer),
 478       net_log_(transport_->socket()->NetLog()),
 479       weak_factory_(this) {
 480   DCHECK(cert_verifier_);
 481 }
 482
 483 SSLClientSocketOpenSSL::~SSLClientSocketOpenSSL() {
 484   Disconnect();
 485 }
 486
 487 void SSLClientSocketOpenSSL::GetSSLCertRequestInfo(
 488     SSLCertRequestInfo* cert_request_info) {
 489   cert_request_info->host_and_port = host_and_port_;
 490   cert_request_info->cert_authorities = cert_authorities_;
 491   cert_request_info->cert_key_types = cert_key_types_;
 492 }
 493
 494 SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto(
 495     std::string* proto) const {
 496   *proto = npn_proto_;
 497   return npn_status_;
 498 }
 499
 500 ChannelIDService*
 501 SSLClientSocketOpenSSL::GetChannelIDService() const {
 502   return channel_id_service_;
 503 }
 504
 505 SSLFailureState SSLClientSocketOpenSSL::GetSSLFailureState() const {
 506   return ssl_failure_state_;
 507 }
 508
 509 int SSLClientSocketOpenSSL::ExportKeyingMaterial(
 510     const base::StringPiece& label,
 511     bool has_context, const base::StringPiece& context,
 512     unsigned char* out, unsigned int outlen) {
 513   if (!IsConnected())
 514     return ERR_SOCKET_NOT_CONNECTED;
 515
 516   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 517
 518   int rv = SSL_export_keying_material(
 519       ssl_, out, outlen, label.data(), label.size(),
 520       reinterpret_cast<const unsigned char*>(context.data()), context.length(),
 521       has_context ? 1 : 0);
 522
 523   if (rv != 1) {
 524     int ssl_error = SSL_get_error(ssl_, rv);
 525     LOG(ERROR) << "Failed to export keying material;"
 526                << " returned " << rv
 527                << ", SSL error code " << ssl_error;
 528     return MapOpenSSLError(ssl_error, err_tracer);
 529   }
 530   return OK;
 531 }
 532
 533 int SSLClientSocketOpenSSL::GetTLSUniqueChannelBinding(std::string* out) {
 534   NOTIMPLEMENTED();
 535   return ERR_NOT_IMPLEMENTED;
 536 }
 537
 538 int SSLClientSocketOpenSSL::Connect(const CompletionCallback& callback) {
 539   // It is an error to create an SSLClientSocket whose context has no
 540   // TransportSecurityState.
 541   DCHECK(transport_security_state_);
 542
 543   // Although StreamSocket does allow calling Connect() after Disconnect(),
 544   // this has never worked for layered sockets. CHECK to detect any consumers
 545   // reconnecting an SSL socket.
 546   //
 547   // TODO(davidben,mmenke): Remove this API feature. See
 548   // https://crbug.com/499289.
 549   CHECK(!disconnected_);
 550
 551   net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT);
 552
 553   // Set up new ssl object.
 554   int rv = Init();
 555   if (rv != OK) {
 556     net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
 557     return rv;
 558   }
 559
 560   // Set SSL to client mode. Handshake happens in the loop below.
 561   SSL_set_connect_state(ssl_);
 562
 563   GotoState(STATE_HANDSHAKE);
 564   rv = DoHandshakeLoop(OK);
 565   if (rv == ERR_IO_PENDING) {
 566     user_connect_callback_ = callback;
 567   } else {
 568     net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
 569   }
 570
 571   return rv > OK ? OK : rv;
 572 }
 573
 574 void SSLClientSocketOpenSSL::Disconnect() {
 575   if (ssl_) {
 576     // Calling SSL_shutdown prevents the session from being marked as
 577     // unresumable.
 578     SSL_shutdown(ssl_);
 579     SSL_free(ssl_);
 580     ssl_ = NULL;
 581   }
 582   if (transport_bio_) {
 583     BIO_free_all(transport_bio_);
 584     transport_bio_ = NULL;
 585   }
 586
 587   disconnected_ = true;
 588
 589   // Shut down anything that may call us back.
 590   cert_verifier_request_.reset();
 591   transport_->socket()->Disconnect();
 592
 593   // Null all callbacks, delete all buffers.
 594   transport_send_busy_ = false;
 595   send_buffer_ = NULL;
 596   transport_recv_busy_ = false;
 597   recv_buffer_ = NULL;
 598
 599   user_connect_callback_.Reset();
 600   user_read_callback_.Reset();
 601   user_write_callback_.Reset();
 602   user_read_buf_         = NULL;
 603   user_read_buf_len_     = 0;
 604   user_write_buf_        = NULL;
 605   user_write_buf_len_    = 0;
 606
 607   pending_read_error_ = kNoPendingResult;
 608   pending_read_ssl_error_ = SSL_ERROR_NONE;
 609   pending_read_error_info_ = OpenSSLErrorInfo();
 610
 611   transport_read_error_ = OK;
 612   transport_write_error_ = OK;
 613
 614   server_cert_verify_result_.Reset();
 615   completed_connect_ = false;
 616
 617   cert_authorities_.clear();
 618   cert_key_types_.clear();
 619
 620   start_cert_verification_time_ = base::TimeTicks();
 621
 622   npn_status_ = kNextProtoUnsupported;
 623   npn_proto_.clear();
 624
 625   channel_id_sent_ = false;
 626   session_pending_ = false;
 627   certificate_verified_ = false;
 628   channel_id_request_.Cancel();
 629   ssl_failure_state_ = SSL_FAILURE_NONE;
 630
 631   private_key_.reset();
 632   signature_result_ = kNoPendingResult;
 633   signature_.clear();
 634 }
 635
 636 bool SSLClientSocketOpenSSL::IsConnected() const {
 637   // If the handshake has not yet completed.
 638   if (!completed_connect_)
 639     return false;
 640   // If an asynchronous operation is still pending.
 641   if (user_read_buf_.get() || user_write_buf_.get())
 642     return true;
 643
 644   return transport_->socket()->IsConnected();
 645 }
 646
 647 bool SSLClientSocketOpenSSL::IsConnectedAndIdle() const {
 648   // If the handshake has not yet completed.
 649   if (!completed_connect_)
 650     return false;
 651   // If an asynchronous operation is still pending.
 652   if (user_read_buf_.get() || user_write_buf_.get())
 653     return false;
 654
 655   // If there is data read from the network that has not yet been consumed, do
 656   // not treat the connection as idle.
 657   //
 658   // Note that this does not check |BIO_pending|, whether there is ciphertext
 659   // that has not yet been flushed to the network. |Write| returns early, so
 660   // this can cause race conditions which cause a socket to not be treated
 661   // reusable when it should be. See https://crbug.com/466147.
 662   if (BIO_wpending(transport_bio_) > 0)
 663     return false;
 664
 665   return transport_->socket()->IsConnectedAndIdle();
 666 }
 667
 668 int SSLClientSocketOpenSSL::GetPeerAddress(IPEndPoint* addressList) const {
 669   return transport_->socket()->GetPeerAddress(addressList);
 670 }
 671
 672 int SSLClientSocketOpenSSL::GetLocalAddress(IPEndPoint* addressList) const {
 673   return transport_->socket()->GetLocalAddress(addressList);
 674 }
 675
 676 const BoundNetLog& SSLClientSocketOpenSSL::NetLog() const {
 677   return net_log_;
 678 }
 679
 680 void SSLClientSocketOpenSSL::SetSubresourceSpeculation() {
 681   if (transport_.get() && transport_->socket()) {
 682     transport_->socket()->SetSubresourceSpeculation();
 683   } else {
 684     NOTREACHED();
 685   }
 686 }
 687
 688 void SSLClientSocketOpenSSL::SetOmniboxSpeculation() {
 689   if (transport_.get() && transport_->socket()) {
 690     transport_->socket()->SetOmniboxSpeculation();
 691   } else {
 692     NOTREACHED();
 693   }
 694 }
 695
 696 bool SSLClientSocketOpenSSL::WasEverUsed() const {
 697   return was_ever_used_;
 698 }
 699
 700 bool SSLClientSocketOpenSSL::UsingTCPFastOpen() const {
 701   if (transport_.get() && transport_->socket())
 702     return transport_->socket()->UsingTCPFastOpen();
 703
 704   NOTREACHED();
 705   return false;
 706 }
 707
 708 bool SSLClientSocketOpenSSL::GetSSLInfo(SSLInfo* ssl_info) {
 709   ssl_info->Reset();
 710   if (server_cert_chain_->empty())
 711     return false;
 712
 713   ssl_info->cert = server_cert_verify_result_.verified_cert;
 714   ssl_info->unverified_cert = server_cert_;
 715   ssl_info->cert_status = server_cert_verify_result_.cert_status;
 716   ssl_info->is_issued_by_known_root =
 717       server_cert_verify_result_.is_issued_by_known_root;
 718   ssl_info->public_key_hashes =
 719     server_cert_verify_result_.public_key_hashes;
 720   ssl_info->client_cert_sent =
 721       ssl_config_.send_client_cert && ssl_config_.client_cert.get();
 722   ssl_info->channel_id_sent = channel_id_sent_;
 723   ssl_info->pinning_failure_log = pinning_failure_log_;
 724
 725   AddSCTInfoToSSLInfo(ssl_info);
 726
 727   const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_);
 728   CHECK(cipher);
 729   ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL);
 730   ssl_info->key_exchange_info =
 731       SSL_SESSION_get_key_exchange_info(SSL_get_session(ssl_));
 732
 733   ssl_info->connection_status = EncodeSSLConnectionStatus(
 734       static_cast<uint16>(SSL_CIPHER_get_id(cipher)), 0 /* no compression */,
 735       GetNetSSLVersion(ssl_));
 736
 737   if (!SSL_get_secure_renegotiation_support(ssl_))
 738     ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
 739
 740   if (ssl_config_.version_fallback)
 741     ssl_info->connection_status |= SSL_CONNECTION_VERSION_FALLBACK;
 742
 743   ssl_info->handshake_type = SSL_session_reused(ssl_) ?
