net/socket/ssl_client_socket_pool.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/socket/ssl_client_socket_pool.h"
   6
   7 #include "base/bind.h"
   8 #include "base/bind_helpers.h"
   9 #include "base/metrics/field_trial.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/metrics/sparse_histogram.h"
  12 #include "base/stl_util.h"
  13 #include "base/values.h"
  14 #include "net/base/host_port_pair.h"
  15 #include "net/base/net_errors.h"
  16 #include "net/http/http_proxy_client_socket.h"
  17 #include "net/http/http_proxy_client_socket_pool.h"
  18 #include "net/socket/client_socket_factory.h"
  19 #include "net/socket/client_socket_handle.h"
  20 #include "net/socket/socks_client_socket_pool.h"
  21 #include "net/socket/ssl_client_socket.h"
  22 #include "net/socket/transport_client_socket_pool.h"
  23 #include "net/ssl/ssl_cert_request_info.h"
  24 #include "net/ssl/ssl_connection_status_flags.h"
  25 #include "net/ssl/ssl_info.h"
  26
  27 namespace net {
  28
  29 SSLSocketParams::SSLSocketParams(
  30     const scoped_refptr<TransportSocketParams>& direct_params,
  31     const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
  32     const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
  33     const HostPortPair& host_and_port,
  34     const SSLConfig& ssl_config,
  35     PrivacyMode privacy_mode,
  36     int load_flags,
  37     bool force_spdy_over_ssl,
  38     bool want_spdy_over_npn)
  39     : direct_params_(direct_params),
  40       socks_proxy_params_(socks_proxy_params),
  41       http_proxy_params_(http_proxy_params),
  42       host_and_port_(host_and_port),
  43       ssl_config_(ssl_config),
  44       privacy_mode_(privacy_mode),
  45       load_flags_(load_flags),
  46       force_spdy_over_ssl_(force_spdy_over_ssl),
  47       want_spdy_over_npn_(want_spdy_over_npn),
  48       ignore_limits_(false) {
  49   if (direct_params_.get()) {
  50     DCHECK(!socks_proxy_params_.get());
  51     DCHECK(!http_proxy_params_.get());
  52     ignore_limits_ = direct_params_->ignore_limits();
  53   } else if (socks_proxy_params_.get()) {
  54     DCHECK(!http_proxy_params_.get());
  55     ignore_limits_ = socks_proxy_params_->ignore_limits();
  56   } else {
  57     DCHECK(http_proxy_params_.get());
  58     ignore_limits_ = http_proxy_params_->ignore_limits();
  59   }
  60 }
  61
  62 SSLSocketParams::~SSLSocketParams() {}
  63
  64 SSLSocketParams::ConnectionType SSLSocketParams::GetConnectionType() const {
  65   if (direct_params_.get()) {
  66     DCHECK(!socks_proxy_params_.get());
  67     DCHECK(!http_proxy_params_.get());
  68     return DIRECT;
  69   }
  70
  71   if (socks_proxy_params_.get()) {
  72     DCHECK(!http_proxy_params_.get());
  73     return SOCKS_PROXY;
  74   }
  75
  76   DCHECK(http_proxy_params_.get());
  77   return HTTP_PROXY;
  78 }
  79
  80 const scoped_refptr<TransportSocketParams>&
  81 SSLSocketParams::GetDirectConnectionParams() const {
  82   DCHECK_EQ(GetConnectionType(), DIRECT);
  83   return direct_params_;
  84 }
  85
  86 const scoped_refptr<SOCKSSocketParams>&
  87 SSLSocketParams::GetSocksProxyConnectionParams() const {
  88   DCHECK_EQ(GetConnectionType(), SOCKS_PROXY);
  89   return socks_proxy_params_;
  90 }
  91
  92 const scoped_refptr<HttpProxySocketParams>&
  93 SSLSocketParams::GetHttpProxyConnectionParams() const {
  94   DCHECK_EQ(GetConnectionType(), HTTP_PROXY);
  95   return http_proxy_params_;
  96 }
  97
  98 SSLConnectJobMessenger::SocketAndCallback::SocketAndCallback(
  99     SSLClientSocket* ssl_socket,
 100     const base::Closure& job_resumption_callback)
 101     : socket(ssl_socket), callback(job_resumption_callback) {
 102 }
 103
 104 SSLConnectJobMessenger::SocketAndCallback::~SocketAndCallback() {
 105 }
 106
 107 SSLConnectJobMessenger::SSLConnectJobMessenger(
 108     const base::Closure& messenger_finished_callback)
 109     : messenger_finished_callback_(messenger_finished_callback),
 110       weak_factory_(this) {
 111 }
 112
 113 SSLConnectJobMessenger::~SSLConnectJobMessenger() {
 114 }
 115
 116 void SSLConnectJobMessenger::RemovePendingSocket(SSLClientSocket* ssl_socket) {
 117   // Sockets do not need to be removed from connecting_sockets_ because
 118   // OnSSLHandshakeCompleted will do this.
