net/socket/ssl_client_socket_openssl.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
   7
   8 #include <string>
   9
  10 #include "base/compiler_specific.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/memory/weak_ptr.h"
  13 #include "net/base/completion_callback.h"
  14 #include "net/base/io_buffer.h"
  15 #include "net/cert/cert_verify_result.h"
  16 #include "net/socket/client_socket_handle.h"
  17 #include "net/socket/ssl_client_socket.h"
  18 #include "net/ssl/server_bound_cert_service.h"
  19 #include "net/ssl/ssl_config_service.h"
  20
  21 // Avoid including misc OpenSSL headers, i.e.:
  22 // <openssl/bio.h>
  23 typedef struct bio_st BIO;
  24 // <openssl/evp.h>
  25 typedef struct evp_pkey_st EVP_PKEY;
  26 // <openssl/ssl.h>
  27 typedef struct ssl_st SSL;
  28 // <openssl/x509.h>
  29 typedef struct x509_st X509;
  30 // <openssl/ossl_type.h>
  31 typedef struct x509_store_ctx_st X509_STORE_CTX;
  32
  33 namespace net {
  34
  35 class CertVerifier;
  36 class SingleRequestCertVerifier;
  37 class SSLCertRequestInfo;
  38 class SSLInfo;
  39
  40 // An SSL client socket implemented with OpenSSL.
  41 class SSLClientSocketOpenSSL : public SSLClientSocket {
  42  public:
  43   // Takes ownership of the transport_socket, which may already be connected.
  44   // The given hostname will be compared with the name(s) in the server's
  45   // certificate during the SSL handshake.  ssl_config specifies the SSL
  46   // settings.
  47   SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket,
  48                          const HostPortPair& host_and_port,
  49                          const SSLConfig& ssl_config,
  50                          const SSLClientSocketContext& context);
  51   virtual ~SSLClientSocketOpenSSL();
  52
  53   const HostPortPair& host_and_port() const { return host_and_port_; }
  54   const std::string& ssl_session_cache_shard() const {
  55     return ssl_session_cache_shard_;
  56   }
  57
  58   // SSLClientSocket implementation.
  59   virtual void GetSSLCertRequestInfo(
  60       SSLCertRequestInfo* cert_request_info) OVERRIDE;
  61   virtual NextProtoStatus GetNextProto(std::string* proto,
  62                                        std::string* server_protos) OVERRIDE;
  63   virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
  64
  65   // SSLSocket implementation.
  66   virtual int ExportKeyingMaterial(const base::StringPiece& label,
  67                                    bool has_context,
  68                                    const base::StringPiece& context,
  69                                    unsigned char* out,
  70                                    unsigned int outlen) OVERRIDE;
  71   virtual int GetTLSUniqueChannelBinding(std::string* out) OVERRIDE;
  72
  73   // StreamSocket implementation.
  74   virtual int Connect(const CompletionCallback& callback) OVERRIDE;
  75   virtual void Disconnect() OVERRIDE;
  76   virtual bool IsConnected() const OVERRIDE;
  77   virtual bool IsConnectedAndIdle() const OVERRIDE;
  78   virtual int GetPeerAddress(IPEndPoint* address) const OVERRIDE;
  79   virtual int GetLocalAddress(IPEndPoint* address) const OVERRIDE;
  80   virtual const BoundNetLog& NetLog() const OVERRIDE;
  81   virtual void SetSubresourceSpeculation() OVERRIDE;
  82   virtual void SetOmniboxSpeculation() OVERRIDE;
  83   virtual bool WasEverUsed() const OVERRIDE;
  84   virtual bool UsingTCPFastOpen() const OVERRIDE;
  85   virtual bool GetSSLInfo(SSLInfo* ssl_info) OVERRIDE;
  86
  87   // Socket implementation.
  88   virtual int Read(IOBuffer* buf, int buf_len,
  89                    const CompletionCallback& callback) OVERRIDE;
  90   virtual int Write(IOBuffer* buf, int buf_len,
  91                     const CompletionCallback& callback) OVERRIDE;
  92   virtual int SetReceiveBufferSize(int32 size) OVERRIDE;
  93   virtual int SetSendBufferSize(int32 size) OVERRIDE;
  94
  95  protected:
  96   // SSLClientSocket implementation.
  97   virtual scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
  98       const OVERRIDE;
  99
 100  private:
 101   class PeerCertificateChain;
 102   class SSLContext;
 103   friend class SSLClientSocket;
 104   friend class SSLContext;
 105
 106   bool Init();
 107   void DoReadCallback(int result);
 108   void DoWriteCallback(int result);
 109
 110   bool DoTransportIO();
 111   int DoHandshake();
 112   int DoVerifyCert(int result);
 113   int DoVerifyCertComplete(int result);
 114   void DoConnectCallback(int result);
 115   X509Certificate* UpdateServerCert();
 116
 117   void OnHandshakeIOComplete(int result);
 118   void OnSendComplete(int result);
 119   void OnRecvComplete(int result);
 120
 121   int DoHandshakeLoop(int last_io_result);
 122   int DoReadLoop(int result);
 123   int DoWriteLoop(int result);
 124   int DoPayloadRead();
 125   int DoPayloadWrite();
 126
 127   int BufferSend();
 128   int BufferRecv();
 129   void BufferSendComplete(int result);
 130   void BufferRecvComplete(int result);
 131   void TransportWriteComplete(int result);
 132   int TransportReadComplete(int result);
 133
 134   // Callback from the SSL layer that indicates the remote server is requesting
 135   // a certificate for this client.