 744       SSLInfo::HANDSHAKE_RESUME : SSLInfo::HANDSHAKE_FULL;
 745
 746   DVLOG(3) << "Encoded connection status: cipher suite = "
 747       << SSLConnectionStatusToCipherSuite(ssl_info->connection_status)
 748       << " version = "
 749       << SSLConnectionStatusToVersion(ssl_info->connection_status);
 750   return true;
 751 }
 752
 753 void SSLClientSocketOpenSSL::GetConnectionAttempts(
 754     ConnectionAttempts* out) const {
 755   out->clear();
 756 }
 757
 758 int SSLClientSocketOpenSSL::Read(IOBuffer* buf,
 759                                  int buf_len,
 760                                  const CompletionCallback& callback) {
 761   user_read_buf_ = buf;
 762   user_read_buf_len_ = buf_len;
 763
 764   int rv = DoReadLoop();
 765
 766   if (rv == ERR_IO_PENDING) {
 767     user_read_callback_ = callback;
 768   } else {
 769     if (rv > 0)
 770       was_ever_used_ = true;
 771     user_read_buf_ = NULL;
 772     user_read_buf_len_ = 0;
 773   }
 774
 775   return rv;
 776 }
 777
 778 int SSLClientSocketOpenSSL::Write(IOBuffer* buf,
 779                                   int buf_len,
 780                                   const CompletionCallback& callback) {
 781   user_write_buf_ = buf;
 782   user_write_buf_len_ = buf_len;
 783
 784   int rv = DoWriteLoop();
 785
 786   if (rv == ERR_IO_PENDING) {
 787     user_write_callback_ = callback;
 788   } else {
 789     if (rv > 0)
 790       was_ever_used_ = true;
 791     user_write_buf_ = NULL;
 792     user_write_buf_len_ = 0;
 793   }
 794
 795   return rv;
 796 }
 797
 798 int SSLClientSocketOpenSSL::SetReceiveBufferSize(int32 size) {
 799   return transport_->socket()->SetReceiveBufferSize(size);
 800 }
 801
 802 int SSLClientSocketOpenSSL::SetSendBufferSize(int32 size) {
 803   return transport_->socket()->SetSendBufferSize(size);
 804 }
 805
 806 int SSLClientSocketOpenSSL::Init() {
 807   DCHECK(!ssl_);
 808   DCHECK(!transport_bio_);
 809
 810   SSLContext* context = SSLContext::GetInstance();
 811   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 812
 813   ssl_ = SSL_new(context->ssl_ctx());
 814   if (!ssl_ || !context->SetClientSocketForSSL(ssl_, this))
 815     return ERR_UNEXPECTED;
 816
 817   // SNI should only contain valid DNS hostnames, not IP addresses (see RFC
 818   // 6066, Section 3).
 819   //
 820   // TODO(rsleevi): Should this code allow hostnames that violate the LDH rule?
 821   // See https://crbug.com/496472 and https://crbug.com/496468 for discussion.
 822   IPAddressNumber unused;
 823   if (!ParseIPLiteralToNumber(host_and_port_.host(), &unused) &&
 824       !SSL_set_tlsext_host_name(ssl_, host_and_port_.host().c_str())) {
 825     return ERR_UNEXPECTED;
 826   }
 827
 828   SSL_SESSION* session = context->session_cache()->Lookup(GetSessionCacheKey());
 829   if (session != nullptr)
 830     SSL_set_session(ssl_, session);
 831
 832   send_buffer_ = new GrowableIOBuffer();
 833   send_buffer_->SetCapacity(KDefaultOpenSSLBufferSize);
 834   recv_buffer_ = new GrowableIOBuffer();
 835   recv_buffer_->SetCapacity(KDefaultOpenSSLBufferSize);
 836
 837   BIO* ssl_bio = NULL;
 838
 839   // SSLClientSocketOpenSSL retains ownership of the BIO buffers.
 840   if (!BIO_new_bio_pair_external_buf(
 841           &ssl_bio, send_buffer_->capacity(),
 842           reinterpret_cast<uint8_t*>(send_buffer_->data()), &transport_bio_,
 843           recv_buffer_->capacity(),
 844           reinterpret_cast<uint8_t*>(recv_buffer_->data())))
 845     return ERR_UNEXPECTED;
 846   DCHECK(ssl_bio);
 847   DCHECK(transport_bio_);
 848
 849   // Install a callback on OpenSSL's end to plumb transport errors through.
 850   BIO_set_callback(ssl_bio, &SSLClientSocketOpenSSL::BIOCallback);
 851   BIO_set_callback_arg(ssl_bio, reinterpret_cast<char*>(this));
 852
 853   SSL_set_bio(ssl_, ssl_bio, ssl_bio);
 854
 855   DCHECK_LT(SSL3_VERSION, ssl_config_.version_min);
 856   DCHECK_LT(SSL3_VERSION, ssl_config_.version_max);
 857   SSL_set_min_version(ssl_, ssl_config_.version_min);
 858   SSL_set_max_version(ssl_, ssl_config_.version_max);
 859
 860   // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
 861   // set everything we care about to an absolute value.
 862   SslSetClearMask options;
 863   options.ConfigureFlag(SSL_OP_NO_COMPRESSION, true);
 864
 865   // TODO(joth): Set this conditionally, see http://crbug.com/55410
 866   options.ConfigureFlag(SSL_OP_LEGACY_SERVER_CONNECT, true);
 867
 868   SSL_set_options(ssl_, options.set_mask);
 869   SSL_clear_options(ssl_, options.clear_mask);
 870
 871   // Same as above, this time for the SSL mode.
 872   SslSetClearMask mode;
 873
 874   mode.ConfigureFlag(SSL_MODE_RELEASE_BUFFERS, true);
 875   mode.ConfigureFlag(SSL_MODE_CBC_RECORD_SPLITTING, true);
 876
 877   mode.ConfigureFlag(SSL_MODE_ENABLE_FALSE_START,
 878                      ssl_config_.false_start_enabled);
 879
 880   mode.ConfigureFlag(SSL_MODE_SEND_FALLBACK_SCSV, ssl_config_.version_fallback);
 881
 882   SSL_set_mode(ssl_, mode.set_mask);
 883   SSL_clear_mode(ssl_, mode.clear_mask);
 884
 885   // Removing ciphers by ID from OpenSSL is a bit involved as we must use the
 886   // textual name with SSL_set_cipher_list because there is no public API to
 887   // directly remove a cipher by ID.
 888   STACK_OF(SSL_CIPHER)* ciphers = SSL_get_ciphers(ssl_);
 889   DCHECK(ciphers);
 890   // See SSLConfig::disabled_cipher_suites for description of the suites
 891   // disabled by default. Note that !SHA256 and !SHA384 only remove HMAC-SHA256
 892   // and HMAC-SHA384 cipher suites, not GCM cipher suites with SHA256 or SHA384
 893   // as the handshake hash.
 894   std::string command("DEFAULT:!SHA256:!SHA384:!AESGCM+AES256:!aPSK");
 895   // Walk through all the installed ciphers, seeing if any need to be
 896   // appended to the cipher removal |command|.