 119   for (SSLPendingSocketsAndCallbacks::iterator it =
 120            pending_sockets_and_callbacks_.begin();
 121        it != pending_sockets_and_callbacks_.end();
 122        ++it) {
 123     if (it->socket == ssl_socket) {
 124       pending_sockets_and_callbacks_.erase(it);
 125       return;
 126     }
 127   }
 128 }
 129
 130 bool SSLConnectJobMessenger::CanProceed(SSLClientSocket* ssl_socket) {
 131   // If there are no connecting sockets, allow the connection to proceed.
 132   return connecting_sockets_.empty();
 133 }
 134
 135 void SSLConnectJobMessenger::MonitorConnectionResult(
 136     SSLClientSocket* ssl_socket) {
 137   connecting_sockets_.push_back(ssl_socket);
 138   ssl_socket->SetHandshakeCompletionCallback(
 139       base::Bind(&SSLConnectJobMessenger::OnSSLHandshakeCompleted,
 140                  weak_factory_.GetWeakPtr()));
 141 }
 142
 143 void SSLConnectJobMessenger::AddPendingSocket(SSLClientSocket* ssl_socket,
 144                                               const base::Closure& callback) {
 145   DCHECK(!connecting_sockets_.empty());
 146   pending_sockets_and_callbacks_.push_back(
 147       SocketAndCallback(ssl_socket, callback));
 148 }
 149
 150 void SSLConnectJobMessenger::OnSSLHandshakeCompleted() {
 151   connecting_sockets_.clear();
 152   SSLPendingSocketsAndCallbacks temp_list;
 153   temp_list.swap(pending_sockets_and_callbacks_);
 154   base::Closure messenger_finished_callback = messenger_finished_callback_;
 155   messenger_finished_callback.Run();
 156   RunAllCallbacks(temp_list);
 157 }
 158
 159 void SSLConnectJobMessenger::RunAllCallbacks(
 160     const SSLPendingSocketsAndCallbacks& pending_sockets_and_callbacks) {
 161   for (std::vector<SocketAndCallback>::const_iterator it =
 162            pending_sockets_and_callbacks.begin();
 163        it != pending_sockets_and_callbacks.end();
 164        ++it) {
 165     it->callback.Run();
 166   }
 167 }
 168
 169 // Timeout for the SSL handshake portion of the connect.
 170 static const int kSSLHandshakeTimeoutInSeconds = 30;
 171
 172 SSLConnectJob::SSLConnectJob(const std::string& group_name,
 173                              RequestPriority priority,
 174                              const scoped_refptr<SSLSocketParams>& params,
 175                              const base::TimeDelta& timeout_duration,
 176                              TransportClientSocketPool* transport_pool,
 177                              SOCKSClientSocketPool* socks_pool,
 178                              HttpProxyClientSocketPool* http_proxy_pool,
 179                              ClientSocketFactory* client_socket_factory,
 180                              const SSLClientSocketContext& context,
 181                              const GetMessengerCallback& get_messenger_callback,
 182                              Delegate* delegate,
 183                              NetLog* net_log)
 184     : ConnectJob(group_name,
 185                  timeout_duration,
 186                  priority,
 187                  delegate,
 188                  BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
 189       params_(params),
 190       transport_pool_(transport_pool),
 191       socks_pool_(socks_pool),
 192       http_proxy_pool_(http_proxy_pool),
 193       client_socket_factory_(client_socket_factory),
 194       context_(context.cert_verifier,
 195                context.channel_id_service,
 196                context.transport_security_state,
 197                context.cert_transparency_verifier,
 198                context.cert_policy_enforcer,
 199                (params->privacy_mode() == PRIVACY_MODE_ENABLED
 200                     ? "pm/" + context.ssl_session_cache_shard
 201                     : context.ssl_session_cache_shard)),
 202       io_callback_(
 203           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
 204       messenger_(NULL),
 205       get_messenger_callback_(get_messenger_callback),
 206       weak_factory_(this) {
 207 }
 208
 209 SSLConnectJob::~SSLConnectJob() {
 210   if (ssl_socket_.get() && messenger_)
 211     messenger_->RemovePendingSocket(ssl_socket_.get());
 212 }
 213
 214 LoadState SSLConnectJob::GetLoadState() const {
 215   switch (next_state_) {
 216     case STATE_TUNNEL_CONNECT_COMPLETE:
 217       if (transport_socket_handle_->socket())
 218         return LOAD_STATE_ESTABLISHING_PROXY_TUNNEL;
 219       // else, fall through.
