net/socket/ssl_client_socket_pool.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/socket/ssl_client_socket_pool.h"
   6
   7 #include "base/bind.h"
   8 #include "base/bind_helpers.h"
   9 #include "base/metrics/field_trial.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/metrics/sparse_histogram.h"
  12 #include "base/profiler/scoped_tracker.h"
  13 #include "base/values.h"
  14 #include "net/base/host_port_pair.h"
  15 #include "net/base/net_errors.h"
  16 #include "net/http/http_proxy_client_socket.h"
  17 #include "net/http/http_proxy_client_socket_pool.h"
  18 #include "net/socket/client_socket_factory.h"
  19 #include "net/socket/client_socket_handle.h"
  20 #include "net/socket/socks_client_socket_pool.h"
  21 #include "net/socket/ssl_client_socket.h"
  22 #include "net/socket/transport_client_socket_pool.h"
  23 #include "net/ssl/ssl_cert_request_info.h"
  24 #include "net/ssl/ssl_connection_status_flags.h"
  25 #include "net/ssl/ssl_info.h"
  26
  27 namespace net {
  28
  29 SSLSocketParams::SSLSocketParams(
  30     const scoped_refptr<TransportSocketParams>& direct_params,
  31     const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
  32     const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
  33     const HostPortPair& host_and_port,
  34     const SSLConfig& ssl_config,
  35     PrivacyMode privacy_mode,
  36     int load_flags,
  37     bool want_spdy_over_npn)
  38     : direct_params_(direct_params),
  39       socks_proxy_params_(socks_proxy_params),
  40       http_proxy_params_(http_proxy_params),
  41       host_and_port_(host_and_port),
  42       ssl_config_(ssl_config),
  43       privacy_mode_(privacy_mode),
  44       load_flags_(load_flags),
  45       want_spdy_over_npn_(want_spdy_over_npn),
  46       ignore_limits_(false) {
  47   if (direct_params_.get()) {
  48     DCHECK(!socks_proxy_params_.get());
  49     DCHECK(!http_proxy_params_.get());
  50     ignore_limits_ = direct_params_->ignore_limits();
  51   } else if (socks_proxy_params_.get()) {
  52     DCHECK(!http_proxy_params_.get());
  53     ignore_limits_ = socks_proxy_params_->ignore_limits();
  54   } else {
  55     DCHECK(http_proxy_params_.get());
  56     ignore_limits_ = http_proxy_params_->ignore_limits();
  57   }
  58 }
  59
  60 SSLSocketParams::~SSLSocketParams() {}
  61
  62 SSLSocketParams::ConnectionType SSLSocketParams::GetConnectionType() const {
  63   if (direct_params_.get()) {
  64     DCHECK(!socks_proxy_params_.get());
  65     DCHECK(!http_proxy_params_.get());
  66     return DIRECT;
  67   }
  68
  69   if (socks_proxy_params_.get()) {
  70     DCHECK(!http_proxy_params_.get());
  71     return SOCKS_PROXY;
  72   }
  73
  74   DCHECK(http_proxy_params_.get());
  75   return HTTP_PROXY;
  76 }
  77
  78 const scoped_refptr<TransportSocketParams>&
  79 SSLSocketParams::GetDirectConnectionParams() const {
  80   DCHECK_EQ(GetConnectionType(), DIRECT);
  81   return direct_params_;
  82 }
  83
  84 const scoped_refptr<SOCKSSocketParams>&
  85 SSLSocketParams::GetSocksProxyConnectionParams() const {
  86   DCHECK_EQ(GetConnectionType(), SOCKS_PROXY);
  87   return socks_proxy_params_;
  88 }
  89
  90 const scoped_refptr<HttpProxySocketParams>&
  91 SSLSocketParams::GetHttpProxyConnectionParams() const {
  92   DCHECK_EQ(GetConnectionType(), HTTP_PROXY);
  93   return http_proxy_params_;
  94 }
  95
  96 // Timeout for the SSL handshake portion of the connect.