 897   for (size_t i = 0; i < sk_SSL_CIPHER_num(ciphers); ++i) {
 898     const SSL_CIPHER* cipher = sk_SSL_CIPHER_value(ciphers, i);
 899     const uint16 id = static_cast<uint16>(SSL_CIPHER_get_id(cipher));
 900     bool disable = false;
 901     if (ssl_config_.require_ecdhe) {
 902       base::StringPiece kx_name(SSL_CIPHER_get_kx_name(cipher));
 903       disable = kx_name != "ECDHE_RSA" && kx_name != "ECDHE_ECDSA";
 904     }
 905     if (!disable) {
 906       disable = std::find(ssl_config_.disabled_cipher_suites.begin(),
 907                           ssl_config_.disabled_cipher_suites.end(), id) !=
 908                     ssl_config_.disabled_cipher_suites.end();
 909     }
 910     if (disable) {
 911        const char* name = SSL_CIPHER_get_name(cipher);
 912        DVLOG(3) << "Found cipher to remove: '" << name << "', ID: " << id
 913                 << " strength: " << SSL_CIPHER_get_bits(cipher, NULL);
 914        command.append(":!");
 915        command.append(name);
 916      }
 917   }
 918
 919   if (!ssl_config_.enable_deprecated_cipher_suites)
 920     command.append(":!RC4");
 921
 922   // Disable ECDSA cipher suites on platforms that do not support ECDSA
 923   // signed certificates, as servers may use the presence of such
 924   // ciphersuites as a hint to send an ECDSA certificate.
 925 #if defined(OS_WIN)
 926   if (base::win::GetVersion() < base::win::VERSION_VISTA)
 927     command.append(":!ECDSA");
 928 #endif
 929
 930   int rv = SSL_set_cipher_list(ssl_, command.c_str());
 931   // If this fails (rv = 0) it means there are no ciphers enabled on this SSL.
 932   // This will almost certainly result in the socket failing to complete the
 933   // handshake at which point the appropriate error is bubbled up to the client.
 934   LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') "
 935                               "returned " << rv;
 936
 937   // TLS channel ids.
 938   if (IsChannelIDEnabled(ssl_config_, channel_id_service_)) {
 939     SSL_enable_tls_channel_id(ssl_);
 940   }
 941
 942   if (!ssl_config_.next_protos.empty()) {
 943     // Get list of ciphers that are enabled.
 944     STACK_OF(SSL_CIPHER)* enabled_ciphers = SSL_get_ciphers(ssl_);
 945     DCHECK(enabled_ciphers);
 946     std::vector<uint16> enabled_ciphers_vector;
 947     for (size_t i = 0; i < sk_SSL_CIPHER_num(enabled_ciphers); ++i) {
 948       const SSL_CIPHER* cipher = sk_SSL_CIPHER_value(enabled_ciphers, i);
 949       const uint16 id = static_cast<uint16>(SSL_CIPHER_get_id(cipher));
 950       enabled_ciphers_vector.push_back(id);
 951     }
 952
 953     std::vector<uint8_t> wire_protos =
 954         SerializeNextProtos(ssl_config_.next_protos,
 955                             HasCipherAdequateForHTTP2(enabled_ciphers_vector) &&
 956                                 IsTLSVersionAdequateForHTTP2(ssl_config_));
 957     SSL_set_alpn_protos(ssl_, wire_protos.empty() ? NULL : &wire_protos[0],
 958                         wire_protos.size());
 959   }
 960
 961   if (ssl_config_.signed_cert_timestamps_enabled) {
 962     SSL_enable_signed_cert_timestamps(ssl_);
 963     SSL_enable_ocsp_stapling(ssl_);
 964   }
 965
 966   if (cert_verifier_->SupportsOCSPStapling())
 967     SSL_enable_ocsp_stapling(ssl_);
 968
 969   // By default, renegotiations are rejected. After the initial handshake
 970   // completes, some application protocols may re-enable it.
 971   SSL_set_reject_peer_renegotiations(ssl_, 1);
 972
 973   return OK;
 974 }
 975
 976 void SSLClientSocketOpenSSL::DoReadCallback(int rv) {
 977   // Since Run may result in Read being called, clear |user_read_callback_|
 978   // up front.
 979   if (rv > 0)
 980     was_ever_used_ = true;
 981   user_read_buf_ = NULL;
 982   user_read_buf_len_ = 0;
 983   base::ResetAndReturn(&user_read_callback_).Run(rv);
 984 }
 985
 986 void SSLClientSocketOpenSSL::DoWriteCallback(int rv) {
 987   // Since Run may result in Write being called, clear |user_write_callback_|
 988   // up front.
 989   if (rv > 0)
 990     was_ever_used_ = true;
 991   user_write_buf_ = NULL;
 992   user_write_buf_len_ = 0;
 993   base::ResetAndReturn(&user_write_callback_).Run(rv);
 994 }
 995
 996 bool SSLClientSocketOpenSSL::DoTransportIO() {
 997   bool network_moved = false;
 998   int rv;
 999   // Read and write as much data as possible. The loop is necessary because
1000   // Write() may return synchronously.
1001   do {
1002     rv = BufferSend();
1003     if (rv != ERR_IO_PENDING && rv != 0)
1004       network_moved = true;
1005   } while (rv > 0);
1006   if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING)
1007     network_moved = true;
1008   return network_moved;
1009 }
1010
1011 // TODO(cbentzel): Remove including "base/threading/thread_local.h" and
1012 // g_first_run_completed once crbug.com/424386 is fixed.
1013 base::LazyInstance<base::ThreadLocalBoolean>::Leaky g_first_run_completed =
1014     LAZY_INSTANCE_INITIALIZER;
1015
1016 int SSLClientSocketOpenSSL::DoHandshake() {
1017   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
1018
1019   int rv;
1020
1021   // TODO(cbentzel): Leave only 1 call to SSL_do_handshake once crbug.com/424386
1022   // is fixed.
1023   if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) {
1024     rv = SSL_do_handshake(ssl_);
1025   } else {
1026     if (g_first_run_completed.Get().Get()) {
1027       // TODO(cbentzel): Remove ScopedTracker below once crbug.com/424386 is
1028       // fixed.
1029       tracked_objects::ScopedTracker tracking_profile(
1030           FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 SSL_do_handshake()"));
1031
1032       rv = SSL_do_handshake(ssl_);
1033     } else {
1034       g_first_run_completed.Get().Set(true);
1035       rv = SSL_do_handshake(ssl_);
1036     }
1037   }
1038
1039   int net_error = OK;
1040   if (rv <= 0) {
1041     int ssl_error = SSL_get_error(ssl_, rv);
1042     if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) {
1043       // The server supports channel ID. Stop to look one up before returning to
1044       // the handshake.
1045       GotoState(STATE_CHANNEL_ID_LOOKUP);
1046       return OK;
1047     }
1048     if (ssl_error == SSL_ERROR_WANT_X509_LOOKUP &&
1049         !ssl_config_.send_client_cert) {
1050       return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
1051     }
1052     if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) {
1053       DCHECK(private_key_);
1054       DCHECK_NE(kNoPendingResult, signature_result_);
1055       GotoState(STATE_HANDSHAKE);
1056       return ERR_IO_PENDING;
1057     }
1058
1059     OpenSSLErrorInfo error_info;
1060     net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
1061     if (net_error == ERR_IO_PENDING) {
1062       // If not done, stay in this state
1063       GotoState(STATE_HANDSHAKE);
1064       return ERR_IO_PENDING;
1065     }
1066
1067     LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code "
1068                << ssl_error << ", net_error " << net_error;
1069     net_log_.AddEvent(
1070         NetLog::TYPE_SSL_HANDSHAKE_ERROR,
1071         CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
1072
1073     // Classify the handshake failure. This is used to determine causes of the
1074     // TLS version fallback.
1075
1076     // |cipher| is the current outgoing cipher suite, so it is non-null iff
1077     // ChangeCipherSpec was sent.
1078     const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_);
1079     if (SSL_get_state(ssl_) == SSL3_ST_CR_SRVR_HELLO_A) {
1080       ssl_failure_state_ = SSL_FAILURE_CLIENT_HELLO;
1081     } else if (cipher && (SSL_CIPHER_get_id(cipher) ==
1082                               TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 ||
1083                           SSL_CIPHER_get_id(cipher) ==
1084                               TLS1_CK_RSA_WITH_AES_128_GCM_SHA256)) {
1085       ssl_failure_state_ = SSL_FAILURE_BUGGY_GCM;
1086     } else if (cipher && ssl_config_.send_client_cert) {
1087       ssl_failure_state_ = SSL_FAILURE_CLIENT_AUTH;
1088     } else if (ERR_GET_LIB(error_info.error_code) == ERR_LIB_SSL &&
1089                ERR_GET_REASON(error_info.error_code) ==
1090                    SSL_R_OLD_SESSION_VERSION_NOT_RETURNED) {
1091       ssl_failure_state_ = SSL_FAILURE_SESSION_MISMATCH;
1092     } else if (cipher && npn_status_ != kNextProtoUnsupported) {
1093       ssl_failure_state_ = SSL_FAILURE_NEXT_PROTO;
1094     } else {
1095       ssl_failure_state_ = SSL_FAILURE_UNKNOWN;
1096     }
1097   }
1098
1099   GotoState(STATE_HANDSHAKE_COMPLETE);
1100   return net_error;
1101 }
1102
1103 int SSLClientSocketOpenSSL::DoHandshakeComplete(int result) {
1104   if (result < 0)
1105     return result;
1106
1107   if (ssl_config_.version_fallback &&
1108       ssl_config_.version_max < ssl_config_.version_fallback_min) {
1109     return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION;
1110   }
1111
1112   // SSL handshake is completed. If NPN wasn't negotiated, see if ALPN was.