 220     case STATE_TRANSPORT_CONNECT:
 221     case STATE_TRANSPORT_CONNECT_COMPLETE:
 222     case STATE_SOCKS_CONNECT:
 223     case STATE_SOCKS_CONNECT_COMPLETE:
 224     case STATE_TUNNEL_CONNECT:
 225       return transport_socket_handle_->GetLoadState();
 226     case STATE_CREATE_SSL_SOCKET:
 227     case STATE_CHECK_FOR_RESUME:
 228     case STATE_SSL_CONNECT:
 229     case STATE_SSL_CONNECT_COMPLETE:
 230       return LOAD_STATE_SSL_HANDSHAKE;
 231     default:
 232       NOTREACHED();
 233       return LOAD_STATE_IDLE;
 234   }
 235 }
 236
 237 void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle* handle) {
 238   // Headers in |error_response_info_| indicate a proxy tunnel setup
 239   // problem. See DoTunnelConnectComplete.
 240   if (error_response_info_.headers.get()) {
 241     handle->set_pending_http_proxy_connection(
 242         transport_socket_handle_.release());
 243   }
 244   handle->set_ssl_error_response_info(error_response_info_);
 245   if (!connect_timing_.ssl_start.is_null())
 246     handle->set_is_ssl_error(true);
 247 }
 248
 249 void SSLConnectJob::OnIOComplete(int result) {
 250   int rv = DoLoop(result);
 251   if (rv != ERR_IO_PENDING)
 252     NotifyDelegateOfCompletion(rv);  // Deletes |this|.
 253 }
 254
 255 int SSLConnectJob::DoLoop(int result) {
 256   DCHECK_NE(next_state_, STATE_NONE);
 257
 258   int rv = result;
 259   do {
 260     State state = next_state_;
 261     next_state_ = STATE_NONE;
 262     switch (state) {
 263       case STATE_TRANSPORT_CONNECT:
 264         DCHECK_EQ(OK, rv);
 265         rv = DoTransportConnect();
 266         break;
 267       case STATE_TRANSPORT_CONNECT_COMPLETE:
 268         rv = DoTransportConnectComplete(rv);
 269         break;
 270       case STATE_SOCKS_CONNECT:
 271         DCHECK_EQ(OK, rv);
 272         rv = DoSOCKSConnect();
 273         break;
 274       case STATE_SOCKS_CONNECT_COMPLETE:
 275         rv = DoSOCKSConnectComplete(rv);
 276         break;
 277       case STATE_TUNNEL_CONNECT:
 278         DCHECK_EQ(OK, rv);
 279         rv = DoTunnelConnect();
 280         break;
 281       case STATE_TUNNEL_CONNECT_COMPLETE:
 282         rv = DoTunnelConnectComplete(rv);
 283         break;
 284       case STATE_CREATE_SSL_SOCKET:
 285         rv = DoCreateSSLSocket();
 286         break;
 287       case STATE_CHECK_FOR_RESUME:
 288         rv = DoCheckForResume();
 289         break;
 290       case STATE_SSL_CONNECT:
 291         DCHECK_EQ(OK, rv);
 292         rv = DoSSLConnect();
 293         break;
 294       case STATE_SSL_CONNECT_COMPLETE:
 295         rv = DoSSLConnectComplete(rv);
 296         break;
 297       default:
 298         NOTREACHED() << "bad state";
 299         rv = ERR_FAILED;
 300         break;
 301     }
 302   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 303
 304   return rv;
 305 }
 306
 307 int SSLConnectJob::DoTransportConnect() {
 308   DCHECK(transport_pool_);
 309
 310   next_state_ = STATE_TRANSPORT_CONNECT_COMPLETE;
 311   transport_socket_handle_.reset(new ClientSocketHandle());
 312   scoped_refptr<TransportSocketParams> direct_params =
 313       params_->GetDirectConnectionParams();
 314   return transport_socket_handle_->Init(group_name(),
 315                                         direct_params,
 316                                         priority(),
 317                                         io_callback_,
 318                                         transport_pool_,
 319                                         net_log());
 320 }
 321
 322 int SSLConnectJob::DoTransportConnectComplete(int result) {
 323   if (result == OK)
 324     next_state_ = STATE_CREATE_SSL_SOCKET;
 325
 326   return result;
 327 }
 328
 329 int SSLConnectJob::DoSOCKSConnect() {
 330   DCHECK(socks_pool_);
 331   next_state_ = STATE_SOCKS_CONNECT_COMPLETE;
 332   transport_socket_handle_.reset(new ClientSocketHandle());
 333   scoped_refptr<SOCKSSocketParams> socks_proxy_params =
 334       params_->GetSocksProxyConnectionParams();
 335   return transport_socket_handle_->Init(group_name(),