  97 static const int kSSLHandshakeTimeoutInSeconds = 30;
  98
  99 SSLConnectJob::SSLConnectJob(const std::string& group_name,
 100                              RequestPriority priority,
 101                              const scoped_refptr<SSLSocketParams>& params,
 102                              const base::TimeDelta& timeout_duration,
 103                              TransportClientSocketPool* transport_pool,
 104                              SOCKSClientSocketPool* socks_pool,
 105                              HttpProxyClientSocketPool* http_proxy_pool,
 106                              ClientSocketFactory* client_socket_factory,
 107                              const SSLClientSocketContext& context,
 108                              Delegate* delegate,
 109                              NetLog* net_log)
 110     : ConnectJob(group_name,
 111                  timeout_duration,
 112                  priority,
 113                  delegate,
 114                  BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
 115       params_(params),
 116       transport_pool_(transport_pool),
 117       socks_pool_(socks_pool),
 118       http_proxy_pool_(http_proxy_pool),
 119       client_socket_factory_(client_socket_factory),
 120       context_(context.cert_verifier,
 121                context.channel_id_service,
 122                context.transport_security_state,
 123                context.cert_transparency_verifier,
 124                context.cert_policy_enforcer,
 125                (params->privacy_mode() == PRIVACY_MODE_ENABLED
 126                     ? "pm/" + context.ssl_session_cache_shard
 127                     : context.ssl_session_cache_shard)),
 128       callback_(
 129           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))) {
 130 }
 131
 132 SSLConnectJob::~SSLConnectJob() {
 133 }
 134
 135 LoadState SSLConnectJob::GetLoadState() const {
 136   switch (next_state_) {
 137     case STATE_TUNNEL_CONNECT_COMPLETE:
 138       if (transport_socket_handle_->socket())
 139         return LOAD_STATE_ESTABLISHING_PROXY_TUNNEL;
 140       // else, fall through.
 141     case STATE_TRANSPORT_CONNECT:
 142     case STATE_TRANSPORT_CONNECT_COMPLETE:
 143     case STATE_SOCKS_CONNECT:
 144     case STATE_SOCKS_CONNECT_COMPLETE:
 145     case STATE_TUNNEL_CONNECT:
 146       return transport_socket_handle_->GetLoadState();
 147     case STATE_SSL_CONNECT:
 148     case STATE_SSL_CONNECT_COMPLETE:
 149       return LOAD_STATE_SSL_HANDSHAKE;
 150     default:
 151       NOTREACHED();
 152       return LOAD_STATE_IDLE;
 153   }
 154 }
 155
 156 void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle* handle) {
 157   // Headers in |error_response_info_| indicate a proxy tunnel setup
 158   // problem. See DoTunnelConnectComplete.
 159   if (error_response_info_.headers.get()) {
 160     handle->set_pending_http_proxy_connection(
 161         transport_socket_handle_.release());
 162   }
 163   handle->set_ssl_error_response_info(error_response_info_);
 164   if (!connect_timing_.ssl_start.is_null())
 165     handle->set_is_ssl_error(true);
 166 }
 167
 168 void SSLConnectJob::OnIOComplete(int result) {
 169   // TODO(pkasting): Remove ScopedTracker below once crbug.com/455884 is fixed.
 170   tracked_objects::ScopedTracker tracking_profile(
 171       FROM_HERE_WITH_EXPLICIT_FUNCTION("455884 SSLConnectJob::OnIOComplete"));
 172   int rv = DoLoop(result);
 173   if (rv != ERR_IO_PENDING)
