// Copyright (c) 2012 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. // OpenSSL binding for SSLClientSocket. The class layout and general principle // of operation is derived from SSLClientSocketNSS. #include "net/socket/ssl_client_socket_openssl.h" #include #include #include #include #include #include "base/bind.h" #include "base/callback_helpers.h" #include "base/environment.h" #include "base/memory/singleton.h" #include "base/metrics/histogram.h" #include "base/profiler/scoped_tracker.h" #include "base/strings/string_piece.h" #include "base/synchronization/lock.h" #include "base/threading/thread_local.h" #include "crypto/ec_private_key.h" #include "crypto/openssl_util.h" #include "crypto/scoped_openssl_types.h" #include "net/base/net_errors.h" #include "net/cert/cert_policy_enforcer.h" #include "net/cert/cert_verifier.h" #include "net/cert/ct_ev_whitelist.h" #include "net/cert/ct_verifier.h" #include "net/cert/single_request_cert_verifier.h" #include "net/cert/x509_certificate_net_log_param.h" #include "net/cert/x509_util_openssl.h" #include "net/http/transport_security_state.h" #include "net/socket/ssl_session_cache_openssl.h" #include "net/ssl/scoped_openssl_types.h" #include "net/ssl/ssl_cert_request_info.h" #include "net/ssl/ssl_connection_status_flags.h" #include "net/ssl/ssl_info.h" #if defined(OS_WIN) #include "base/win/windows_version.h" #endif #if defined(USE_OPENSSL_CERTS) #include "net/ssl/openssl_client_key_store.h" #else #include "net/ssl/openssl_platform_key.h" #endif namespace net { namespace { // Enable this to see logging for state machine state transitions. #if 0 #define GotoState(s) do { DVLOG(2) << (void *)this << " " << __FUNCTION__ << \ " jump to state " << s; \ next_handshake_state_ = s; } while (0) #else #define GotoState(s) next_handshake_state_ = s #endif // This constant can be any non-negative/non-zero value (eg: it does not // overlap with any value of the net::Error range, including net::OK). const int kNoPendingReadResult = 1; // If a client doesn't have a list of protocols that it supports, but // the server supports NPN, choosing "http/1.1" is the best answer. const char kDefaultSupportedNPNProtocol[] = "http/1.1"; // Default size of the internal BoringSSL buffers. const int KDefaultOpenSSLBufferSize = 17 * 1024; void FreeX509Stack(STACK_OF(X509)* ptr) { sk_X509_pop_free(ptr, X509_free); } using ScopedX509Stack = crypto::ScopedOpenSSL; #if OPENSSL_VERSION_NUMBER < 0x1000103fL // This method doesn't seem to have made it into the OpenSSL headers. unsigned long SSL_CIPHER_get_id(const SSL_CIPHER* cipher) { return cipher->id; } #endif // Used for encoding the |connection_status| field of an SSLInfo object. int EncodeSSLConnectionStatus(uint16 cipher_suite, int compression, int version) { return cipher_suite | ((compression & SSL_CONNECTION_COMPRESSION_MASK) << SSL_CONNECTION_COMPRESSION_SHIFT) | ((version & SSL_CONNECTION_VERSION_MASK) << SSL_CONNECTION_VERSION_SHIFT); } // Returns the net SSL version number (see ssl_connection_status_flags.h) for // this SSL connection. int GetNetSSLVersion(SSL* ssl) { switch (SSL_version(ssl)) { case SSL2_VERSION: return SSL_CONNECTION_VERSION_SSL2; case SSL3_VERSION: return SSL_CONNECTION_VERSION_SSL3; case TLS1_VERSION: return SSL_CONNECTION_VERSION_TLS1; case TLS1_1_VERSION: return SSL_CONNECTION_VERSION_TLS1_1; case TLS1_2_VERSION: return SSL_CONNECTION_VERSION_TLS1_2; default: return SSL_CONNECTION_VERSION_UNKNOWN; } } ScopedX509 OSCertHandleToOpenSSL( X509Certificate::OSCertHandle os_handle) { #if defined(USE_OPENSSL_CERTS) return ScopedX509(X509Certificate::DupOSCertHandle(os_handle)); #else // !defined(USE_OPENSSL_CERTS) std::string der_encoded; if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded)) return ScopedX509(); const uint8_t* bytes = reinterpret_cast(der_encoded.data()); return ScopedX509(d2i_X509(NULL, &bytes, der_encoded.size())); #endif // defined(USE_OPENSSL_CERTS) } ScopedX509Stack OSCertHandlesToOpenSSL( const X509Certificate::OSCertHandles& os_handles) { ScopedX509Stack stack(sk_X509_new_null()); for (size_t i = 0; i < os_handles.size(); i++) { ScopedX509 x509 = OSCertHandleToOpenSSL(os_handles[i]); if (!x509) return ScopedX509Stack(); sk_X509_push(stack.get(), x509.release()); } return stack.Pass(); } int LogErrorCallback(const char* str, size_t len, void* context) { LOG(ERROR) << base::StringPiece(str, len); return 1; } bool IsOCSPStaplingSupported() { #if defined(OS_WIN) // CERT_OCSP_RESPONSE_PROP_ID is only implemented on Vista+, but it can be // set on Windows XP without error. There is some overhead from the server // sending the OCSP response if it supports the extension, for the subset of // XP clients who will request it but be unable to use it, but this is an // acceptable trade-off for simplicity of implementation. return true; #else return false; #endif } } // namespace class SSLClientSocketOpenSSL::SSLContext { public: static SSLContext* GetInstance() { return Singleton::get(); } SSL_CTX* ssl_ctx() { return ssl_ctx_.get(); } SSLSessionCacheOpenSSL* session_cache() { return &session_cache_; } SSLClientSocketOpenSSL* GetClientSocketFromSSL(const SSL* ssl) { DCHECK(ssl); SSLClientSocketOpenSSL* socket = static_cast( SSL_get_ex_data(ssl, ssl_socket_data_index_)); DCHECK(socket); return socket; } bool SetClientSocketForSSL(SSL* ssl, SSLClientSocketOpenSSL* socket) { return SSL_set_ex_data(ssl, ssl_socket_data_index_, socket) != 0; } private: friend