 336                                         socks_proxy_params,
 337                                         priority(),
 338                                         io_callback_,
 339                                         socks_pool_,
 340                                         net_log());
 341 }
 342
 343 int SSLConnectJob::DoSOCKSConnectComplete(int result) {
 344   if (result == OK)
 345     next_state_ = STATE_CREATE_SSL_SOCKET;
 346
 347   return result;
 348 }
 349
 350 int SSLConnectJob::DoTunnelConnect() {
 351   DCHECK(http_proxy_pool_);
 352   next_state_ = STATE_TUNNEL_CONNECT_COMPLETE;
 353
 354   transport_socket_handle_.reset(new ClientSocketHandle());
 355   scoped_refptr<HttpProxySocketParams> http_proxy_params =
 356       params_->GetHttpProxyConnectionParams();
 357   return transport_socket_handle_->Init(group_name(),
 358                                         http_proxy_params,
 359                                         priority(),
 360                                         io_callback_,
 361                                         http_proxy_pool_,
 362                                         net_log());
 363 }
 364
 365 int SSLConnectJob::DoTunnelConnectComplete(int result) {
 366   // Extract the information needed to prompt for appropriate proxy
 367   // authentication so that when ClientSocketPoolBaseHelper calls
 368   // |GetAdditionalErrorState|, we can easily set the state.
 369   if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 370     error_response_info_ = transport_socket_handle_->ssl_error_response_info();
 371   } else if (result == ERR_PROXY_AUTH_REQUESTED ||
 372              result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
 373     StreamSocket* socket = transport_socket_handle_->socket();
 374     ProxyClientSocket* tunnel_socket = static_cast<ProxyClientSocket*>(socket);
 375     error_response_info_ = *tunnel_socket->GetConnectResponseInfo();
 376   }
 377   if (result < 0)
 378     return result;
 379   next_state_ = STATE_CREATE_SSL_SOCKET;
 380   return result;
 381 }
 382
 383 int SSLConnectJob::DoCreateSSLSocket() {
 384   // TODO(pkasting): Remove ScopedTracker below once crbug.com/462815 is fixed.
 385   tracked_objects::ScopedTracker tracking_profile(
 386       FROM_HERE_WITH_EXPLICIT_FUNCTION(
 387           "462815 SSLConnectJob::DoCreateSSLSocket"));
 388   next_state_ = STATE_CHECK_FOR_RESUME;
 389
 390   // Reset the timeout to just the time allowed for the SSL handshake.
 391   ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
 392
 393   // If the handle has a fresh socket, get its connect start and DNS times.
 394   // This should always be the case.
 395   const LoadTimingInfo::ConnectTiming& socket_connect_timing =
 396       transport_socket_handle_->connect_timing();
 397   if (!transport_socket_handle_->is_reused() &&
 398       !socket_connect_timing.connect_start.is_null()) {
 399     // Overwriting |connect_start| serves two purposes - it adjusts timing so
 400     // |connect_start| doesn't include dns times, and it adjusts the time so
 401     // as not to include time spent waiting for an idle socket.
 402     connect_timing_.connect_start = socket_connect_timing.connect_start;
 403     connect_timing_.dns_start = socket_connect_timing.dns_start;
 404     connect_timing_.dns_end = socket_connect_timing.dns_end;
 405   }
 406
 407   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
 408       transport_socket_handle_.Pass(),
 409       params_->host_and_port(),
 410       params_->ssl_config(),
 411       context_);
 412
 413   if (!ssl_socket_->InSessionCache())
 414     messenger_ = get_messenger_callback_.Run(ssl_socket_->GetSessionCacheKey());
 415
 416   return OK;
 417 }
 418
 419 int SSLConnectJob::DoCheckForResume() {
 420   next_state_ = STATE_SSL_CONNECT;
 421
 422   if (!messenger_)
 423     return OK;
 424
 425   if (messenger_->CanProceed(ssl_socket_.get())) {
 426     messenger_->MonitorConnectionResult(ssl_socket_.get());
 427     // The SSLConnectJob no longer needs access to the messenger after this
 428     // point.