 174     NotifyDelegateOfCompletion(rv);  // Deletes |this|.
 175 }
 176
 177 int SSLConnectJob::DoLoop(int result) {
 178   DCHECK_NE(next_state_, STATE_NONE);
 179
 180   int rv = result;
 181   do {
 182     State state = next_state_;
 183     next_state_ = STATE_NONE;
 184     switch (state) {
 185       case STATE_TRANSPORT_CONNECT:
 186         DCHECK_EQ(OK, rv);
 187         rv = DoTransportConnect();
 188         break;
 189       case STATE_TRANSPORT_CONNECT_COMPLETE:
 190         rv = DoTransportConnectComplete(rv);
 191         break;
 192       case STATE_SOCKS_CONNECT:
 193         DCHECK_EQ(OK, rv);
 194         rv = DoSOCKSConnect();
 195         break;
 196       case STATE_SOCKS_CONNECT_COMPLETE:
 197         rv = DoSOCKSConnectComplete(rv);
 198         break;
 199       case STATE_TUNNEL_CONNECT:
 200         DCHECK_EQ(OK, rv);
 201         rv = DoTunnelConnect();
 202         break;
 203       case STATE_TUNNEL_CONNECT_COMPLETE:
 204         rv = DoTunnelConnectComplete(rv);
 205         break;
 206       case STATE_SSL_CONNECT:
 207         DCHECK_EQ(OK, rv);
 208         rv = DoSSLConnect();
 209         break;
 210       case STATE_SSL_CONNECT_COMPLETE:
 211         rv = DoSSLConnectComplete(rv);
 212         break;
 213       default:
 214         NOTREACHED() << "bad state";
 215         rv = ERR_FAILED;
 216         break;
 217     }
 218   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 219
 220   return rv;
 221 }
 222
 223 int SSLConnectJob::DoTransportConnect() {
 224   DCHECK(transport_pool_);
 225
 226   next_state_ = STATE_TRANSPORT_CONNECT_COMPLETE;
 227   transport_socket_handle_.reset(new ClientSocketHandle());
 228   scoped_refptr<TransportSocketParams> direct_params =
 229       params_->GetDirectConnectionParams();
 230   return transport_socket_handle_->Init(group_name(), direct_params, priority(),
 231                                         callback_, transport_pool_, net_log());
 232 }
 233
 234 int SSLConnectJob::DoTransportConnectComplete(int result) {
 235   if (result == OK)
 236     next_state_ = STATE_SSL_CONNECT;
 237
 238   return result;
 239 }
 240
 241 int SSLConnectJob::DoSOCKSConnect() {
 242   DCHECK(socks_pool_);
 243   next_state_ = STATE_SOCKS_CONNECT_COMPLETE;
 244   transport_socket_handle_.reset(new ClientSocketHandle());
 245   scoped_refptr<SOCKSSocketParams> socks_proxy_params =
 246       params_->GetSocksProxyConnectionParams();
 247   return transport_socket_handle_->Init(group_name(), socks_proxy_params,
 248                                         priority(), callback_, socks_pool_,
 249                                         net_log());
 250 }
 251
 252 int SSLConnectJob::DoSOCKSConnectComplete(int result) {
 253   if (result == OK)
 254     next_state_ = STATE_SSL_CONNECT;
 255
 256   return result;
 257 }
 258
 259 int SSLConnectJob::DoTunnelConnect() {
 260   DCHECK(http_proxy_pool_);
 261   next_state_ = STATE_TUNNEL_CONNECT_COMPLETE;
 262
 263   transport_socket_handle_.reset(new ClientSocketHandle());
 264   scoped_refptr<HttpProxySocketParams> http_proxy_params =
 265       params_->GetHttpProxyConnectionParams();
 266   return transport_socket_handle_->Init(group_name(), http_proxy_params,
 267                                         priority(), callback_, http_proxy_pool_,
 268                                         net_log());
 269 }
 270
 271 int SSLConnectJob::DoTunnelConnectComplete(int result) {
 272   // Extract the information needed to prompt for appropriate proxy
 273   // authentication so that when ClientSocketPoolBaseHelper calls
 274   // |GetAdditionalErrorState|, we can easily set the state.
 275   if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 276     error_response_info_ = transport_socket_handle_->ssl_error_response_info();
 277   } else if (result == ERR_PROXY_AUTH_REQUESTED ||
 278              result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
 279     StreamSocket* socket = transport_socket_handle_->socket();
 280     ProxyClientSocket* tunnel_socket = static_cast<ProxyClientSocket*>(socket);
 281     error_response_info_ = *tunnel_socket->GetConnectResponseInfo();
 282   }
 283   if (result < 0)
 284     return result;
 285
 286   next_state_ = STATE_SSL_CONNECT;
 287   return result;
 288 }
 289
 290 int SSLConnectJob::DoSSLConnect() {
 291   // TODO(pkasting): Remove ScopedTracker below once crbug.com/462815 is fixed.