struct DefaultSingletonTraits; SSLContext() { crypto::EnsureOpenSSLInit(); ssl_socket_data_index_ = SSL_get_ex_new_index(0, 0, 0, 0, 0); DCHECK_NE(ssl_socket_data_index_, -1); ssl_ctx_.reset(SSL_CTX_new(SSLv23_client_method())); session_cache_.Reset(ssl_ctx_.get(), kDefaultSessionCacheConfig); SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(), CertVerifyCallback, NULL); SSL_CTX_set_cert_cb(ssl_ctx_.get(), ClientCertRequestCallback, NULL); SSL_CTX_set_verify(ssl_ctx_.get(), SSL_VERIFY_PEER, NULL); // This stops |SSL_shutdown| from generating the close_notify message, which // is currently not sent on the network. // TODO(haavardm): Remove setting quiet shutdown once 118366 is fixed. SSL_CTX_set_quiet_shutdown(ssl_ctx_.get(), 1); // TODO(kristianm): Only select this if ssl_config_.next_proto is not empty. // It would be better if the callback were not a global setting, // but that is an OpenSSL issue. SSL_CTX_set_next_proto_select_cb(ssl_ctx_.get(), SelectNextProtoCallback, NULL); ssl_ctx_->tlsext_channel_id_enabled_new = 1; scoped_ptr env(base::Environment::Create()); std::string ssl_keylog_file; if (env->GetVar("SSLKEYLOGFILE", &ssl_keylog_file) && !ssl_keylog_file.empty()) { crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); BIO* bio = BIO_new_file(ssl_keylog_file.c_str(), "a"); if (!bio) { LOG(ERROR) << "Failed to open " << ssl_keylog_file; ERR_print_errors_cb(&LogErrorCallback, NULL); } else { SSL_CTX_set_keylog_bio(ssl_ctx_.get(), bio); } } } static std::string GetSessionCacheKey(const SSL* ssl) { SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl); DCHECK(socket); return socket->GetSessionCacheKey(); } static SSLSessionCacheOpenSSL::Config kDefaultSessionCacheConfig; static int ClientCertRequestCallback(SSL* ssl, void* arg) { SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl); DCHECK(socket); return socket->ClientCertRequestCallback(ssl); } static int CertVerifyCallback(X509_STORE_CTX *store_ctx, void *arg) { SSL* ssl = reinterpret_cast(X509_STORE_CTX_get_ex_data( store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx())); SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl); CHECK(socket); return socket->CertVerifyCallback(store_ctx); } static int SelectNextProtoCallback(SSL* ssl, unsigned char** out, unsigned char* outlen, const unsigned char* in, unsigned int inlen, void* arg) { SSLClientSocketOpenSSL* socket = GetInstance()->GetClientSocketFromSSL(ssl); return socket->SelectNextProtoCallback(out, outlen, in, inlen); } // This is the index used with SSL_get_ex_data to retrieve the owner // SSLClientSocketOpenSSL object from an SSL instance. int ssl_socket_data_index_; ScopedSSL_CTX ssl_ctx_; // |session_cache_| must be destroyed before |ssl_ctx_|. SSLSessionCacheOpenSSL session_cache_; }; // PeerCertificateChain is a helper object which extracts the certificate // chain, as given by the server, from an OpenSSL socket and performs the needed // resource management. The first element of the chain is the leaf certificate // and the other elements are in the order given by the server. class SSLClientSocketOpenSSL::PeerCertificateChain { public: explicit PeerCertificateChain(STACK_OF(X509)* chain) { Reset(chain); } PeerCertificateChain(const PeerCertificateChain& other) { *this = other; } ~PeerCertificateChain() {} PeerCertificateChain& operator=(const PeerCertificateChain& other); // Resets the PeerCertificateChain to the set of certificates in|chain|, // which may be NULL, indicating to empty the store certificates. // Note: If an error occurs, such as being unable to parse the certificates, // this will behave as if Reset(NULL) was called. void Reset(STACK_OF(X509)* chain); // Note that when USE_OPENSSL is defined, OSCertHandle is X509* scoped_refptr AsOSChain() const; size_t size() const { if (!openssl_chain_.get()) return 0; return sk_X509_num(openssl_chain_.get()); } bool empty() const { return size() == 0; } X509* Get(size_t index) const { DCHECK_LT(index, size()); return sk_X509_value(openssl_chain_.get(), index); } private: ScopedX509Stack openssl_chain_; }; SSLClientSocketOpenSSL::PeerCertificateChain& SSLClientSocketOpenSSL::PeerCertificateChain::operator=( const PeerCertificateChain& other) { if (this == &other) return *this; openssl_chain_.reset(X509_chain_up_ref(other.openssl_chain_.get())); return *this; } void SSLClientSocketOpenSSL::PeerCertificateChain::Reset( STACK_OF(X509)* chain) { openssl_chain_.reset(chain ? X509_chain_up_ref(chain) : NULL); } scoped_refptr SSLClientSocketOpenSSL::PeerCertificateChain::AsOSChain() const { #if defined(USE_OPENSSL_CERTS) // When OSCertHandle is typedef'ed to X509, this implementation does a short // cut to avoid converting back and forth between DER and the X509 struct. X509Certificate::OSCertHandles intermediates; for (size_t i = 1; i < sk_X509_num(openssl_chain_.get()); ++i) { intermediates.push_back(sk_X509_value(openssl_chain_.get(), i)); } return make_scoped_refptr(X509Certificate::CreateFromHandle( sk_X509_value(openssl_chain_.get(), 0), intermediates)); #else // DER-encode the chain and convert to a platform certificate handle. std::vector der_chain; for (size_t i = 0; i < sk_X509_num(openssl_chain_.get()); ++i) { X509* x = sk_X509_value(openssl_chain_.get(), i); base::StringPiece der; if (!x509_util::GetDER(x, &der)) return NULL; der_chain.push_back(der); } return make_scoped_refptr(X509Certificate::CreateFromDERCertChain(der_chain)); #endif } // static