net/socket/ssl_client_socket_nss.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
   6 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
   7 #pragma once
   8
   9 #include <certt.h>
  10 #include <keyt.h>
  11 #include <nspr.h>
  12 #include <nss.h>
  13
  14 #include <string>
  15 #include <vector>
  16
  17 #include "base/memory/scoped_ptr.h"
  18 #include "base/synchronization/lock.h"
  19 #include "base/threading/platform_thread.h"
  20 #include "base/time.h"
  21 #include "base/timer.h"
  22 #include "net/base/cert_verify_result.h"
  23 #include "net/base/completion_callback.h"
  24 #include "net/base/host_port_pair.h"
  25 #include "net/base/net_export.h"
  26 #include "net/base/net_log.h"
  27 #include "net/base/nss_memio.h"
  28 #include "net/base/server_bound_cert_service.h"
  29 #include "net/base/ssl_config_service.h"
  30 #include "net/base/x509_certificate.h"
  31 #include "net/socket/ssl_client_socket.h"
  32
  33 namespace base {
  34 class SingleThreadTaskRunner;
  35 }
  36
  37 namespace net {
  38
  39 class BoundNetLog;
  40 class CertVerifier;
  41 class ClientSocketHandle;
  42 class ServerBoundCertService;
  43 class SingleRequestCertVerifier;
  44 class SSLHostInfo;
  45 class TransportSecurityState;
  46 class X509Certificate;
  47
  48 // An SSL client socket implemented with Mozilla NSS.
  49 class SSLClientSocketNSS : public SSLClientSocket {
  50  public:
  51   // Takes ownership of the |transport_socket|, which must already be connected.
  52   // The hostname specified in |host_and_port| will be compared with the name(s)
  53   // in the server's certificate during the SSL handshake.  If SSL client
  54   // authentication is requested, the host_and_port field of SSLCertRequestInfo
  55   // will be populated with |host_and_port|.  |ssl_config| specifies
  56   // the SSL settings.
  57   //
  58   // Because calls to NSS may block, such as due to needing to access slow
  59   // hardware or needing to synchronously unlock protected tokens, calls to
  60   // NSS may optionally be run on a dedicated thread. If synchronous/blocking
  61   // behaviour is desired, for performance or compatibility, the current task
  62   // runner should be supplied instead.
  63   SSLClientSocketNSS(base::SingleThreadTaskRunner* nss_task_runner,
  64                      ClientSocketHandle* transport_socket,
  65                      const HostPortPair& host_and_port,
  66                      const SSLConfig& ssl_config,
  67                      SSLHostInfo* ssl_host_info,
  68                      const SSLClientSocketContext& context);
  69   virtual ~SSLClientSocketNSS();
  70
  71   // SSLClientSocket implementation.
  72   virtual void GetSSLInfo(SSLInfo* ssl_info) OVERRIDE;
  73   virtual void GetSSLCertRequestInfo(
  74       SSLCertRequestInfo* cert_request_info) OVERRIDE;
  75   virtual int ExportKeyingMaterial(const base::StringPiece& label,
  76                                    bool has_context,
  77                                    const base::StringPiece& context,
  78                                    unsigned char* out,
  79                                    unsigned int outlen) OVERRIDE;
  80   virtual NextProtoStatus GetNextProto(std::string* proto,
  81                                        std::string* server_protos) OVERRIDE;
  82
  83   // StreamSocket implementation.
  84   virtual int Connect(const CompletionCallback& callback) OVERRIDE;
  85   virtual void Disconnect() OVERRIDE;
  86   virtual bool IsConnected() const OVERRIDE;
  87   virtual bool IsConnectedAndIdle() const OVERRIDE;
  88   virtual int GetPeerAddress(IPEndPoint* address) const OVERRIDE;
  89   virtual int GetLocalAddress(IPEndPoint* address) const OVERRIDE;
  90   virtual const BoundNetLog& NetLog() const OVERRIDE;
  91   virtual void SetSubresourceSpeculation() OVERRIDE;
  92   virtual void SetOmniboxSpeculation() OVERRIDE;
  93   virtual bool WasEverUsed() const OVERRIDE;
  94   virtual bool UsingTCPFastOpen() const OVERRIDE;
  95   virtual int64 NumBytesRead() const OVERRIDE;
  96   virtual base::TimeDelta GetConnectTimeMicros() const OVERRIDE;
  97
  98   // Socket implementation.