 292   tracked_objects::ScopedTracker tracking_profile(
 293       FROM_HERE_WITH_EXPLICIT_FUNCTION("462815 SSLConnectJob::DoSSLConnect"));
 294
 295   next_state_ = STATE_SSL_CONNECT_COMPLETE;
 296
 297   // Reset the timeout to just the time allowed for the SSL handshake.
 298   ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
 299
 300   // If the handle has a fresh socket, get its connect start and DNS times.
 301   // This should always be the case.
 302   const LoadTimingInfo::ConnectTiming& socket_connect_timing =
 303       transport_socket_handle_->connect_timing();
 304   if (!transport_socket_handle_->is_reused() &&
 305       !socket_connect_timing.connect_start.is_null()) {
 306     // Overwriting |connect_start| serves two purposes - it adjusts timing so
 307     // |connect_start| doesn't include dns times, and it adjusts the time so
 308     // as not to include time spent waiting for an idle socket.
 309     connect_timing_.connect_start = socket_connect_timing.connect_start;
 310     connect_timing_.dns_start = socket_connect_timing.dns_start;
 311     connect_timing_.dns_end = socket_connect_timing.dns_end;
 312   }
 313
 314   connect_timing_.ssl_start = base::TimeTicks::Now();
 315
 316   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
 317       transport_socket_handle_.Pass(),
 318       params_->host_and_port(),
 319       params_->ssl_config(),
 320       context_);
 321   return ssl_socket_->Connect(callback_);
 322 }
 323
 324 int SSLConnectJob::DoSSLConnectComplete(int result) {
 325   // TODO(rvargas): Remove ScopedTracker below once crbug.com/462784 is fixed.
 326   tracked_objects::ScopedTracker tracking_profile(
 327       FROM_HERE_WITH_EXPLICIT_FUNCTION(
 328           "462784 SSLConnectJob::DoSSLConnectComplete"));
 329
 330   connect_timing_.ssl_end = base::TimeTicks::Now();
 331
 332   SSLClientSocket::NextProtoStatus status =
 333       SSLClientSocket::kNextProtoUnsupported;
 334   std::string proto;
 335   // GetNextProto will fail and and trigger a NOTREACHED if we pass in a socket
 336   // that hasn't had SSL_ImportFD called on it. If we get a certificate error
 337   // here, then we know that we called SSL_ImportFD.
 338   if (result == OK || IsCertificateError(result)) {
 339     status = ssl_socket_->GetNextProto(&proto);
 340     ssl_socket_->RecordNegotiationExtension();
 341   }
 342
 343   // If we want spdy over npn, make sure it succeeded.
 344   if (status == SSLClientSocket::kNextProtoNegotiated) {
 345     ssl_socket_->set_was_npn_negotiated(true);
 346     NextProto protocol_negotiated =
 347         SSLClientSocket::NextProtoFromString(proto);
 348     ssl_socket_->set_protocol_negotiated(protocol_negotiated);
 349     // If we negotiated a SPDY version, it must have been present in
 350     // SSLConfig::next_protos.
 351     // TODO(mbelshe): Verify this.