 136   int ClientCertRequestCallback(SSL* ssl, X509** x509, EVP_PKEY** pkey);
 137
 138   // Callback from the SSL layer that indicates the remote server supports TLS
 139   // Channel IDs.
 140   void ChannelIDRequestCallback(SSL* ssl, EVP_PKEY** pkey);
 141
 142   // CertVerifyCallback is called to verify the server's certificates. We do
 143   // verification after the handshake so this function only enforces that the
 144   // certificates don't change during renegotiation.
 145   int CertVerifyCallback(X509_STORE_CTX *store_ctx);
 146
 147   // Callback from the SSL layer to check which NPN protocol we are supporting
 148   int SelectNextProtoCallback(unsigned char** out, unsigned char* outlen,
 149                               const unsigned char* in, unsigned int inlen);
 150
 151   bool transport_send_busy_;
 152   bool transport_recv_busy_;
 153   bool transport_recv_eof_;
 154
 155   scoped_refptr<DrainableIOBuffer> send_buffer_;
 156   scoped_refptr<IOBuffer> recv_buffer_;
 157
 158   CompletionCallback user_connect_callback_;
 159   CompletionCallback user_read_callback_;
 160   CompletionCallback user_write_callback_;
 161
 162   base::WeakPtrFactory<SSLClientSocketOpenSSL> weak_factory_;
 163
 164   // Used by Read function.
 165   scoped_refptr<IOBuffer> user_read_buf_;
 166   int user_read_buf_len_;
 167
 168   // Used by Write function.
 169   scoped_refptr<IOBuffer> user_write_buf_;
 170   int user_write_buf_len_;
 171
 172   // Used by DoPayloadRead() when attempting to fill the caller's buffer with
 173   // as much data as possible without blocking.
 174   // If DoPayloadRead() encounters an error after having read some data, stores
 175   // the result to return on the *next* call to DoPayloadRead().  A value > 0
 176   // indicates there is no pending result, otherwise 0 indicates EOF and < 0
 177   // indicates an error.
 178   int pending_read_error_;
 179
 180   // Used by TransportWriteComplete() and TransportReadComplete() to signify an
 181   // error writing to the transport socket. A value of OK indicates no error.
 182   int transport_write_error_;
 183
 184   // Set when handshake finishes.
 185   scoped_ptr<PeerCertificateChain> server_cert_chain_;
 186   scoped_refptr<X509Certificate> server_cert_;
 187   CertVerifyResult server_cert_verify_result_;
 188   bool completed_handshake_;
 189
 190   // Set when Read() or Write() successfully reads or writes data to or from the
 191   // network.
 192   bool was_ever_used_;
 193
 194   // Stores client authentication information between ClientAuthHandler and
 195   // GetSSLCertRequestInfo calls.
 196   bool client_auth_cert_needed_;
 197   // List of DER-encoded X.509 DistinguishedName of certificate authorities
 198   // allowed by the server.
 199   std::vector<std::string> cert_authorities_;
 200
 201   CertVerifier* const cert_verifier_;
 202   scoped_ptr<SingleRequestCertVerifier> verifier_;
 203
 204   // The service for retrieving Channel ID keys.  May be NULL.
 205   ServerBoundCertService* server_bound_cert_service_;
 206
 207   // OpenSSL stuff
 208   SSL* ssl_;
 209   BIO* transport_bio_;
 210
 211   scoped_ptr<ClientSocketHandle> transport_;
 212   const HostPortPair host_and_port_;
 213   SSLConfig ssl_config_;
 214   // ssl_session_cache_shard_ is an opaque string that partitions the SSL
 215   // session cache. i.e. sessions created with one value will not attempt to
 216   // resume on the socket with a different value.
 217   const std::string ssl_session_cache_shard_;
 218
 219   // Used for session cache diagnostics.
 220   bool trying_cached_session_;
 221
 222   enum State {
 223     STATE_NONE,
 224     STATE_HANDSHAKE,
 225     STATE_VERIFY_CERT,
 226     STATE_VERIFY_CERT_COMPLETE,
 227   };
 228   State next_handshake_state_;
 229   NextProtoStatus npn_status_;
 230   std::string npn_proto_;
 231   std::string server_protos_;
 232   // Written by the |server_bound_cert_service_|.
 233   std::string channel_id_private_key_;
 234   std::string channel_id_cert_;
 235   // The return value of the last call to |server_bound_cert_service_|.
 236   int channel_id_request_return_value_;
 237   // True if channel ID extension was negotiated.
 238   bool channel_id_xtn_negotiated_;
 239   // The request handle for |server_bound_cert_service_|.
 240   ServerBoundCertService::RequestHandle channel_id_request_handle_;
 241   BoundNetLog net_log_;
 242 };
 243
 244 }  // namespace net
 245
 246 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_