  99   virtual int Read(IOBuffer* buf,
 100                    int buf_len,
 101                    const CompletionCallback& callback) OVERRIDE;
 102   virtual int Write(IOBuffer* buf,
 103                     int buf_len,
 104                     const CompletionCallback& callback) OVERRIDE;
 105   virtual bool SetReceiveBufferSize(int32 size) OVERRIDE;
 106   virtual bool SetSendBufferSize(int32 size) OVERRIDE;
 107   virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
 108
 109  private:
 110   // Helper class to handle marshalling any NSS interaction to and from the
 111   // NSS and network task runners. Not every call needs to happen on the Core
 112   class Core;
 113
 114   enum State {
 115     STATE_NONE,
 116     STATE_LOAD_SSL_HOST_INFO,
 117     STATE_HANDSHAKE,
 118     STATE_HANDSHAKE_COMPLETE,
 119     STATE_VERIFY_DNSSEC,
 120     STATE_VERIFY_CERT,
 121     STATE_VERIFY_CERT_COMPLETE,
 122   };
 123
 124   int Init();
 125   void InitCore();
 126
 127   // Initializes NSS SSL options.  Returns a net error code.
 128   int InitializeSSLOptions();
 129
 130   // Initializes the socket peer name in SSL.  Returns a net error code.
 131   int InitializeSSLPeerName();
 132
 133   void DoConnectCallback(int result);
 134   void OnHandshakeIOComplete(int result);
 135
 136   void LoadSSLHostInfo();
 137   int DoLoadSSLHostInfo();
 138
 139   int DoHandshakeLoop(int last_io_result);
 140   int DoHandshake();
 141   int DoHandshakeComplete(int result);
 142   int DoVerifyDNSSEC(int result);
 143   int DoVerifyCert(int result);
 144   int DoVerifyCertComplete(int result);
 145   void SaveSSLHostInfo();
 146
 147   void LogConnectionTypeMetrics() const;
 148
 149   // The following methods are for debugging bug 65948. Will remove this code
 150   // after fixing bug 65948.
 151   void EnsureThreadIdAssigned() const;
 152   bool CalledOnValidThread() const;
 153
 154   // The task runner used to perform NSS operations.
 155   scoped_refptr<base::SingleThreadTaskRunner> nss_task_runner_;
 156   scoped_ptr<ClientSocketHandle> transport_;
 157   HostPortPair host_and_port_;
 158   SSLConfig ssl_config_;
 159
 160   scoped_refptr<Core> core_;
 161
 162   CompletionCallback user_connect_callback_;
 163
 164   // |server_cert_verify_result_| points at the verification result, which may,
 165   // or may not be, |&local_server_cert_verify_result_|, depending on whether
 166   // we used an SSLHostInfo's verification.
 167   const CertVerifyResult* server_cert_verify_result_;
 168   CertVerifyResult local_server_cert_verify_result_;
 169   std::vector<SHA1Fingerprint> side_pinned_public_keys_;
 170
 171   CertVerifier* const cert_verifier_;
 172   scoped_ptr<SingleRequestCertVerifier> verifier_;
 173
 174   // For domain bound certificates in client auth.
 175   ServerBoundCertService* server_bound_cert_service_;
 176
 177   // ssl_session_cache_shard_ is an opaque string that partitions the SSL
 178   // session cache. i.e. sessions created with one value will not attempt to
 179   // resume on the socket with a different value.
 180   const std::string ssl_session_cache_shard_;
 181
 182   // True if the SSL handshake has been completed.
 183   bool completed_handshake_;
 184
 185   State next_handshake_state_;
 186
 187   // The NSS SSL state machine. This is owned by |core_|.
 188   // TODO(rsleevi): http://crbug.com/130616 - Remove this member once
 189   // ExportKeyingMaterial is updated to be asynchronous.
 190   PRFileDesc* nss_fd_;
 191
 192   BoundNetLog net_log_;
 193
 194   base::TimeTicks start_cert_verification_time_;
 195
 196   scoped_ptr<SSLHostInfo> ssl_host_info_;
 197
 198   TransportSecurityState* transport_security_state_;
 199
 200   // The following two variables are added for debugging bug 65948. Will
 201   // remove this code after fixing bug 65948.
 202   // Added the following code Debugging in release mode.
 203   mutable base::Lock lock_;
 204   // This is mutable so that CalledOnValidThread can set it.
 205   // It's guarded by |lock_|.
 206   mutable base::PlatformThreadId valid_thread_id_;
 207 };
 208
 209 }  // namespace net
 210
 211 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_