 352     if (protocol_negotiated >= kProtoSPDYMinimumVersion &&
 353         protocol_negotiated <= kProtoSPDYMaximumVersion) {
 354       ssl_socket_->set_was_spdy_negotiated(true);
 355     }
 356   }
 357   if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated())
 358     return ERR_NPN_NEGOTIATION_FAILED;
 359
 360   if (result == OK ||
 361       ssl_socket_->IgnoreCertError(result, params_->load_flags())) {
 362     DCHECK(!connect_timing_.ssl_start.is_null());
 363     base::TimeDelta connect_duration =
 364         connect_timing_.ssl_end - connect_timing_.ssl_start;
 365     if (params_->want_spdy_over_npn()) {
 366       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency_2",
 367                                  connect_duration,
 368                                  base::TimeDelta::FromMilliseconds(1),
 369                                  base::TimeDelta::FromMinutes(1),
 370                                  100);
 371     }
 372
 373     UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_2",
 374                                connect_duration,
 375                                base::TimeDelta::FromMilliseconds(1),
 376                                base::TimeDelta::FromMinutes(1),
 377                                100);
 378
 379     SSLInfo ssl_info;
 380     bool has_ssl_info = ssl_socket_->GetSSLInfo(&ssl_info);
 381     DCHECK(has_ssl_info);
 382
 383     UMA_HISTOGRAM_ENUMERATION("Net.SSLVersion", SSLConnectionStatusToVersion(
 384                                                     ssl_info.connection_status),
 385                               SSL_CONNECTION_VERSION_MAX);
 386
 387     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite",
 388                                 SSLConnectionStatusToCipherSuite(
 389                                     ssl_info.connection_status));
 390
 391     if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 392       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Resume_Handshake",
 393                                  connect_duration,
 394                                  base::TimeDelta::FromMilliseconds(1),
 395                                  base::TimeDelta::FromMinutes(1),
 396                                  100);
 397     } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 398       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Full_Handshake",
 399                                  connect_duration,
 400                                  base::TimeDelta::FromMilliseconds(1),
 401                                  base::TimeDelta::FromMinutes(1),
 402                                  100);
 403     }
 404
 405     const std::string& host = params_->host_and_port().host();
 406     bool is_google =
 407         host == "google.com" ||
 408         (host.size() > 11 && host.rfind(".google.com") == host.size() - 11);
 409     if (is_google) {
 410       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google2",
 411                                  connect_duration,
 412                                  base::TimeDelta::FromMilliseconds(1),
 413                                  base::TimeDelta::FromMinutes(1),
 414                                  100);
 415       if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 416         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 417                                        "Resume_Handshake",
 418                                    connect_duration,
 419                                    base::TimeDelta::FromMilliseconds(1),
 420                                    base::TimeDelta::FromMinutes(1),
 421                                    100);
 422       } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 423         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 424                                        "Full_Handshake",
 425                                    connect_duration,
 426                                    base::TimeDelta::FromMilliseconds(1),
 427                                    base::TimeDelta::FromMinutes(1),
 428                                    100);
 429       }
 430     }
 431   }
 432
 433   UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error", std::abs(result));
 434   if (params_->ssl_config().fastradio_padding_eligible) {
 435     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error_FastRadioPadding",
 436                                 std::abs(result));
 437   }
 438
 439   if (result == OK || IsCertificateError(result)) {
 440     SetSocket(ssl_socket_.Pass());
 441   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 442     error_response_info_.cert_request_info = new SSLCertRequestInfo;
 443     ssl_socket_->GetSSLCertRequestInfo(
 444         error_response_info_.cert_request_info.get());
 445   }
 446
 447   return result;
 448 }