 429     messenger_ = NULL;
 430     return OK;
 431   }
 432
 433   messenger_->AddPendingSocket(ssl_socket_.get(),
 434                                base::Bind(&SSLConnectJob::ResumeSSLConnection,
 435                                           weak_factory_.GetWeakPtr()));
 436
 437   return ERR_IO_PENDING;
 438 }
 439
 440 int SSLConnectJob::DoSSLConnect() {
 441   // TODO(pkasting): Remove ScopedTracker below once crbug.com/462813 is fixed.
 442   tracked_objects::ScopedTracker tracking_profile(
 443       FROM_HERE_WITH_EXPLICIT_FUNCTION("462813 SSLConnectJob::DoSSLConnect"));
 444   next_state_ = STATE_SSL_CONNECT_COMPLETE;
 445
 446   connect_timing_.ssl_start = base::TimeTicks::Now();
 447
 448   return ssl_socket_->Connect(io_callback_);
 449 }
 450
 451 int SSLConnectJob::DoSSLConnectComplete(int result) {
 452   connect_timing_.ssl_end = base::TimeTicks::Now();
 453
 454   SSLClientSocket::NextProtoStatus status =
 455       SSLClientSocket::kNextProtoUnsupported;
 456   std::string proto;
 457   // GetNextProto will fail and and trigger a NOTREACHED if we pass in a socket
 458   // that hasn't had SSL_ImportFD called on it. If we get a certificate error
 459   // here, then we know that we called SSL_ImportFD.
 460   if (result == OK || IsCertificateError(result)) {
 461     status = ssl_socket_->GetNextProto(&proto);
 462     ssl_socket_->RecordNegotiationExtension();
 463   }
 464
 465   // If we want spdy over npn, make sure it succeeded.
 466   if (status == SSLClientSocket::kNextProtoNegotiated) {
 467     ssl_socket_->set_was_npn_negotiated(true);
 468     NextProto protocol_negotiated =
 469         SSLClientSocket::NextProtoFromString(proto);
 470     ssl_socket_->set_protocol_negotiated(protocol_negotiated);
 471     // If we negotiated a SPDY version, it must have been present in
 472     // SSLConfig::next_protos.
 473     // TODO(mbelshe): Verify this.
 474     if (protocol_negotiated >= kProtoSPDYMinimumVersion &&
 475         protocol_negotiated <= kProtoSPDYMaximumVersion) {
 476       ssl_socket_->set_was_spdy_negotiated(true);
 477     }
 478   }
 479   if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated())
 480     return ERR_NPN_NEGOTIATION_FAILED;
 481
 482   // Spdy might be turned on by default, or it might be over npn.
 483   bool using_spdy = params_->force_spdy_over_ssl() ||
 484       params_->want_spdy_over_npn();
 485
 486   if (result == OK ||
 487       ssl_socket_->IgnoreCertError(result, params_->load_flags())) {
 488     DCHECK(!connect_timing_.ssl_start.is_null());
 489     base::TimeDelta connect_duration =
 490         connect_timing_.ssl_end - connect_timing_.ssl_start;
 491     if (using_spdy) {
 492       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency_2",
 493                                  connect_duration,
 494                                  base::TimeDelta::FromMilliseconds(1),
 495                                  base::TimeDelta::FromMinutes(1),
 496                                  100);
 497     }
 498
 499     UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_2",
 500                                connect_duration,
 501                                base::TimeDelta::FromMilliseconds(1),
 502                                base::TimeDelta::FromMinutes(1),
 503                                100);
 504
 505     SSLInfo ssl_info;
 506     bool has_ssl_info = ssl_socket_->GetSSLInfo(&ssl_info);
 507     DCHECK(has_ssl_info);
 508
 509     UMA_HISTOGRAM_ENUMERATION("Net.SSLVersion", SSLConnectionStatusToVersion(
 510                                                     ssl_info.connection_status),
 511                               SSL_CONNECTION_VERSION_MAX);
 512
 513     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite",
 514                                 SSLConnectionStatusToCipherSuite(
 515                                     ssl_info.connection_status));
 516
 517     UMA_HISTOGRAM_BOOLEAN(
 518         "Net.RenegotiationExtensionSupported",
 519         (ssl_info.connection_status &
 520          SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) == 0);
 521
 522     if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 523       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Resume_Handshake",
 524                                  connect_duration,
 525                                  base::TimeDelta::FromMilliseconds(1),
 526                                  base::TimeDelta::FromMinutes(1),
 527                                  100);
 528     } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 529       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Full_Handshake",
 530                                  connect_duration,