1113   if (npn_status_ == kNextProtoUnsupported) {
1114     const uint8_t* alpn_proto = NULL;
1115     unsigned alpn_len = 0;
1116     SSL_get0_alpn_selected(ssl_, &alpn_proto, &alpn_len);
1117     if (alpn_len > 0) {
1118       npn_proto_.assign(reinterpret_cast<const char*>(alpn_proto), alpn_len);
1119       npn_status_ = kNextProtoNegotiated;
1120       set_negotiation_extension(kExtensionALPN);
1121     }
1122   }
1123
1124   RecordNegotiationExtension();
1125   RecordChannelIDSupport(channel_id_service_, channel_id_sent_,
1126                          ssl_config_.channel_id_enabled,
1127                          crypto::ECPrivateKey::IsSupported());
1128
1129   // Only record OCSP histograms if OCSP was requested.
1130   if (ssl_config_.signed_cert_timestamps_enabled ||
1131       cert_verifier_->SupportsOCSPStapling()) {
1132     const uint8_t* ocsp_response;
1133     size_t ocsp_response_len;
1134     SSL_get0_ocsp_response(ssl_, &ocsp_response, &ocsp_response_len);
1135
1136     set_stapled_ocsp_response_received(ocsp_response_len != 0);
1137     UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_response_len != 0);
1138   }
1139
1140   const uint8_t* sct_list;
1141   size_t sct_list_len;
1142   SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len);
1143   set_signed_cert_timestamps_received(sct_list_len != 0);
1144
1145   if (IsRenegotiationAllowed())
1146     SSL_set_reject_peer_renegotiations(ssl_, 0);
1147
1148   // Verify the certificate.
1149   UpdateServerCert();
1150   GotoState(STATE_VERIFY_CERT);
1151   return OK;
1152 }
1153
1154 int SSLClientSocketOpenSSL::DoChannelIDLookup() {
1155   net_log_.AddEvent(NetLog::TYPE_SSL_CHANNEL_ID_REQUESTED);
1156   GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE);
1157   return channel_id_service_->GetOrCreateChannelID(
1158       host_and_port_.host(), &channel_id_key_,
1159       base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete,
1160                  base::Unretained(this)),
1161       &channel_id_request_);
1162 }
1163
1164 int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) {
1165   if (result < 0)
1166     return result;
1167
1168   if (!channel_id_key_) {
1169     LOG(ERROR) << "Failed to import Channel ID.";
1170     return ERR_CHANNEL_ID_IMPORT_FAILED;
1171   }
1172
1173   // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key
1174   // type.
1175   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
1176   int rv = SSL_set1_tls_channel_id(ssl_, channel_id_key_->key());
1177   if (!rv) {
1178     LOG(ERROR) << "Failed to set Channel ID.";
1179     int err = SSL_get_error(ssl_, rv);
1180     return MapOpenSSLError(err, err_tracer);
1181   }
1182
1183   // Return to the handshake.
1184   channel_id_sent_ = true;
1185   net_log_.AddEvent(NetLog::TYPE_SSL_CHANNEL_ID_PROVIDED);
1186   GotoState(STATE_HANDSHAKE);
1187   return OK;
1188 }
1189
1190 int SSLClientSocketOpenSSL::DoVerifyCert(int result) {
1191   DCHECK(!server_cert_chain_->empty());
1192   DCHECK(start_cert_verification_time_.is_null());
1193
1194   GotoState(STATE_VERIFY_CERT_COMPLETE);
1195
1196   // OpenSSL decoded the certificate, but the platform certificate
1197   // implementation could not. This is treated as a fatal SSL-level protocol
1198   // error rather than a certificate error. See https://crbug.com/91341.
1199   if (!server_cert_.get())
1200     return ERR_SSL_SERVER_CERT_BAD_FORMAT;
1201
1202   // If the certificate is bad and has been previously accepted, use
1203   // the previous status and bypass the error.
1204   base::StringPiece der_cert;
1205   if (!x509_util::GetDER(server_cert_chain_->Get(0), &der_cert)) {
1206     NOTREACHED();
1207     return ERR_CERT_INVALID;
1208   }
1209   CertStatus cert_status;
1210   if (ssl_config_.IsAllowedBadCert(der_cert, &cert_status)) {
1211     VLOG(1) << "Received an expected bad cert with status: " << cert_status;
1212     server_cert_verify_result_.Reset();
1213     server_cert_verify_result_.cert_status = cert_status;
1214     server_cert_verify_result_.verified_cert = server_cert_;
1215     return OK;
1216   }
1217
1218   std::string ocsp_response;
1219   if (cert_verifier_->SupportsOCSPStapling()) {
1220     const uint8_t* ocsp_response_raw;
1221     size_t ocsp_response_len;
1222     SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len);
1223     ocsp_response.assign(reinterpret_cast<const char*>(ocsp_response_raw),
1224                          ocsp_response_len);
1225   }
1226
1227   start_cert_verification_time_ = base::TimeTicks::Now();
1228
1229   return cert_verifier_->Verify(
1230       server_cert_.get(), host_and_port_.host(), ocsp_response,
1231       ssl_config_.GetCertVerifyFlags(),
1232       // TODO(davidben): Route the CRLSet through SSLConfig so
1233       // SSLClientSocket doesn't depend on SSLConfigService.
1234       SSLConfigService::GetCRLSet().get(), &server_cert_verify_result_,
1235       base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete,
1236                  base::Unretained(this)),
1237       &cert_verifier_request_, net_log_);
1238 }
1239
1240 int SSLClientSocketOpenSSL::DoVerifyCertComplete(int result) {
1241   cert_verifier_request_.reset();
1242
1243   if (!start_cert_verification_time_.is_null()) {
1244     base::TimeDelta verify_time =
1245         base::TimeTicks::Now() - start_cert_verification_time_;
1246     if (result == OK) {
1247       UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTime", verify_time);
1248     } else {
1249       UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTimeError", verify_time);
1250     }
1251   }
1252
1253   if (result == OK) {
1254     if (SSL_session_reused(ssl_)) {
1255       // Record whether or not the server tried to resume a session for a
1256       // different version. See https://crbug.com/441456.
1257       UMA_HISTOGRAM_BOOLEAN(
1258           "Net.SSLSessionVersionMatch",
1259           SSL_version(ssl_) == SSL_get_session(ssl_)->ssl_version);
1260     }
1261   }
1262
1263   const CertStatus cert_status = server_cert_verify_result_.cert_status;
1264   if (transport_security_state_ &&
1265       (result == OK ||
1266        (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
1267       !transport_security_state_->CheckPublicKeyPins(
1268           host_and_port_, server_cert_verify_result_.is_issued_by_known_root,
1269           server_cert_verify_result_.public_key_hashes, server_cert_.get(),
1270           server_cert_verify_result_.verified_cert.get(),
1271           TransportSecurityState::ENABLE_PIN_REPORTS, &pinning_failure_log_)) {
1272     result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
1273   }
1274
1275   if (result == OK) {
1276     // Only check Certificate Transparency if there were no other errors with
1277     // the connection.
1278     VerifyCT();
1279
1280     DCHECK(!certificate_verified_);
1281     certificate_verified_ = true;
1282     MaybeCacheSession();
1283   } else {
1284     DVLOG(1) << "DoVerifyCertComplete error " << ErrorToString(result)
1285              << " (" << result << ")";
1286   }
1287
1288   completed_connect_ = true;
1289   // Exit DoHandshakeLoop and return the result to the caller to Connect.