 449
 450 SSLConnectJob::State SSLConnectJob::GetInitialState(
 451     SSLSocketParams::ConnectionType connection_type) {
 452   switch (connection_type) {
 453     case SSLSocketParams::DIRECT:
 454       return STATE_TRANSPORT_CONNECT;
 455     case SSLSocketParams::HTTP_PROXY:
 456       return STATE_TUNNEL_CONNECT;
 457     case SSLSocketParams::SOCKS_PROXY:
 458       return STATE_SOCKS_CONNECT;
 459   }
 460   NOTREACHED();
 461   return STATE_NONE;
 462 }
 463
 464 int SSLConnectJob::ConnectInternal() {
 465   next_state_ = GetInitialState(params_->GetConnectionType());
 466   return DoLoop(OK);
 467 }
 468
 469 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
 470     TransportClientSocketPool* transport_pool,
 471     SOCKSClientSocketPool* socks_pool,
 472     HttpProxyClientSocketPool* http_proxy_pool,
 473     ClientSocketFactory* client_socket_factory,
 474     const SSLClientSocketContext& context,
 475     NetLog* net_log)
 476     : transport_pool_(transport_pool),
 477       socks_pool_(socks_pool),
 478       http_proxy_pool_(http_proxy_pool),
 479       client_socket_factory_(client_socket_factory),
 480       context_(context),
 481       net_log_(net_log) {
 482   base::TimeDelta max_transport_timeout = base::TimeDelta();
 483   base::TimeDelta pool_timeout;
 484   if (transport_pool_)
 485     max_transport_timeout = transport_pool_->ConnectionTimeout();
 486   if (socks_pool_) {
 487     pool_timeout = socks_pool_->ConnectionTimeout();
 488     if (pool_timeout > max_transport_timeout)
 489       max_transport_timeout = pool_timeout;
 490   }
 491   if (http_proxy_pool_) {
 492     pool_timeout = http_proxy_pool_->ConnectionTimeout();
 493     if (pool_timeout > max_transport_timeout)
 494       max_transport_timeout = pool_timeout;
 495   }
 496   timeout_ = max_transport_timeout +
 497       base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds);
 498 }
 499
 500 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
 501 }
 502
 503 SSLClientSocketPool::SSLClientSocketPool(
 504     int max_sockets,
 505     int max_sockets_per_group,
 506     CertVerifier* cert_verifier,
 507     ChannelIDService* channel_id_service,
 508     TransportSecurityState* transport_security_state,
 509     CTVerifier* cert_transparency_verifier,
 510     CertPolicyEnforcer* cert_policy_enforcer,
 511     const std::string& ssl_session_cache_shard,
 512     ClientSocketFactory* client_socket_factory,
 513     TransportClientSocketPool* transport_pool,
 514     SOCKSClientSocketPool* socks_pool,
 515     HttpProxyClientSocketPool* http_proxy_pool,
 516     SSLConfigService* ssl_config_service,
 517     NetLog* net_log)
 518     : transport_pool_(transport_pool),
 519       socks_pool_(socks_pool),
 520       http_proxy_pool_(http_proxy_pool),
 521       base_(this,
 522             max_sockets,
 523             max_sockets_per_group,
 524             ClientSocketPool::unused_idle_socket_timeout(),
 525             ClientSocketPool::used_idle_socket_timeout(),
 526             new SSLConnectJobFactory(
 527                 transport_pool,
 528                 socks_pool,
 529                 http_proxy_pool,
 530                 client_socket_factory,
 531                 SSLClientSocketContext(cert_verifier,
 532                                        channel_id_service,
 533                                        transport_security_state,
 534                                        cert_transparency_verifier,
 535                                        cert_policy_enforcer,
 536                                        ssl_session_cache_shard),
 537                 net_log)),
 538       ssl_config_service_(ssl_config_service) {
 539   if (ssl_config_service_.get())
 540     ssl_config_service_->AddObserver(this);
 541   if (transport_pool_)
 542     base_.AddLowerLayeredPool(transport_pool_);
 543   if (socks_pool_)
 544     base_.AddLowerLayeredPool(socks_pool_);
 545   if (http_proxy_pool_)
 546     base_.AddLowerLayeredPool(http_proxy_pool_);
 547 }
 548
 549 SSLClientSocketPool::~SSLClientSocketPool() {
 550   if (ssl_config_service_.get())
 551     ssl_config_service_->RemoveObserver(this);
 552 }
 553
 554 scoped_ptr<ConnectJob> SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
 555     const std::string& group_name,
 556     const PoolBase::Request& request,
 557     ConnectJob::Delegate* delegate) const {
 558   return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
 559                                                   request.priority(),
 560                                                   request.params(),
 561                                                   ConnectionTimeout(),
 562                                                   transport_pool_,
 563                                                   socks_pool_,