 531                                  base::TimeDelta::FromMilliseconds(1),
 532                                  base::TimeDelta::FromMinutes(1),
 533                                  100);
 534     }
 535
 536     const std::string& host = params_->host_and_port().host();
 537     bool is_google =
 538         host == "google.com" ||
 539         (host.size() > 11 && host.rfind(".google.com") == host.size() - 11);
 540     if (is_google) {
 541       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google2",
 542                                  connect_duration,
 543                                  base::TimeDelta::FromMilliseconds(1),
 544                                  base::TimeDelta::FromMinutes(1),
 545                                  100);
 546       if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
 547         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 548                                        "Resume_Handshake",
 549                                    connect_duration,
 550                                    base::TimeDelta::FromMilliseconds(1),
 551                                    base::TimeDelta::FromMinutes(1),
 552                                    100);
 553       } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
 554         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
 555                                        "Full_Handshake",
 556                                    connect_duration,
 557                                    base::TimeDelta::FromMilliseconds(1),
 558                                    base::TimeDelta::FromMinutes(1),
 559                                    100);
 560       }
 561     }
 562   }
 563
 564   UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error", std::abs(result));
 565   if (params_->ssl_config().fastradio_padding_eligible) {
 566     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_Connection_Error_FastRadioPadding",
 567                                 std::abs(result));
 568   }
 569
 570   if (result == OK || IsCertificateError(result)) {
 571     SetSocket(ssl_socket_.Pass());
 572   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
 573     error_response_info_.cert_request_info = new SSLCertRequestInfo;
 574     ssl_socket_->GetSSLCertRequestInfo(
 575         error_response_info_.cert_request_info.get());
 576   }
 577
 578   return result;
 579 }
 580
 581 void SSLConnectJob::ResumeSSLConnection() {
 582   DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
 583   messenger_ = NULL;
 584   OnIOComplete(OK);
 585 }
 586
 587 SSLConnectJob::State SSLConnectJob::GetInitialState(
 588     SSLSocketParams::ConnectionType connection_type) {
 589   switch (connection_type) {
 590     case SSLSocketParams::DIRECT:
 591       return STATE_TRANSPORT_CONNECT;
 592     case SSLSocketParams::HTTP_PROXY:
 593       return STATE_TUNNEL_CONNECT;
 594     case SSLSocketParams::SOCKS_PROXY:
 595       return STATE_SOCKS_CONNECT;
 596   }
 597   NOTREACHED();
 598   return STATE_NONE;
 599 }
 600
 601 int SSLConnectJob::ConnectInternal() {
 602   next_state_ = GetInitialState(params_->GetConnectionType());
 603   return DoLoop(OK);
 604 }
 605
 606 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
 607     TransportClientSocketPool* transport_pool,
 608     SOCKSClientSocketPool* socks_pool,
 609     HttpProxyClientSocketPool* http_proxy_pool,
 610     ClientSocketFactory* client_socket_factory,
 611     const SSLClientSocketContext& context,
 612     const SSLConnectJob::GetMessengerCallback& get_messenger_callback,
 613     NetLog* net_log)
 614     : transport_pool_(transport_pool),
 615       socks_pool_(socks_pool),
 616       http_proxy_pool_(http_proxy_pool),
 617       client_socket_factory_(client_socket_factory),
 618       context_(context),
 619       get_messenger_callback_(get_messenger_callback),
 620       net_log_(net_log) {
 621   base::TimeDelta max_transport_timeout = base::TimeDelta();
 622   base::TimeDelta pool_timeout;
 623   if (transport_pool_)
 624     max_transport_timeout = transport_pool_->ConnectionTimeout();
 625   if (socks_pool_) {
 626     pool_timeout = socks_pool_->ConnectionTimeout();
 627     if (pool_timeout > max_transport_timeout)
 628       max_transport_timeout = pool_timeout;
 629   }
 630   if (http_proxy_pool_) {
 631     pool_timeout = http_proxy_pool_->ConnectionTimeout();
 632     if (pool_timeout > max_transport_timeout)
 633       max_transport_timeout = pool_timeout;
 634   }
 635   timeout_ = max_transport_timeout +
 636       base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds);
 637 }
 638
 639 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