SSLSessionCacheOpenSSL::Config SSLClientSocketOpenSSL::SSLContext::kDefaultSessionCacheConfig = { &GetSessionCacheKey, // key_func 1024, // max_entries 256, // expiration_check_count 60 * 60, // timeout_seconds }; // static void SSLClientSocket::ClearSessionCache() { SSLClientSocketOpenSSL::SSLContext* context = SSLClientSocketOpenSSL::SSLContext::GetInstance(); context->session_cache()->Flush(); } // static uint16 SSLClientSocket::GetMaxSupportedSSLVersion() { return SSL_PROTOCOL_VERSION_TLS1_2; } SSLClientSocketOpenSSL::SSLClientSocketOpenSSL( scoped_ptr transport_socket, const HostPortPair& host_and_port, const SSLConfig& ssl_config, const SSLClientSocketContext& context) : transport_send_busy_(false), transport_recv_busy_(false), pending_read_error_(kNoPendingReadResult), pending_read_ssl_error_(SSL_ERROR_NONE), transport_read_error_(OK), transport_write_error_(OK), server_cert_chain_(new PeerCertificateChain(NULL)), completed_connect_(false), was_ever_used_(false), client_auth_cert_needed_(false), cert_verifier_(context.cert_verifier), cert_transparency_verifier_(context.cert_transparency_verifier), channel_id_service_(context.channel_id_service), ssl_(NULL), transport_bio_(NULL), transport_(transport_socket.Pass()), host_and_port_(host_and_port), ssl_config_(ssl_config), ssl_session_cache_shard_(context.ssl_session_cache_shard), trying_cached_session_(false), next_handshake_state_(STATE_NONE), npn_status_(kNextProtoUnsupported), channel_id_xtn_negotiated_(false), handshake_succeeded_(false), marked_session_as_good_(false), transport_security_state_(context.transport_security_state), policy_enforcer_(context.cert_policy_enforcer), net_log_(transport_->socket()->NetLog()), weak_factory_(this) { } SSLClientSocketOpenSSL::~SSLClientSocketOpenSSL() { Disconnect(); } std::string SSLClientSocketOpenSSL::GetSessionCacheKey() const { std::string result = host_and_port_.ToString(); result.append("/"); result.append(ssl_session_cache_shard_); return result; } bool SSLClientSocketOpenSSL::InSessionCache() const { SSLContext* context = SSLContext::GetInstance(); std::string cache_key = GetSessionCacheKey(); return context->session_cache()->SSLSessionIsInCache(cache_key); } void SSLClientSocketOpenSSL::SetHandshakeCompletionCallback( const base::Closure& callback) { handshake_completion_callback_ = callback; } void SSLClientSocketOpenSSL::GetSSLCertRequestInfo( SSLCertRequestInfo* cert_request_info) { cert_request_info->host_and_port = host_and_port_; cert_request_info->cert_authorities = cert_authorities_; cert_request_info->cert_key_types = cert_key_types_; } SSLClientSocket::NextProtoStatus SSLClientSocketOpenSSL::GetNextProto( std::string* proto) { *proto = npn_proto_; return npn_status_; } ChannelIDService* SSLClientSocketOpenSSL::GetChannelIDService() const { return channel_id_service_; } int SSLClientSocketOpenSSL::ExportKeyingMaterial( const base::StringPiece& label, bool has_context, const base::StringPiece& context, unsigned char* out, unsigned int outlen) { crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); int rv = SSL_export_keying_material( ssl_, out, outlen, label.data(), label.size(), reinterpret_cast(context.data()), context.length(), context.length() > 0); if (rv != 1) { int ssl_error = SSL_get_error(ssl_, rv); LOG(ERROR) << "Failed to export keying material;" << " returned " << rv << ", SSL error code " << ssl_error; return MapOpenSSLError(ssl_error, err_tracer); } return OK; } int SSLClientSocketOpenSSL::GetTLSUniqueChannelBinding(std::string* out) { NOTIMPLEMENTED(); return ERR_NOT_IMPLEMENTED; } int SSLClientSocketOpenSSL::Connect(const CompletionCallback& callback) { // It is an error to create an SSLClientSocket whose context has no // TransportSecurityState. DCHECK(transport_security_state_); net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT); // Set up new ssl object. int rv = Init(); if (rv != OK) { net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); return rv; } // Set SSL to client mode. Handshake happens in the loop below. SSL_set_connect_state(ssl_); // Enable fastradio padding. SSL_enable_fastradio_padding(ssl_, ssl_config_.fastradio_padding_enabled && ssl_config_.fastradio_padding_eligible); GotoState(STATE_HANDSHAKE); rv = DoHandshakeLoop(OK); if (rv == ERR_IO_PENDING) { user_connect_callback_ = callback; } else { net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); if (rv < OK) OnHandshakeCompletion(); } return rv > OK ? OK : rv; } void SSLClientSocketOpenSSL::Disconnect() { // If a handshake was pending (Connect() had been called), notify interested // parties that it's been aborted now. If the handshake had already // completed, this is a no-op. OnHandshakeCompletion(); if (ssl_) { // Calling SSL_shutdown prevents the session from being marked as // unresumable. SSL_shutdown(ssl_); SSL_free(ssl_); ssl_ = NULL; } if (transport_bio_) { BIO_free_all(transport_bio_); transport_bio_ = NULL; } // Shut down anything that may call us back. verifier_.reset(); transport_->socket()->Disconnect(); // Null all callbacks, delete all buffers. transport_send_busy_ = false; send_buffer_ = NULL; transport_recv_busy_ = false; recv_buffer_ = NULL; user_connect_callback_.Reset(); user_read_callback_.Reset(); user_write_callback_.Reset(); user_read_buf_ = NULL; user_read_buf_len_ = 0; user_write_buf_ = NULL; user_write_buf_len_ = 0; pending_read_error_ = kNoPendingReadResult; pending_read_ssl_error_ = SSL_ERROR_NONE; pending_read_error_info_ = OpenSSLErrorInfo(); transport_read_error_ = OK; transport_write_error_ = OK; server_cert_verify_result_.Reset(); completed_connect_ = false; cert_authorities_.clear(); cert_key_types_.clear(); client_auth_cert_needed_ = false; start_cert_verification_time_ = base::TimeTicks(); npn_status_ = kNextProtoUnsupported; npn_proto_.clear(); channel_id_xtn_negotiated_ = false; channel_id_request_handle_.Cancel(); } bool SSLClientSocketOpenSSL::IsConnected() const { // If the handshake has not yet completed. if (!completed_connect_) return false; // If an asynchronous operation is still pending. if (user_read_buf_.get() || user_write_buf_.get()) return true; return transport_->socket()->IsConnected(); } bool SSLClientSocketOpenSSL::IsConnectedAndIdle() const { // If the handshake has not yet completed. if (!completed_connect_) return false; // If an asynchronous operation is still pending. if (user_read_buf_.get() || user_write_buf_.get()) return false; // If there is data waiting to be sent, or data read from the network that // has not yet been consumed. if (BIO_pending(transport_bio_) > 0 || BIO_wpending(transport_bio_) > 0) { return false; } return transport_->socket()->IsConnectedAndIdle(); } int SSLClientSocketOpenSSL::GetPeerAddress(IPEndPoint* addressList) const { return transport_->socket()->GetPeerAddress(addressList); } int SSLClientSocketOpenSSL::GetLocalAddress(IPEndPoint* addressList) const { return transport_->socket()->GetLocalAddress(addressList); } const BoundNetLog& SSLClientSocketOpenSSL::NetLog() const { return net_log_; } void SSLClientSocketOpenSSL::SetSubresourceSpeculation() { if (transport_.get() && transport_->socket()) { transport_->socket()->SetSubresourceSpeculation(); } else { NOTREACHED(); } } void SSLClientSocketOpenSSL::SetOmniboxSpeculation() { if (transport_.get() && transport_->socket()) { transport_->socket()->SetOmniboxSpeculation(); } else { NOTREACHED(); } } bool SSLClientSocketOpenSSL::WasEverUsed() const { return was_ever_used_; } bool SSLClientSocketOpenSSL::UsingTCPFastOpen() const { if (transport_.get() && transport_->socket()) return transport_->socket()->UsingTCPFastOpen(); NOTREACHED(); return false; } bool SSLClientSocketOpenSSL::GetSSLInfo(SSLInfo* ssl_info) { ssl_info->Reset(); if (server_cert_chain_->empty()) return false; ssl_info->cert = server_cert_verify_result_.verified_cert; ssl_info->cert_status = server_cert_verify_result_.cert_status; ssl_info->is_issued_by_known_root = server_cert_verify_result_.is_issued_by_known_root; ssl_info->public_key_hashes = server_cert_verify_result_.public_key_hashes; ssl_info->client_cert_sent = ssl_config_.send_client_cert && ssl_config_.client_cert.get(); ssl_info->channel_id_sent = WasChannelIDSent(); ssl_info->pinning_failure_log = pinning_failure_log_; AddSCTInfoToSSLInfo(ssl_info); const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_); CHECK(cipher); ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL); ssl_info->connection_status = EncodeSSLConnectionStatus( static_cast(SSL_CIPHER_get_id(cipher)), 0 /* no compression */, GetNetSSLVersion(ssl_)); if (!SSL_get_secure_renegotiation_support(ssl_)) ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION; if (ssl_config_.version_fallback) ssl_info->connection_status |= SSL_CONNECTION_VERSION_FALLBACK; ssl_info->handshake_type = SSL_session_reused(ssl_) ? SSLInfo::HANDSHAKE_RESUME : SSLInfo::HANDSHAKE_FULL; DVLOG(3) << "Encoded connection status: cipher suite = " << SSLConnectionStatusToCipherSuite(ssl_info->connection_status) << " version = " << SSLConnectionStatusToVersion(ssl_info->connection_status); return true; } int SSLClientSocketOpenSSL::Read(IOBuffer* buf, int buf_len, const CompletionCallback& callback) { user_read_buf_ = buf; user_read_buf_len_ = buf_len; int rv = DoReadLoop(); if (rv == ERR_IO_PENDING) { user_read_callback_ = callback; } else { if (rv > 0) was_ever_used_ = true; user_read_buf_ = NULL; user_read_buf_len_ = 0; if (rv <= 0) { // Failure of a read attempt may indicate a failed false start // connection. OnHandshakeCompletion(); } } return rv; } int SSLClientSocketOpenSSL::Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback) { user_write_buf_ = buf; user_write_buf_len_ = buf_len; int rv = DoWriteLoop(); if (rv == ERR_IO_PENDING) { user_write_callback_ = callback; } else { if (rv > 0) was_ever_used_ = true; user_write_buf_ = NULL; user_write_buf_len_ = 0; if (rv < 0) { // Failure of a write attempt may indicate a failed false start // connection. OnHandshakeCompletion(); } } return rv; } int SSLClientSocketOpenSSL::SetReceiveBufferSize(int32 size) { return transport_->socket()->SetReceiveBufferSize(size); } int SSLClientSocketOpenSSL::SetSendBufferSize(int32 size) { return transport_->socket()->SetSendBufferSize(size); } int SSLClientSocketOpenSSL::Init() { DCHECK(!ssl_); DCHECK(!transport_bio_); SSLContext* context = SSLContext::GetInstance(); crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); ssl_ = SSL_new(context->ssl_ctx()); if (!ssl_ || !context->SetClientSocketForSSL(ssl_, this)) return ERR_UNEXPECTED; if (!SSL_set_tlsext_host_name(ssl_, host_and_port_.host().c_str())) return ERR_UNEXPECTED; // Set an OpenSSL callback to monitor this SSL*'s connection. SSL_set_info_callback(ssl_, &InfoCallback); trying_cached_session_ = context->session_cache()->SetSSLSessionWithKey( ssl_, GetSessionCacheKey()); send_buffer_ = new GrowableIOBuffer(); send_buffer_->SetCapacity(KDefaultOpenSSLBufferSize); recv_buffer_ = new GrowableIOBuffer(); recv_buffer_->SetCapacity(KDefaultOpenSSLBufferSize); BIO* ssl_bio = NULL; // SSLClientSocketOpenSSL retains ownership of the BIO buffers. if (!BIO_new_bio_pair_external_buf( &ssl_bio, send_buffer_->capacity(), reinterpret_cast(send_buffer_->data()), &transport_bio_, recv_buffer_->capacity(), reinterpret_cast(recv_buffer_->data()))) return ERR_UNEXPECTED; DCHECK(ssl_bio); DCHECK(transport_bio_); // Install a callback on OpenSSL's end to plumb transport errors through. BIO_set_callback(ssl_bio, BIOCallback); BIO_set_callback_arg(ssl_bio, reinterpret_cast(this)); SSL_set_bio(ssl_, ssl_bio, ssl_bio); // OpenSSL defaults some options to on, others to off. To avoid ambiguity, // set everything we care about to an absolute value. SslSetClearMask options; options.ConfigureFlag(SSL_OP_NO_SSLv2, true); bool ssl3_enabled = (ssl_config_.version_min == SSL_PROTOCOL_VERSION_SSL3); options.ConfigureFlag(SSL_OP_NO_SSLv3, !ssl3_enabled); bool tls1_enabled = (ssl_config_.version_min <= SSL_PROTOCOL_VERSION_TLS1 && ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1); options.ConfigureFlag(SSL_OP_NO_TLSv1, !tls1_enabled); bool tls1_1_enabled = (ssl_config_.version_min <= SSL_PROTOCOL_VERSION_TLS1_1 && ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1_1); options.ConfigureFlag(SSL_OP_NO_TLSv1_1, !tls1_1_enabled); bool tls1_2_enabled = (ssl_config_.version_min <= SSL_PROTOCOL_VERSION_TLS1_2 && ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1_2); options.ConfigureFlag(SSL_OP_NO_TLSv1_2, !tls1_2_enabled); options.ConfigureFlag(SSL_OP_NO_COMPRESSION, true); // TODO(joth): Set this conditionally, see http://crbug.com/55410 options.ConfigureFlag(SSL_OP_LEGACY_SERVER_CONNECT, true); SSL_set_options(ssl_, options.set_mask); SSL_clear_options(ssl_, options.clear_mask); // Same as above, this time for the SSL mode. SslSetClearMask mode; mode.ConfigureFlag(SSL_MODE_RELEASE_BUFFERS, true); mode.ConfigureFlag(SSL_MODE_CBC_RECORD_SPLITTING, true); mode.ConfigureFlag(SSL_MODE_ENABLE_FALSE_START, ssl_config_.false_start_enabled); SSL_set_mode(ssl_, mode.set_mask); SSL_clear_mode(ssl_, mode.clear_mask); // Removing ciphers by ID from OpenSSL is a bit involved as we must use the // textual name with SSL_set_cipher_list because there is no public API to // directly remove a cipher by ID. STACK_OF(SSL_CIPHER)* ciphers = SSL_get_ciphers(ssl_); DCHECK(ciphers); // See SSLConfig::disabled_cipher_suites for description of the suites // disabled by default. Note that !SHA256 and !SHA384 only remove HMAC-SHA256 // and HMAC-SHA384 cipher suites, not GCM cipher suites with SHA256 or SHA384 // as the handshake hash. std::string command( "DEFAULT:!NULL:!aNULL:!SHA256:!SHA384:!aECDH:!AESGCM+AES256:!aPSK"); // Walk through all the installed ciphers, seeing if any need to be // appended to the cipher removal |command|. for (size_t i = 0; i < sk_SSL_CIPHER_num(ciphers); ++i) { const SSL_CIPHER* cipher = sk_SSL_CIPHER_value(ciphers, i); const uint16 id = static_cast(SSL_CIPHER_get_id(cipher)); // Remove any ciphers with a strength of less than 80 bits. Note the NSS // implementation uses "effective" bits here but OpenSSL does not provide // this detail. This only impacts Triple DES: reports 112 vs. 168 bits, // both of which are greater than 80 anyway. bool disable = SSL_CIPHER_get_bits(cipher, NULL) < 80; if (!disable) { disable = std::find(ssl_config_.disabled_cipher_suites.begin(), ssl_config_.disabled_cipher_suites.end(), id) != ssl_config_.disabled_cipher_suites.end(); } if (disable) { const char* name = SSL_CIPHER_get_name(cipher); DVLOG(3) << "Found cipher to remove: '" << name << "', ID: " << id << " strength: " << SSL_CIPHER_get_bits(cipher, NULL); command.append(":!"); command.append(name); } } // Disable ECDSA cipher suites on platforms that do not support ECDSA // signed certificates, as servers may use the presence of such // ciphersuites as a hint to send an ECDSA certificate. #if defined(OS_WIN) if (base::win::GetVersion() < base::win::VERSION_VISTA) command.append(":!ECDSA"); #endif int rv = SSL_set_cipher_list(ssl_, command.c_str()); // If this fails (rv = 0) it means there are no ciphers enabled on this SSL. // This will almost certainly result in the socket failing to complete the // handshake at which point the appropriate error is bubbled up to the client. LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') " "returned " << rv; if (ssl_config_.version_fallback) SSL_enable_fallback_scsv(ssl_); // TLS channel ids. if (IsChannelIDEnabled(ssl_config_, channel_id_service_)) { SSL_enable_tls_channel_id(ssl_); } if (!ssl_config_.next_protos.empty()) { // Get list of ciphers that are enabled. STACK_OF(SSL_CIPHER)* enabled_ciphers = SSL_get_ciphers(ssl_); DCHECK(enabled_ciphers); std::vector enabled_ciphers_vector; for (size_t i = 0; i < sk_SSL_CIPHER_num(enabled_ciphers); ++i) { const SSL_CIPHER* cipher = sk_SSL_CIPHER_value(enabled_ciphers, i); const uint16 id = static_cast(SSL_CIPHER_get_id(cipher)); enabled_ciphers_vector.push_back(id); } std::vector wire_protos = SerializeNextProtos(ssl_config_.next_protos, HasCipherAdequateForHTTP2(enabled_ciphers_vector) && IsTLSVersionAdequateForHTTP2(ssl_config_)); SSL_set_alpn_protos(ssl_, wire_protos.empty() ? NULL : &wire_protos[0], wire_protos.size()); } if (ssl_config_.signed_cert_timestamps_enabled) { SSL_enable_signed_cert_timestamps(ssl_); SSL_enable_ocsp_stapling(ssl_); } if (IsOCSPStaplingSupported()) SSL_enable_ocsp_stapling(ssl_); return OK; } void SSLClientSocketOpenSSL::DoReadCallback(int rv) { // Since Run may result in Read being called, clear |user_read_callback_| // up front. if (rv > 0) was_ever_used_ = true; user_read_buf_ = NULL; user_read_buf_len_ = 0; if (rv <= 0) { // Failure of a read attempt may indicate a failed false start // connection. OnHandshakeCompletion(); } base::ResetAndReturn(&user_read_callback_).Run(rv); } void SSLClientSocketOpenSSL::DoWriteCallback(int rv) { // Since Run may result in Write being called, clear |user_write_callback_| // up front. if (rv > 0) was_ever_used_ = true; user_write_buf_ = NULL; user_write_buf_len_ = 0; if (rv < 0) { // Failure of a write attempt may indicate a failed false start // connection. OnHandshakeCompletion(); } base::ResetAndReturn(&user_write_callback_).Run(rv); } void SSLClientSocketOpenSSL::OnHandshakeCompletion() { if (!handshake_completion_callback_.is_null()) base::ResetAndReturn(&handshake_completion_callback_).Run(); } bool SSLClientSocketOpenSSL::DoTransportIO() { bool network_moved = false; int rv; // Read and write as much data as possible. The loop is necessary because // Write() may return synchronously. do { rv = BufferSend(); if (rv != ERR_IO_PENDING && rv != 0) network_moved = true; } while (rv > 0); if (transport_read_error_ == OK && BufferRecv() != ERR_IO_PENDING) network_moved = true; return network_moved; } // TODO(vadimt): Remove including "base/threading/thread_local.h" and // g_first_run_completed once crbug.com/424386 is fixed. base::LazyInstance::Leaky g_first_run_completed = LAZY_INSTANCE_INITIALIZER; int SSLClientSocketOpenSSL::DoHandshake() { crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); int net_error = OK; int rv; // TODO(vadimt): Leave only 1 call to SSL_do_handshake once crbug.com/424386 // is fixed. if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile1( FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 DoHandshake_WithCert")); rv = SSL_do_handshake(ssl_); } else { if (g_first_run_completed.Get().Get()) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is // fixed. tracked_objects::ScopedTracker tracking_profile1( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 DoHandshake_WithoutCert Not First")); rv = SSL_do_handshake(ssl_); } else { g_first_run_completed.Get().Set(true); // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is // fixed. tracked_objects::ScopedTracker tracking_profile1( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 DoHandshake_WithoutCert First")); rv = SSL_do_handshake(ssl_); } } if (client_auth_cert_needed_) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile2( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::DoHandshake2")); net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; // If the handshake already succeeded (because the server requests but // doesn't require a client cert), we need to invalidate the SSL session // so that we won't try to resume the non-client-authenticated session in // the next handshake. This will cause the server to ask for a client // cert again. if (rv == 1) { // Remove from session cache but don't clear this connection. SSL_SESSION* session = SSL_get_session(ssl_); if (session) { int rv = SSL_CTX_remove_session(SSL_get_SSL_CTX(ssl_), session); LOG_IF(WARNING, !rv) << "Couldn't invalidate SSL session: " << session; } } } else if (rv == 1) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile3( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::DoHandshake3")); if (trying_cached_session_ && logging::DEBUG_MODE) { DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString() << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail"); } if (ssl_config_.version_fallback && ssl_config_.version_max < ssl_config_.version_fallback_min) { return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION; } // SSL handshake is completed. If NPN wasn't negotiated, see if ALPN was. if (npn_status_ == kNextProtoUnsupported) { const uint8_t* alpn_proto = NULL; unsigned alpn_len = 0; SSL_get0_alpn_selected(ssl_, &alpn_proto, &alpn_len); if (alpn_len > 0) { npn_proto_.assign(reinterpret_cast(alpn_proto), alpn_len); npn_status_ = kNextProtoNegotiated; set_negotiation_extension(kExtensionALPN); } } RecordChannelIDSupport(channel_id_service_, channel_id_xtn_negotiated_, ssl_config_.channel_id_enabled, crypto::ECPrivateKey::IsSupported()); // Only record OCSP histograms if OCSP was requested. if (ssl_config_.signed_cert_timestamps_enabled || IsOCSPStaplingSupported()) { const uint8_t* ocsp_response; size_t ocsp_response_len; SSL_get0_ocsp_response(ssl_, &ocsp_response, &ocsp_response_len); set_stapled_ocsp_response_received(ocsp_response_len != 0); UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_response_len != 0); } const uint8_t* sct_list; size_t sct_list_len; SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len); set_signed_cert_timestamps_received(sct_list_len != 0); // Verify the certificate. UpdateServerCert(); GotoState(STATE_VERIFY_CERT); } else { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile4( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::DoHandshake4")); int ssl_error = SSL_get_error(ssl_, rv); if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) { // The server supports channel ID. Stop to look one up before returning to // the handshake. channel_id_xtn_negotiated_ = true; GotoState(STATE_CHANNEL_ID_LOOKUP); return