1290   DCHECK_EQ(STATE_NONE, next_handshake_state_);
1291   return result;
1292 }
1293
1294 void SSLClientSocketOpenSSL::DoConnectCallback(int rv) {
1295   if (!user_connect_callback_.is_null()) {
1296     CompletionCallback c = user_connect_callback_;
1297     user_connect_callback_.Reset();
1298     c.Run(rv > OK ? OK : rv);
1299   }
1300 }
1301
1302 void SSLClientSocketOpenSSL::UpdateServerCert() {
1303   server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_));
1304   server_cert_ = server_cert_chain_->AsOSChain();
1305   if (server_cert_.get()) {
1306     net_log_.AddEvent(
1307         NetLog::TYPE_SSL_CERTIFICATES_RECEIVED,
1308         base::Bind(&NetLogX509CertificateCallback,
1309                    base::Unretained(server_cert_.get())));
1310   }
1311 }
1312
1313 void SSLClientSocketOpenSSL::VerifyCT() {
1314   if (!cert_transparency_verifier_)
1315     return;
1316
1317   const uint8_t* ocsp_response_raw;
1318   size_t ocsp_response_len;
1319   SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len);
1320   std::string ocsp_response;
1321   if (ocsp_response_len > 0) {
1322     ocsp_response.assign(reinterpret_cast<const char*>(ocsp_response_raw),
1323                          ocsp_response_len);
1324   }
1325
1326   const uint8_t* sct_list_raw;
1327   size_t sct_list_len;
1328   SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list_raw, &sct_list_len);
1329   std::string sct_list;
1330   if (sct_list_len > 0)
1331     sct_list.assign(reinterpret_cast<const char*>(sct_list_raw), sct_list_len);
1332
1333   // Note that this is a completely synchronous operation: The CT Log Verifier
1334   // gets all the data it needs for SCT verification and does not do any
1335   // external communication.
1336   cert_transparency_verifier_->Verify(
1337       server_cert_verify_result_.verified_cert.get(), ocsp_response, sct_list,
1338       &ct_verify_result_, net_log_);
1339
1340   if (policy_enforcer_ &&
1341       (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV)) {
1342     scoped_refptr<ct::EVCertsWhitelist> ev_whitelist =
1343         SSLConfigService::GetEVCertsWhitelist();
1344     if (!policy_enforcer_->DoesConformToCTEVPolicy(
1345             server_cert_verify_result_.verified_cert.get(), ev_whitelist.get(),
1346             ct_verify_result_, net_log_)) {
1347       // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766
1348       VLOG(1) << "EV certificate for "
1349               << server_cert_verify_result_.verified_cert->subject()
1350                      .GetDisplayName()
1351               << " does not conform to CT policy, removing EV status.";
1352       server_cert_verify_result_.cert_status |=
1353           CERT_STATUS_CT_COMPLIANCE_FAILED;
1354       server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV;
1355     }
1356   }
1357 }
1358
1359 void SSLClientSocketOpenSSL::OnHandshakeIOComplete(int result) {
1360   int rv = DoHandshakeLoop(result);
1361   if (rv != ERR_IO_PENDING) {
1362     net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
1363     DoConnectCallback(rv);
1364   }
1365 }
1366
1367 void SSLClientSocketOpenSSL::OnSendComplete(int result) {
1368   if (next_handshake_state_ == STATE_HANDSHAKE) {
1369     // In handshake phase.
1370     OnHandshakeIOComplete(result);
1371     return;
1372   }
1373
1374   // During a renegotiation, a Read call may also be blocked on a transport
1375   // write, so retry both operations.
1376   PumpReadWriteEvents();
1377 }
1378
1379 void SSLClientSocketOpenSSL::OnRecvComplete(int result) {
1380   if (next_handshake_state_ == STATE_HANDSHAKE) {
1381     // In handshake phase.
1382     OnHandshakeIOComplete(result);
1383     return;
1384   }
1385
1386   // Network layer received some data, check if client requested to read
1387   // decrypted data.
1388   if (!user_read_buf_.get())
1389     return;
1390
1391   int rv = DoReadLoop();
1392   if (rv != ERR_IO_PENDING)
1393     DoReadCallback(rv);
1394 }
1395
1396 int SSLClientSocketOpenSSL::DoHandshakeLoop(int last_io_result) {
1397   int rv = last_io_result;
1398   do {
1399     // Default to STATE_NONE for next state.
1400     // (This is a quirk carried over from the windows
1401     // implementation.  It makes reading the logs a bit harder.)
1402     // State handlers can and often do call GotoState just
1403     // to stay in the current state.
1404     State state = next_handshake_state_;
1405     GotoState(STATE_NONE);
1406     switch (state) {
1407       case STATE_HANDSHAKE:
1408         rv = DoHandshake();
1409         break;
1410       case STATE_HANDSHAKE_COMPLETE:
1411         rv = DoHandshakeComplete(rv);
1412         break;
1413       case STATE_CHANNEL_ID_LOOKUP:
1414         DCHECK_EQ(OK, rv);
1415         rv = DoChannelIDLookup();
1416        break;
1417       case STATE_CHANNEL_ID_LOOKUP_COMPLETE:
1418         rv = DoChannelIDLookupComplete(rv);
1419         break;
1420       case STATE_VERIFY_CERT:
1421         DCHECK_EQ(OK, rv);
1422         rv = DoVerifyCert(rv);
1423        break;
1424       case STATE_VERIFY_CERT_COMPLETE:
1425         rv = DoVerifyCertComplete(rv);
1426         break;
1427       case STATE_NONE:
1428       default:
1429         rv = ERR_UNEXPECTED;
1430         NOTREACHED() << "unexpected state" << state;
1431         break;
1432     }
1433
1434     bool network_moved = DoTransportIO();
1435     if (network_moved && next_handshake_state_ == STATE_HANDSHAKE) {
1436       // In general we exit the loop if rv is ERR_IO_PENDING.  In this
1437       // special case we keep looping even if rv is ERR_IO_PENDING because
1438       // the transport IO may allow DoHandshake to make progress.
1439       rv = OK;  // This causes us to stay in the loop.
1440     }
1441   } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE);
1442   return rv;
1443 }
1444
1445 int SSLClientSocketOpenSSL::DoReadLoop() {
1446   bool network_moved;
1447   int rv;
1448   do {
1449     rv = DoPayloadRead();
1450     network_moved = DoTransportIO();
1451   } while (rv == ERR_IO_PENDING && network_moved);
1452
1453   return rv;
1454 }
1455
1456 int SSLClientSocketOpenSSL::DoWriteLoop() {
1457   bool network_moved;
1458   int rv;
1459   do {
1460     rv = DoPayloadWrite();
1461     network_moved = DoTransportIO();
1462   } while (rv == ERR_IO_PENDING && network_moved);
1463
1464   return rv;
1465 }
1466
1467 int SSLClientSocketOpenSSL::DoPayloadRead() {
1468   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
1469
1470   DCHECK_LT(0, user_read_buf_len_);
1471   DCHECK(user_read_buf_.get());
1472
1473   int rv;
1474   if (pending_read_error_ != kNoPendingResult) {
1475     rv = pending_read_error_;
1476     pending_read_error_ = kNoPendingResult;
1477     if (rv == 0) {
1478       net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED,
1479                                     rv, user_read_buf_->data());
1480     } else {
1481       net_log_.AddEvent(
1482           NetLog::TYPE_SSL_READ_ERROR,
1483           CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_,
1484                                            pending_read_error_info_));
1485     }
1486     pending_read_ssl_error_ = SSL_ERROR_NONE;
1487     pending_read_error_info_ = OpenSSLErrorInfo();
1488     return rv;
1489   }
1490
1491   int total_bytes_read = 0;
1492   int ssl_ret;
1493   do {
1494     ssl_ret = SSL_read(ssl_, user_read_buf_->data() + total_bytes_read,
1495                        user_read_buf_len_ - total_bytes_read);
1496     if (ssl_ret > 0)
1497       total_bytes_read += ssl_ret;
1498   } while (total_bytes_read < user_read_buf_len_ && ssl_ret > 0);
1499
1500   // Although only the final SSL_read call may have failed, the failure needs to
1501   // processed immediately, while the information still available in OpenSSL's
1502   // error queue.
1503   if (ssl_ret <= 0) {
1504     // A zero return from SSL_read may mean any of:
1505     // - The underlying BIO_read returned 0.
1506     // - The peer sent a close_notify.
1507     // - Any arbitrary error. https://crbug.com/466303
1508     //
1509     // TransportReadComplete converts the first to an ERR_CONNECTION_CLOSED
1510     // error, so it does not occur. The second and third are distinguished by
1511     // SSL_ERROR_ZERO_RETURN.