 640 }
 641
 642 SSLClientSocketPool::SSLClientSocketPool(
 643     int max_sockets,
 644     int max_sockets_per_group,
 645     ClientSocketPoolHistograms* histograms,
 646     CertVerifier* cert_verifier,
 647     ChannelIDService* channel_id_service,
 648     TransportSecurityState* transport_security_state,
 649     CTVerifier* cert_transparency_verifier,
 650     CertPolicyEnforcer* cert_policy_enforcer,
 651     const std::string& ssl_session_cache_shard,
 652     ClientSocketFactory* client_socket_factory,
 653     TransportClientSocketPool* transport_pool,
 654     SOCKSClientSocketPool* socks_pool,
 655     HttpProxyClientSocketPool* http_proxy_pool,
 656     SSLConfigService* ssl_config_service,
 657     bool enable_ssl_connect_job_waiting,
 658     NetLog* net_log)
 659     : transport_pool_(transport_pool),
 660       socks_pool_(socks_pool),
 661       http_proxy_pool_(http_proxy_pool),
 662       base_(this,
 663             max_sockets,
 664             max_sockets_per_group,
 665             histograms,
 666             ClientSocketPool::unused_idle_socket_timeout(),
 667             ClientSocketPool::used_idle_socket_timeout(),
 668             new SSLConnectJobFactory(
 669                 transport_pool,
 670                 socks_pool,
 671                 http_proxy_pool,
 672                 client_socket_factory,
 673                 SSLClientSocketContext(cert_verifier,
 674                                        channel_id_service,
 675                                        transport_security_state,
 676                                        cert_transparency_verifier,
 677                                        cert_policy_enforcer,
 678                                        ssl_session_cache_shard),
 679                 base::Bind(
 680                     &SSLClientSocketPool::GetOrCreateSSLConnectJobMessenger,
 681                     base::Unretained(this)),
 682                 net_log)),
 683       ssl_config_service_(ssl_config_service),
 684       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting) {
 685   if (ssl_config_service_.get())
 686     ssl_config_service_->AddObserver(this);
 687   if (transport_pool_)
 688     base_.AddLowerLayeredPool(transport_pool_);
 689   if (socks_pool_)
 690     base_.AddLowerLayeredPool(socks_pool_);
 691   if (http_proxy_pool_)
 692     base_.AddLowerLayeredPool(http_proxy_pool_);
 693 }
 694
 695 SSLClientSocketPool::~SSLClientSocketPool() {
 696   STLDeleteContainerPairSecondPointers(messenger_map_.begin(),
 697                                        messenger_map_.end());
 698   if (ssl_config_service_.get())
 699     ssl_config_service_->RemoveObserver(this);
 700 }
 701
 702 scoped_ptr<ConnectJob> SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
 703     const std::string& group_name,
 704     const PoolBase::Request& request,
 705     ConnectJob::Delegate* delegate) const {
 706   return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
 707                                                   request.priority(),
 708                                                   request.params(),
 709                                                   ConnectionTimeout(),
 710                                                   transport_pool_,
 711                                                   socks_pool_,
 712                                                   http_proxy_pool_,
 713                                                   client_socket_factory_,
 714                                                   context_,
 715                                                   get_messenger_callback_,
 716                                                   delegate,
 717                                                   net_log_));
 718 }
 719
 720 base::TimeDelta SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout()
 721     const {
 722   return timeout_;
 723 }
 724
 725 int SSLClientSocketPool::RequestSocket(const std::string& group_name,
 726                                        const void* socket_params,
 727                                        RequestPriority priority,
 728                                        ClientSocketHandle* handle,
 729                                        const CompletionCallback& callback,
 730                                        const BoundNetLog& net_log) {
 731   const scoped_refptr<SSLSocketParams>* casted_socket_params =
 732       static_cast<const scoped_refptr<SSLSocketParams>*>(socket_params);
 733
 734   return base_.RequestSocket(group_name, *casted_socket_params, priority,
 735                              handle, callback, net_log);
 736 }
 737
 738 void SSLClientSocketPool::RequestSockets(