 564                                                   http_proxy_pool_,
 565                                                   client_socket_factory_,
 566                                                   context_,
 567                                                   delegate,
 568                                                   net_log_));
 569 }
 570
 571 base::TimeDelta SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout()
 572     const {
 573   return timeout_;
 574 }
 575
 576 int SSLClientSocketPool::RequestSocket(const std::string& group_name,
 577                                        const void* socket_params,
 578                                        RequestPriority priority,
 579                                        ClientSocketHandle* handle,
 580                                        const CompletionCallback& callback,
 581                                        const BoundNetLog& net_log) {
 582   const scoped_refptr<SSLSocketParams>* casted_socket_params =
 583       static_cast<const scoped_refptr<SSLSocketParams>*>(socket_params);
 584
 585   return base_.RequestSocket(group_name, *casted_socket_params, priority,
 586                              handle, callback, net_log);
 587 }
 588
 589 void SSLClientSocketPool::RequestSockets(
 590     const std::string& group_name,
 591     const void* params,
 592     int num_sockets,
 593     const BoundNetLog& net_log) {
 594   const scoped_refptr<SSLSocketParams>* casted_params =
 595       static_cast<const scoped_refptr<SSLSocketParams>*>(params);
 596
 597   base_.RequestSockets(group_name, *casted_params, num_sockets, net_log);
 598 }
 599
 600 void SSLClientSocketPool::CancelRequest(const std::string& group_name,
 601                                         ClientSocketHandle* handle) {
 602   base_.CancelRequest(group_name, handle);
 603 }
 604
 605 void SSLClientSocketPool::ReleaseSocket(const std::string& group_name,
 606                                         scoped_ptr<StreamSocket> socket,
 607                                         int id) {
 608   base_.ReleaseSocket(group_name, socket.Pass(), id);
 609 }
 610
 611 void SSLClientSocketPool::FlushWithError(int error) {
 612   base_.FlushWithError(error);
 613 }
 614
 615 void SSLClientSocketPool::CloseIdleSockets() {
 616   base_.CloseIdleSockets();
 617 }
 618
 619 int SSLClientSocketPool::IdleSocketCount() const {
 620   return base_.idle_socket_count();
 621 }
 622
 623 int SSLClientSocketPool::IdleSocketCountInGroup(
 624     const std::string& group_name) const {
 625   return base_.IdleSocketCountInGroup(group_name);
 626 }
 627
 628 LoadState SSLClientSocketPool::GetLoadState(
 629     const std::string& group_name, const ClientSocketHandle* handle) const {
 630   return base_.GetLoadState(group_name, handle);
 631 }
 632
 633 base::DictionaryValue* SSLClientSocketPool::GetInfoAsValue(
 634     const std::string& name,
 635     const std::string& type,
 636     bool include_nested_pools) const {
 637   base::DictionaryValue* dict = base_.GetInfoAsValue(name, type);
 638   if (include_nested_pools) {
 639     base::ListValue* list = new base::ListValue();
 640     if (transport_pool_) {
 641       list->Append(transport_pool_->GetInfoAsValue("transport_socket_pool",
 642                                                    "transport_socket_pool",
 643                                                    false));
 644     }
 645     if (socks_pool_) {
 646       list->Append(socks_pool_->GetInfoAsValue("socks_pool",
 647                                                "socks_pool",
 648                                                true));
 649     }
 650     if (http_proxy_pool_) {
 651       list->Append(http_proxy_pool_->GetInfoAsValue("http_proxy_pool",
 652                                                     "http_proxy_pool",
 653                                                     true));
 654     }
 655     dict->Set("nested_pools", list);
 656   }
 657   return dict;
 658 }
 659
 660 base::TimeDelta SSLClientSocketPool::ConnectionTimeout() const {
 661   return base_.ConnectionTimeout();
 662 }
 663
 664 bool SSLClientSocketPool::IsStalled() const {
 665   return base_.IsStalled();
 666 }
 667
 668 void SSLClientSocketPool::AddHigherLayeredPool(HigherLayeredPool* higher_pool) {
 669   base_.AddHigherLayeredPool(higher_pool);
 670 }
 671
 672 void SSLClientSocketPool::RemoveHigherLayeredPool(
 673     HigherLayeredPool* higher_pool) {
 674   base_.RemoveHigherLayeredPool(higher_pool);
 675 }
 676
 677 bool SSLClientSocketPool::CloseOneIdleConnection() {
 678   if (base_.CloseOneIdleSocket())
 679     return true;
 680   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 681 }
 682
 683 void SSLClientSocketPool::OnSSLConfigChanged() {
 684   FlushWithError(ERR_NETWORK_CHANGED);
 685 }
 686
 687 }  // namespace net