1512     pending_read_ssl_error_ = SSL_get_error(ssl_, ssl_ret);
1513     if (pending_read_ssl_error_ == SSL_ERROR_ZERO_RETURN) {
1514       pending_read_error_ = 0;
1515     } else if (pending_read_ssl_error_ == SSL_ERROR_WANT_X509_LOOKUP &&
1516                !ssl_config_.send_client_cert) {
1517       pending_read_error_ = ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
1518     } else if (pending_read_ssl_error_ ==
1519                SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) {
1520       DCHECK(private_key_);
1521       DCHECK_NE(kNoPendingResult, signature_result_);
1522       pending_read_error_ = ERR_IO_PENDING;
1523     } else {
1524       pending_read_error_ = MapOpenSSLErrorWithDetails(
1525           pending_read_ssl_error_, err_tracer, &pending_read_error_info_);
1526     }
1527
1528     // Many servers do not reliably send a close_notify alert when shutting down
1529     // a connection, and instead terminate the TCP connection. This is reported
1530     // as ERR_CONNECTION_CLOSED. Because of this, map the unclean shutdown to a
1531     // graceful EOF, instead of treating it as an error as it should be.
1532     if (pending_read_error_ == ERR_CONNECTION_CLOSED)
1533       pending_read_error_ = 0;
1534   }
1535
1536   if (total_bytes_read > 0) {
1537     // Return any bytes read to the caller. The error will be deferred to the
1538     // next call of DoPayloadRead.
1539     rv = total_bytes_read;
1540
1541     // Do not treat insufficient data as an error to return in the next call to
1542     // DoPayloadRead() - instead, let the call fall through to check SSL_read()
1543     // again. This is because DoTransportIO() may complete in between the next
1544     // call to DoPayloadRead(), and thus it is important to check SSL_read() on
1545     // subsequent invocations to see if a complete record may now be read.
1546     if (pending_read_error_ == ERR_IO_PENDING)
1547       pending_read_error_ = kNoPendingResult;
1548   } else {
1549     // No bytes were returned. Return the pending read error immediately.
1550     DCHECK_NE(kNoPendingResult, pending_read_error_);
1551     rv = pending_read_error_;
1552     pending_read_error_ = kNoPendingResult;
1553   }
1554
1555   if (rv >= 0) {
1556     net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, rv,
1557                                   user_read_buf_->data());
1558   } else if (rv != ERR_IO_PENDING) {
1559     net_log_.AddEvent(
1560         NetLog::TYPE_SSL_READ_ERROR,
1561         CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_,
1562                                          pending_read_error_info_));
1563     pending_read_ssl_error_ = SSL_ERROR_NONE;
1564     pending_read_error_info_ = OpenSSLErrorInfo();
1565   }
1566   return rv;
1567 }
1568
1569 int SSLClientSocketOpenSSL::DoPayloadWrite() {
1570   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
1571   int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_);
1572
1573   if (rv >= 0) {
1574     net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv,
1575                                   user_write_buf_->data());
1576     return rv;
1577   }
1578
1579   int ssl_error = SSL_get_error(ssl_, rv);
1580   if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION)
1581     return ERR_IO_PENDING;
1582   OpenSSLErrorInfo error_info;
1583   int net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer,
1584                                              &error_info);
1585
1586   if (net_error != ERR_IO_PENDING) {
1587     net_log_.AddEvent(
1588         NetLog::TYPE_SSL_WRITE_ERROR,
1589         CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
1590   }
1591   return net_error;
1592 }
1593
1594 void SSLClientSocketOpenSSL::PumpReadWriteEvents() {
1595   int rv_read = ERR_IO_PENDING;
1596   int rv_write = ERR_IO_PENDING;
1597   bool network_moved;
1598   do {
1599     if (user_read_buf_.get())
1600       rv_read = DoPayloadRead();
1601     if (user_write_buf_.get())
1602       rv_write = DoPayloadWrite();
1603     network_moved = DoTransportIO();
1604   } while (rv_read == ERR_IO_PENDING && rv_write == ERR_IO_PENDING &&
1605            (user_read_buf_.get() || user_write_buf_.get()) && network_moved);
1606
1607   // Performing the Read callback may cause |this| to be deleted. If this
1608   // happens, the Write callback should not be invoked. Guard against this by
1609   // holding a WeakPtr to |this| and ensuring it's still valid.
1610   base::WeakPtr<SSLClientSocketOpenSSL> guard(weak_factory_.GetWeakPtr());
1611   if (user_read_buf_.get() && rv_read != ERR_IO_PENDING)
1612     DoReadCallback(rv_read);
1613
1614   if (!guard.get())
1615     return;
1616
1617   if (user_write_buf_.get() && rv_write != ERR_IO_PENDING)
1618     DoWriteCallback(rv_write);
1619 }
1620
1621 int SSLClientSocketOpenSSL::BufferSend(void) {
1622   if (transport_send_busy_)
1623     return ERR_IO_PENDING;
1624
1625   size_t buffer_read_offset;
1626   uint8_t* read_buf;
1627   size_t max_read;
1628   int status = BIO_zero_copy_get_read_buf(transport_bio_, &read_buf,
1629                                           &buffer_read_offset, &max_read);
1630   DCHECK_EQ(status, 1);  // Should never fail.
1631   if (!max_read)
1632     return 0;  // Nothing pending in the OpenSSL write BIO.
1633   CHECK_EQ(read_buf, reinterpret_cast<uint8_t*>(send_buffer_->StartOfBuffer()));
1634   CHECK_LT(buffer_read_offset, static_cast<size_t>(send_buffer_->capacity()));
1635   send_buffer_->set_offset(buffer_read_offset);
1636
1637   int rv = transport_->socket()->Write(
1638       send_buffer_.get(), max_read,
1639       base::Bind(&SSLClientSocketOpenSSL::BufferSendComplete,
1640                  base::Unretained(this)));
1641   if (rv == ERR_IO_PENDING) {
1642     transport_send_busy_ = true;
1643   } else {
1644     TransportWriteComplete(rv);
1645   }
1646   return rv;
1647 }
1648
1649 int SSLClientSocketOpenSSL::BufferRecv(void) {
1650   if (transport_recv_busy_)
1651     return ERR_IO_PENDING;
1652
1653   // Determine how much was requested from |transport_bio_| that was not
1654   // actually available.
1655   size_t requested = BIO_ctrl_get_read_request(transport_bio_);
1656   if (requested == 0) {
1657     // This is not a perfect match of error codes, as no operation is
1658     // actually pending. However, returning 0 would be interpreted as
1659     // a possible sign of EOF, which is also an inappropriate match.
1660     return ERR_IO_PENDING;
1661   }
1662
1663   // Known Issue: While only reading |requested| data is the more correct
1664   // implementation, it has the downside of resulting in frequent reads:
1665   // One read for the SSL record header (~5 bytes) and one read for the SSL
1666   // record body. Rather than issuing these reads to the underlying socket
1667   // (and constantly allocating new IOBuffers), a single Read() request to
1668   // fill |transport_bio_| is issued. As long as an SSL client socket cannot
1669   // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL
1670   // traffic, this over-subscribed Read()ing will not cause issues.
1671
1672   size_t buffer_write_offset;
1673   uint8_t* write_buf;
1674   size_t max_write;
1675   int status = BIO_zero_copy_get_write_buf(transport_bio_, &write_buf,
1676                                            &buffer_write_offset, &max_write);
1677   DCHECK_EQ(status, 1);  // Should never fail.
1678   if (!max_write)
1679     return ERR_IO_PENDING;
1680
1681   CHECK_EQ(write_buf,
1682            reinterpret_cast<uint8_t*>(recv_buffer_->StartOfBuffer()));
1683   CHECK_LT(buffer_write_offset, static_cast<size_t>(recv_buffer_->capacity()));
1684
1685   recv_buffer_->set_offset(buffer_write_offset);
1686   int rv = transport_->socket()->Read(
1687       recv_buffer_.get(),
1688       max_write,
1689       base::Bind(&SSLClientSocketOpenSSL::BufferRecvComplete,
1690                  base::Unretained(this)));
1691   if (rv == ERR_IO_PENDING) {
1692     transport_recv_busy_ = true;
1693   } else {
1694     rv = TransportReadComplete(rv);
1695   }
1696   return rv;
1697 }
1698
1699 void SSLClientSocketOpenSSL::BufferSendComplete(int result) {
1700   TransportWriteComplete(result);
1701   OnSendComplete(result);
1702 }
1703
1704 void SSLClientSocketOpenSSL::BufferRecvComplete(int result) {
1705   result = TransportReadComplete(result);
1706   OnRecvComplete(result);
1707 }
1708
1709 void SSLClientSocketOpenSSL::TransportWriteComplete(int result) {
1710   DCHECK(ERR_IO_PENDING != result);
1711   int bytes_written = 0;
1712   if (result < 0) {
1713     // Record the error. Save it to be reported in a future read or write on
1714     // transport_bio_'s peer.