 739     const std::string& group_name,
 740     const void* params,
 741     int num_sockets,
 742     const BoundNetLog& net_log) {
 743   const scoped_refptr<SSLSocketParams>* casted_params =
 744       static_cast<const scoped_refptr<SSLSocketParams>*>(params);
 745
 746   base_.RequestSockets(group_name, *casted_params, num_sockets, net_log);
 747 }
 748
 749 void SSLClientSocketPool::CancelRequest(const std::string& group_name,
 750                                         ClientSocketHandle* handle) {
 751   base_.CancelRequest(group_name, handle);
 752 }
 753
 754 void SSLClientSocketPool::ReleaseSocket(const std::string& group_name,
 755                                         scoped_ptr<StreamSocket> socket,
 756                                         int id) {
 757   base_.ReleaseSocket(group_name, socket.Pass(), id);
 758 }
 759
 760 void SSLClientSocketPool::FlushWithError(int error) {
 761   base_.FlushWithError(error);
 762 }
 763
 764 void SSLClientSocketPool::CloseIdleSockets() {
 765   base_.CloseIdleSockets();
 766 }
 767
 768 int SSLClientSocketPool::IdleSocketCount() const {
 769   return base_.idle_socket_count();
 770 }
 771
 772 int SSLClientSocketPool::IdleSocketCountInGroup(
 773     const std::string& group_name) const {
 774   return base_.IdleSocketCountInGroup(group_name);
 775 }
 776
 777 LoadState SSLClientSocketPool::GetLoadState(
 778     const std::string& group_name, const ClientSocketHandle* handle) const {
 779   return base_.GetLoadState(group_name, handle);
 780 }
 781
 782 base::DictionaryValue* SSLClientSocketPool::GetInfoAsValue(
 783     const std::string& name,
 784     const std::string& type,
 785     bool include_nested_pools) const {
 786   base::DictionaryValue* dict = base_.GetInfoAsValue(name, type);
 787   if (include_nested_pools) {
 788     base::ListValue* list = new base::ListValue();
 789     if (transport_pool_) {
 790       list->Append(transport_pool_->GetInfoAsValue("transport_socket_pool",
 791                                                    "transport_socket_pool",
 792                                                    false));
 793     }
 794     if (socks_pool_) {
 795       list->Append(socks_pool_->GetInfoAsValue("socks_pool",
 796                                                "socks_pool",
 797                                                true));
 798     }
 799     if (http_proxy_pool_) {
 800       list->Append(http_proxy_pool_->GetInfoAsValue("http_proxy_pool",
 801                                                     "http_proxy_pool",
 802                                                     true));
 803     }
 804     dict->Set("nested_pools", list);
 805   }
 806   return dict;
 807 }
 808
 809 base::TimeDelta SSLClientSocketPool::ConnectionTimeout() const {
 810   return base_.ConnectionTimeout();
 811 }
 812
 813 ClientSocketPoolHistograms* SSLClientSocketPool::histograms() const {
 814   return base_.histograms();
 815 }
 816
 817 bool SSLClientSocketPool::IsStalled() const {
 818   return base_.IsStalled();
 819 }
 820
 821 void SSLClientSocketPool::AddHigherLayeredPool(HigherLayeredPool* higher_pool) {
 822   base_.AddHigherLayeredPool(higher_pool);
 823 }
 824
 825 void SSLClientSocketPool::RemoveHigherLayeredPool(
 826     HigherLayeredPool* higher_pool) {
 827   base_.RemoveHigherLayeredPool(higher_pool);
 828 }
 829
 830 bool SSLClientSocketPool::CloseOneIdleConnection() {
 831   if (base_.CloseOneIdleSocket())
 832     return true;
 833   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 834 }
 835
 836 SSLConnectJobMessenger* SSLClientSocketPool::GetOrCreateSSLConnectJobMessenger(
 837     const std::string& cache_key) {
 838   if (!enable_ssl_connect_job_waiting_)
 839     return NULL;
 840   MessengerMap::const_iterator it = messenger_map_.find(cache_key);
 841   if (it == messenger_map_.end()) {
 842     std::pair<MessengerMap::iterator, bool> iter =
 843         messenger_map_.insert(MessengerMap::value_type(
 844             cache_key,
 845             new SSLConnectJobMessenger(
 846                 base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
 847                            base::Unretained(this),
 848                            cache_key))));
 849     it = iter.first;
 850   }
 851   return it->second;
 852 }
 853
 854 void SSLClientSocketPool::DeleteSSLConnectJobMessenger(
 855     const std::string& cache_key) {
 856   MessengerMap::iterator it = messenger_map_.find(cache_key);
 857   CHECK(it != messenger_map_.end());
 858   delete it->second;
 859   messenger_map_.erase(it);
 860 }
 861
 862 void SSLClientSocketPool::OnSSLConfigChanged() {
 863   FlushWithError(ERR_NETWORK_CHANGED);
 864 }
 865
 866 }  // namespace net