1715     transport_write_error_ = result;
1716   } else {
1717     bytes_written = result;
1718   }
1719   DCHECK_GE(send_buffer_->RemainingCapacity(), bytes_written);
1720   int ret = BIO_zero_copy_get_read_buf_done(transport_bio_, bytes_written);
1721   DCHECK_EQ(1, ret);
1722   transport_send_busy_ = false;
1723 }
1724
1725 int SSLClientSocketOpenSSL::TransportReadComplete(int result) {
1726   DCHECK(ERR_IO_PENDING != result);
1727   // If an EOF, canonicalize to ERR_CONNECTION_CLOSED here so MapOpenSSLError
1728   // does not report success.
1729   if (result == 0)
1730     result = ERR_CONNECTION_CLOSED;
1731   int bytes_read = 0;
1732   if (result < 0) {
1733     DVLOG(1) << "TransportReadComplete result " << result;
1734     // Received an error. Save it to be reported in a future read on
1735     // transport_bio_'s peer.
1736     transport_read_error_ = result;
1737   } else {
1738     bytes_read = result;
1739   }
1740   DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read);
1741   int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read);
1742   DCHECK_EQ(1, ret);
1743   transport_recv_busy_ = false;
1744   return result;
1745 }
1746
1747 int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) {
1748   DVLOG(3) << "OpenSSL ClientCertRequestCallback called";
1749   DCHECK(ssl == ssl_);
1750
1751   net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED);
1752
1753   // Clear any currently configured certificates.
1754   SSL_certs_clear(ssl_);
1755
1756 #if defined(OS_IOS)
1757   // TODO(droger): Support client auth on iOS. See http://crbug.com/145954).
1758   LOG(WARNING) << "Client auth is not supported";
1759 #else  // !defined(OS_IOS)
1760   if (!ssl_config_.send_client_cert) {
1761     // First pass: we know that a client certificate is needed, but we do not
1762     // have one at hand.
1763     STACK_OF(X509_NAME) *authorities = SSL_get_client_CA_list(ssl);
1764     for (size_t i = 0; i < sk_X509_NAME_num(authorities); i++) {
1765       X509_NAME *ca_name = (X509_NAME *)sk_X509_NAME_value(authorities, i);
1766       unsigned char* str = NULL;
1767       int length = i2d_X509_NAME(ca_name, &str);
1768       cert_authorities_.push_back(std::string(
1769           reinterpret_cast<const char*>(str),
1770           static_cast<size_t>(length)));
1771       OPENSSL_free(str);
1772     }
1773
1774     const unsigned char* client_cert_types;
1775     size_t num_client_cert_types =
1776         SSL_get0_certificate_types(ssl, &client_cert_types);
1777     for (size_t i = 0; i < num_client_cert_types; i++) {
1778       cert_key_types_.push_back(
1779           static_cast<SSLClientCertType>(client_cert_types[i]));
1780     }
1781
1782     // Suspends handshake. SSL_get_error will return SSL_ERROR_WANT_X509_LOOKUP.
1783     return -1;
1784   }
1785
1786   // Second pass: a client certificate should have been selected.
1787   if (ssl_config_.client_cert.get()) {
1788     ScopedX509 leaf_x509 =
1789         OSCertHandleToOpenSSL(ssl_config_.client_cert->os_cert_handle());
1790     if (!leaf_x509) {
1791       LOG(WARNING) << "Failed to import certificate";
1792       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
1793       return -1;
1794     }
1795
1796     ScopedX509Stack chain = OSCertHandlesToOpenSSL(
1797         ssl_config_.client_cert->GetIntermediateCertificates());
1798     if (!chain) {
1799       LOG(WARNING) << "Failed to import intermediate certificates";
1800       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
1801       return -1;
1802     }
1803
1804     if (!SSL_use_certificate(ssl_, leaf_x509.get()) ||
1805         !SSL_set1_chain(ssl_, chain.get())) {
1806       LOG(WARNING) << "Failed to set client certificate";
1807       return -1;
1808     }
1809
1810 #if defined(OS_NACL)
1811       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY);
1812       return -1;
1813 #else
1814     // TODO(davidben): Lift this call up to the embedder so we can actually test
1815     // this code. https://crbug.com/394131
1816     private_key_ = FetchClientCertPrivateKey(
1817         ssl_config_.client_cert.get(),
1818         g_platform_key_task_runner.Get().task_runner());
1819     if (!private_key_) {
1820       // Could not find the private key. Fail the handshake and surface an
1821       // appropriate error to the caller.
1822       LOG(WARNING) << "Client cert found without private key";
1823       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY);
1824       return -1;
1825     }
1826
1827     SSL_set_private_key_method(ssl_, &SSLContext::kPrivateKeyMethod);
1828 #endif
1829
1830     int cert_count = 1 + sk_X509_num(chain.get());
1831     net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED,
1832                       NetLog::IntegerCallback("cert_count", cert_count));
1833     return 1;
1834   }
1835 #endif  // defined(OS_IOS)
1836
1837   // Send no client certificate.
1838   net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED,
1839                     NetLog::IntegerCallback("cert_count", 0));
1840   return 1;
1841 }
1842
1843 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
1844   if (!completed_connect_) {
1845     // If the first handshake hasn't completed then we accept any certificates
1846     // because we verify after the handshake.
1847     return 1;
1848   }
1849
1850   // Disallow the server certificate to change in a renegotiation.
1851   if (server_cert_chain_->empty()) {
1852     LOG(ERROR) << "Received invalid certificate chain between handshakes";
1853     return 0;
1854   }
1855   base::StringPiece old_der, new_der;
1856   if (store_ctx->cert == NULL ||
1857       !x509_util::GetDER(server_cert_chain_->Get(0), &old_der) ||
1858       !x509_util::GetDER(store_ctx->cert, &new_der)) {
1859     LOG(ERROR) << "Failed to encode certificates";
1860     return 0;
1861   }
1862   if (old_der != new_der) {
1863     LOG(ERROR) << "Server certificate changed between handshakes";
1864     return 0;
1865   }
1866
1867   return 1;
1868 }
1869
1870 // SelectNextProtoCallback is called by OpenSSL during the handshake. If the
1871 // server supports NPN, selects a protocol from the list that the server
1872 // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the
1873 // callback can assume that |in| is syntactically valid.
1874 int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out,
1875                                                     unsigned char* outlen,
1876                                                     const unsigned char* in,
1877                                                     unsigned int inlen) {
1878   if (ssl_config_.next_protos.empty()) {
1879     *out = reinterpret_cast<uint8*>(
1880         const_cast<char*>(kDefaultSupportedNPNProtocol));
1881     *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1;
1882     npn_status_ = kNextProtoUnsupported;
1883     return SSL_TLSEXT_ERR_OK;
1884   }
1885
1886   // Assume there's no overlap between our protocols and the server's list.
1887   npn_status_ = kNextProtoNoOverlap;
1888
1889   // For each protocol in server preference order, see if we support it.
1890   for (unsigned int i = 0; i < inlen; i += in[i] + 1) {
1891     for (NextProto next_proto : ssl_config_.next_protos) {
1892       const std::string proto = NextProtoToString(next_proto);
1893       if (in[i] == proto.size() &&
1894           memcmp(&in[i + 1], proto.data(), in[i]) == 0) {
1895         // We found a match.
1896         *out = const_cast<unsigned char*>(in) + i + 1;
1897         *outlen = in[i];
1898         npn_status_ = kNextProtoNegotiated;
1899         break;
1900       }
1901     }
1902     if (npn_status_ == kNextProtoNegotiated)
1903       break;
1904   }
1905
1906   // If we didn't find a protocol, we select the first one from our list.
1907   if (npn_status_ == kNextProtoNoOverlap) {
1908     // NextProtoToString returns a pointer to a static string.
1909     const char* proto = NextProtoToString(ssl_config_.next_protos[0]);
1910     *out = reinterpret_cast<unsigned char*>(const_cast<char*>(proto));
1911     *outlen = strlen(proto);
1912   }
1913
1914   npn_proto_.assign(reinterpret_cast<const char*>(*out), *outlen);
1915   DVLOG(2) << "next protocol: '" << npn_proto_ << "' status: " << npn_status_;
1916   set_negotiation_extension(kExtensionNPN);
1917   return SSL_TLSEXT_ERR_OK;
1918 }
1919
1920 long SSLClientSocketOpenSSL::MaybeReplayTransportError(
1921     BIO *bio,
1922     int cmd,
1923     const char *argp, int argi, long argl,
1924     long retvalue) {
1925   if (cmd == (BIO_CB_READ|BIO_CB_RETURN) && retvalue <= 0) {
1926     // If there is no more data in the buffer, report any pending errors that
1927     // were observed. Note that both the readbuf and the writebuf are checked
1928     // for errors, since the application may have encountered a socket error
1929     // while writing that would otherwise not be reported until the application
1930     // attempted to write again - which it may never do. See
1931     // https://crbug.com/249848.
1932     if (transport_read_error_ != OK) {
1933       OpenSSLPutNetError(FROM_HERE, transport_read_error_);
1934       return -1;
1935     }
1936     if (transport_write_error_ != OK) {
1937       OpenSSLPutNetError(FROM_HERE, transport_write_error_);
1938       return -1;
1939     }
1940   } else if (cmd == BIO_CB_WRITE) {
1941     // Because of the write buffer, this reports a failure from the previous
1942     // write payload. If the current payload fails to write, the error will be
1943     // reported in a future write or read to |bio|.
1944     if (transport_write_error_ != OK) {
1945       OpenSSLPutNetError(FROM_HERE, transport_write_error_);
1946       return -1;
1947     }
1948   }
1949   return retvalue;
1950 }
1951
1952 // static
1953 long SSLClientSocketOpenSSL::BIOCallback(
1954     BIO *bio,
1955     int cmd,
1956     const char *argp, int argi, long argl,
1957     long retvalue) {
1958   SSLClientSocketOpenSSL* socket = reinterpret_cast<SSLClientSocketOpenSSL*>(
1959       BIO_get_callback_arg(bio));
1960   CHECK(socket);
1961   return socket->MaybeReplayTransportError(
1962       bio, cmd, argp, argi, argl, retvalue);
1963 }
1964
1965 void SSLClientSocketOpenSSL::MaybeCacheSession() {
1966   // Only cache the session once both a new session has been established and the
1967   // certificate has been verified. Due to False Start, these events may happen
1968   // in either order.
1969   if (!session_pending_ || !certificate_verified_)
1970     return;
1971
1972   SSLContext::GetInstance()->session_cache()->Insert(GetSessionCacheKey(),
1973                                                      SSL_get_session(ssl_));
1974   session_pending_ = false;
1975 }
1976
1977 int SSLClientSocketOpenSSL::NewSessionCallback(SSL_SESSION* session) {
1978   DCHECK_EQ(session, SSL_get_session(ssl_));
1979
1980   // Only sessions from the initial handshake get cached. Note this callback may
1981   // be signaled on abbreviated handshakes if the ticket was renewed.
1982   session_pending_ = true;
1983   MaybeCacheSession();
1984
1985   // OpenSSL passes a reference to |session|, but the session cache does not
1986   // take this reference, so release it.
1987   SSL_SESSION_free(session);
1988   return 1;
1989 }
1990
1991 void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const {
1992   for (ct::SCTList::const_iterator iter =
1993        ct_verify_result_.verified_scts.begin();
1994        iter != ct_verify_result_.verified_scts.end(); ++iter) {
1995     ssl_info->signed_certificate_timestamps.push_back(
1996         SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_OK));
1997   }
1998   for (ct::SCTList::const_iterator iter =
1999        ct_verify_result_.invalid_scts.begin();
2000        iter != ct_verify_result_.invalid_scts.end(); ++iter) {
2001     ssl_info->signed_certificate_timestamps.push_back(
2002         SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_INVALID));
2003   }
2004   for (ct::SCTList::const_iterator iter =
2005        ct_verify_result_.unknown_logs_scts.begin();
2006        iter != ct_verify_result_.unknown_logs_scts.end(); ++iter) {
2007     ssl_info->signed_certificate_timestamps.push_back(
2008         SignedCertificateTimestampAndStatus(*iter,
2009                                             ct::SCT_STATUS_LOG_UNKNOWN));
2010   }
2011 }
2012
2013 std::string SSLClientSocketOpenSSL::GetSessionCacheKey() const {
2014   std::string result = host_and_port_.ToString();
2015   result.append("/");
2016   result.append(ssl_session_cache_shard_);
2017
2018   // Shard the session cache based on maximum protocol version. This causes
2019   // fallback connections to use a separate session cache.
2020   result.append("/");
2021   switch (ssl_config_.version_max) {
2022     case SSL_PROTOCOL_VERSION_TLS1:
2023       result.append("tls1");
2024       break;
2025     case SSL_PROTOCOL_VERSION_TLS1_1:
2026       result.append("tls1.1");
2027       break;
2028     case SSL_PROTOCOL_VERSION_TLS1_2:
2029       result.append("tls1.2");
2030       break;
2031     default:
2032       NOTREACHED();
2033   }
2034
2035   result.append("/");
2036   if (ssl_config_.enable_deprecated_cipher_suites)
2037     result.append("deprecated");
2038
2039   return result;
2040 }
2041
2042 bool SSLClientSocketOpenSSL::IsRenegotiationAllowed() const {
2043   if (npn_status_ == kNextProtoUnsupported)
2044     return ssl_config_.renego_allowed_default;
2045
2046   NextProto next_proto = NextProtoFromString(npn_proto_);
2047   for (NextProto allowed : ssl_config_.renego_allowed_for_protos) {
2048     if (next_proto == allowed)
2049       return true;
2050   }
2051   return false;
2052 }
2053
2054 int SSLClientSocketOpenSSL::PrivateKeyTypeCallback() {
2055   switch (private_key_->GetType()) {
2056     case SSLPrivateKey::Type::RSA:
2057       return EVP_PKEY_RSA;
2058     case SSLPrivateKey::Type::ECDSA:
2059       return EVP_PKEY_EC;
2060   }
2061   NOTREACHED();
2062   return EVP_PKEY_NONE;
2063 }
2064
2065 int SSLClientSocketOpenSSL::PrivateKeySupportsDigestCallback(const EVP_MD* md) {
2066   SSLPrivateKey::Hash hash;
2067   return EVP_MDToPrivateKeyHash(md, &hash) && private_key_->SupportsHash(hash);
2068 }
2069
2070 size_t SSLClientSocketOpenSSL::PrivateKeyMaxSignatureLenCallback() {
2071   return private_key_->GetMaxSignatureLengthInBytes();
2072 }
2073
2074 ssl_private_key_result_t SSLClientSocketOpenSSL::PrivateKeySignCallback(
2075     uint8_t* out,
2076     size_t* out_len,
2077     size_t max_out,
2078     const EVP_MD* md,
2079     const uint8_t* in,
2080     size_t in_len) {
2081   DCHECK_EQ(kNoPendingResult, signature_result_);
2082   DCHECK(signature_.empty());
2083   DCHECK(private_key_);
2084
2085   net_log_.BeginEvent(NetLog::TYPE_SSL_PRIVATE_KEY_OPERATION);
2086
2087   SSLPrivateKey::Hash hash;
2088   if (!EVP_MDToPrivateKeyHash(md, &hash)) {
2089     OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
2090     return ssl_private_key_failure;
2091   }
2092
2093   signature_result_ = ERR_IO_PENDING;
2094   private_key_->SignDigest(
2095       hash, base::StringPiece(reinterpret_cast<const char*>(in), in_len),
2096       base::Bind(&SSLClientSocketOpenSSL::OnPrivateKeySignComplete,
2097                  weak_factory_.GetWeakPtr()));
2098   return ssl_private_key_retry;
2099 }
2100
2101 ssl_private_key_result_t SSLClientSocketOpenSSL::PrivateKeySignCompleteCallback(
2102     uint8_t* out,
2103     size_t* out_len,
2104     size_t max_out) {
2105   DCHECK_NE(kNoPendingResult, signature_result_);
2106   DCHECK(private_key_);
2107
2108   if (signature_result_ == ERR_IO_PENDING)
2109     return ssl_private_key_retry;
2110   if (signature_result_ != OK) {
2111     OpenSSLPutNetError(FROM_HERE, signature_result_);
2112     return ssl_private_key_failure;
2113   }
2114   if (signature_.size() > max_out) {
2115     OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
2116     return ssl_private_key_failure;
2117   }
2118   memcpy(out, vector_as_array(&signature_), signature_.size());
2119   *out_len = signature_.size();
2120   signature_.clear();
2121   return ssl_private_key_success;
2122 }
2123
2124 void SSLClientSocketOpenSSL::OnPrivateKeySignComplete(
2125     Error error,
2126     const std::vector<uint8_t>& signature) {
2127   DCHECK_EQ(ERR_IO_PENDING, signature_result_);
2128   DCHECK(signature_.empty());
2129   DCHECK(private_key_);
2130
2131   net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_PRIVATE_KEY_OPERATION,
2132                                     error);
2133
2134   signature_result_ = error;
2135   if (signature_result_ == OK)
2136     signature_ = signature;
2137
2138   if (next_handshake_state_ == STATE_HANDSHAKE) {
2139     OnHandshakeIOComplete(signature_result_);
2140     return;
2141   }
2142
2143   // During a renegotiation, either Read or Write calls may be blocked on an
2144   // asynchronous private key operation.
2145   PumpReadWriteEvents();
2146 }
2147
2148 }  // namespace net