OK; } OpenSSLErrorInfo error_info; net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); // If not done, stay in this state if (net_error == ERR_IO_PENDING) { GotoState(STATE_HANDSHAKE); } else { LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code " << ssl_error << ", net_error " << net_error; net_log_.AddEvent( NetLog::TYPE_SSL_HANDSHAKE_ERROR, CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); } } return net_error; } int SSLClientSocketOpenSSL::DoChannelIDLookup() { net_log_.AddEvent(NetLog::TYPE_SSL_CHANNEL_ID_REQUESTED); GotoState(STATE_CHANNEL_ID_LOOKUP_COMPLETE); return channel_id_service_->GetOrCreateChannelID( host_and_port_.host(), &channel_id_private_key_, &channel_id_cert_, base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, base::Unretained(this)), &channel_id_request_handle_); } int SSLClientSocketOpenSSL::DoChannelIDLookupComplete(int result) { if (result < 0) return result; DCHECK_LT(0u, channel_id_private_key_.size()); // Decode key. std::vector encrypted_private_key_info; std::vector subject_public_key_info; encrypted_private_key_info.assign( channel_id_private_key_.data(), channel_id_private_key_.data() + channel_id_private_key_.size()); subject_public_key_info.assign( channel_id_cert_.data(), channel_id_cert_.data() + channel_id_cert_.size()); scoped_ptr ec_private_key( crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( ChannelIDService::kEPKIPassword, encrypted_private_key_info, subject_public_key_info)); if (!ec_private_key) { LOG(ERROR) << "Failed to import Channel ID."; return ERR_CHANNEL_ID_IMPORT_FAILED; } // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key // type. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); int rv = SSL_set1_tls_channel_id(ssl_, ec_private_key->key()); if (!rv) { LOG(ERROR) << "Failed to set Channel ID."; int err = SSL_get_error(ssl_, rv); return MapOpenSSLError(err, err_tracer); } // Return to the handshake. set_channel_id_sent(true); net_log_.AddEvent(NetLog::TYPE_SSL_CHANNEL_ID_PROVIDED); GotoState(STATE_HANDSHAKE); return OK; } int SSLClientSocketOpenSSL::DoVerifyCert(int result) { DCHECK(!server_cert_chain_->empty()); DCHECK(start_cert_verification_time_.is_null()); GotoState(STATE_VERIFY_CERT_COMPLETE); // If the certificate is bad and has been previously accepted, use // the previous status and bypass the error. base::StringPiece der_cert; if (!x509_util::GetDER(server_cert_chain_->Get(0), &der_cert)) { NOTREACHED(); return ERR_CERT_INVALID; } CertStatus cert_status; if (ssl_config_.IsAllowedBadCert(der_cert, &cert_status)) { VLOG(1) << "Received an expected bad cert with status: " << cert_status; server_cert_verify_result_.Reset(); server_cert_verify_result_.cert_status = cert_status; server_cert_verify_result_.verified_cert = server_cert_; return OK; } // When running in a sandbox, it may not be possible to create an // X509Certificate*, as that may depend on OS functionality blocked // in the sandbox. if (!server_cert_.get()) { server_cert_verify_result_.Reset(); server_cert_verify_result_.cert_status = CERT_STATUS_INVALID; return ERR_CERT_INVALID; } start_cert_verification_time_ = base::TimeTicks::Now(); int flags = 0; if (ssl_config_.rev_checking_enabled) flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED; if (ssl_config_.verify_ev_cert) flags |= CertVerifier::VERIFY_EV_CERT; if (ssl_config_.cert_io_enabled) flags |= CertVerifier::VERIFY_CERT_IO_ENABLED; if (ssl_config_.rev_checking_required_local_anchors) flags |= CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS; verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); return verifier_->Verify( server_cert_.get(), host_and_port_.host(), flags, // TODO(davidben): Route the CRLSet through SSLConfig so // SSLClientSocket doesn't depend on SSLConfigService. SSLConfigService::GetCRLSet().get(), &server_cert_verify_result_, base::Bind(&SSLClientSocketOpenSSL::OnHandshakeIOComplete, base::Unretained(this)), net_log_); } int SSLClientSocketOpenSSL::DoVerifyCertComplete(int result) { verifier_.reset(); if (!start_cert_verification_time_.is_null()) { base::TimeDelta verify_time = base::TimeTicks::Now() - start_cert_verification_time_; if (result == OK) { UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTime", verify_time); } else { UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTimeError", verify_time); } } if (result == OK) { if (SSL_session_reused(ssl_)) { // Record whether or not the server tried to resume a session for a // different version. See https://crbug.com/441456. UMA_HISTOGRAM_BOOLEAN( "Net.SSLSessionVersionMatch", SSL_version(ssl_) == SSL_get_session(ssl_)->ssl_version); } } const CertStatus cert_status = server_cert_verify_result_.cert_status; if (transport_security_state_ && (result == OK || (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && !transport_security_state_->CheckPublicKeyPins( host_and_port_.host(), server_cert_verify_result_.is_issued_by_known_root, server_cert_verify_result_.public_key_hashes, &pinning_failure_log_)) { result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; } if (result == OK) { // Only check Certificate Transparency if there were no other errors with // the connection. VerifyCT(); // TODO(joth): Work out if we need to remember the intermediate CA certs // when the server sends them to us, and do so here. SSLContext::GetInstance()->session_cache()->MarkSSLSessionAsGood(ssl_); marked_session_as_good_ = true; CheckIfHandshakeFinished(); } else { DVLOG(1) << "DoVerifyCertComplete error " << ErrorToString(result) << " (" << result << ")"; } completed_connect_ = true; // Exit DoHandshakeLoop and return the result to the caller to Connect. DCHECK_EQ(STATE_NONE, next_handshake_state_); return result; } void SSLClientSocketOpenSSL::DoConnectCallback(int rv) { if (rv < OK) OnHandshakeCompletion(); if (!user_connect_callback_.is_null()) { CompletionCallback c = user_connect_callback_; user_connect_callback_.Reset(); c.Run(rv > OK ? OK : rv); } } void SSLClientSocketOpenSSL::UpdateServerCert() { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::UpdateServerCert")); server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_)); // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile1( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::UpdateServerCert1")); server_cert_ = server_cert_chain_->AsOSChain(); if (server_cert_.get()) { net_log_.AddEvent( NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, base::Bind(&NetLogX509CertificateCallback, base::Unretained(server_cert_.get()))); // TODO(rsleevi): Plumb an OCSP response into the Mac system library and // update IsOCSPStaplingSupported for Mac. https://crbug.com/430714 if (IsOCSPStaplingSupported()) { #if defined(OS_WIN) // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is // fixed. tracked_objects::ScopedTracker tracking_profile2( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::UpdateServerCert2")); const uint8_t* ocsp_response_raw; size_t ocsp_response_len; SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); CRYPT_DATA_BLOB ocsp_response_blob; ocsp_response_blob.cbData = ocsp_response_len; ocsp_response_blob.pbData = const_cast(ocsp_response_raw); BOOL ok = CertSetCertificateContextProperty( server_cert_->os_cert_handle(), CERT_OCSP_RESPONSE_PROP_ID, CERT_SET_PROPERTY_IGNORE_PERSIST_ERROR_FLAG, &ocsp_response_blob); if (!ok) { VLOG(1) << "Failed to set OCSP response property: " << GetLastError(); } #else NOTREACHED(); #endif } } } void SSLClientSocketOpenSSL::VerifyCT() { if (!cert_transparency_verifier_) return; const uint8_t* ocsp_response_raw; size_t ocsp_response_len; SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len); std::string ocsp_response; if (ocsp_response_len > 0) { ocsp_response.assign(reinterpret_cast(ocsp_response_raw), ocsp_response_len); } const uint8_t* sct_list_raw; size_t sct_list_len; SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list_raw, &sct_list_len); std::string sct_list; if (sct_list_len > 0) sct_list.assign(reinterpret_cast(sct_list_raw), sct_list_len); // Note that this is a completely synchronous operation: The CT Log Verifier // gets all the data it needs for SCT verification and does not do any // external communication. cert_transparency_verifier_->Verify( server_cert_verify_result_.verified_cert.get(), ocsp_response, sct_list, &ct_verify_result_, net_log_); if (!policy_enforcer_) { server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; } else { if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) { scoped_refptr ev_whitelist = SSLConfigService::GetEVCertsWhitelist(); if (!policy_enforcer_->DoesConformToCTEVPolicy( server_cert_verify_result_.verified_cert.get(), ev_whitelist.get(), ct_verify_result_, net_log_)) { // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 VLOG(1) << "EV certificate for " << server_cert_verify_result_.verified_cert->subject() .GetDisplayName() << " does not conform to CT policy, removing EV status."; server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; } } } } void SSLClientSocketOpenSSL::OnHandshakeIOComplete(int result) { int rv = DoHandshakeLoop(result); if (rv != ERR_IO_PENDING) { net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv); DoConnectCallback(rv); } } void SSLClientSocketOpenSSL::OnSendComplete(int result) { if (next_handshake_state_ == STATE_HANDSHAKE) { // In handshake phase. OnHandshakeIOComplete(result); return; } // OnSendComplete may need to call DoPayloadRead while the renegotiation // handshake is in progress. int rv_read = ERR_IO_PENDING; int rv_write = ERR_IO_PENDING; bool network_moved; do { if (user_read_buf_.get()) rv_read = DoPayloadRead(); if (user_write_buf_.get()) rv_write = DoPayloadWrite(); network_moved = DoTransportIO(); } while (rv_read == ERR_IO_PENDING && rv_write == ERR_IO_PENDING && (user_read_buf_.get() || user_write_buf_.get()) && network_moved); // Performing the Read callback may cause |this| to be deleted. If this // happens, the Write callback should not be invoked. Guard against this by // holding a WeakPtr to |this| and ensuring it's still valid. base::WeakPtr guard(weak_factory_.GetWeakPtr()); if (user_read_buf_.get() && rv_read != ERR_IO_PENDING) DoReadCallback(rv_read); if (!guard.get()) return; if (user_write_buf_.get() && rv_write != ERR_IO_PENDING) DoWriteCallback(rv_write); } void SSLClientSocketOpenSSL::OnRecvComplete(int result) { if (next_handshake_state_ == STATE_HANDSHAKE) { // In handshake phase. OnHandshakeIOComplete(result); return; } // Network layer received some data, check if client requested to read // decrypted data. if (!user_read_buf_.get()) return; int rv = DoReadLoop(); if (rv != ERR_IO_PENDING) DoReadCallback(rv); } int SSLClientSocketOpenSSL::DoHandshakeLoop(int last_io_result) { int rv = last_io_result; do { // Default to STATE_NONE for next state. // (This is a quirk carried over from the windows // implementation. It makes reading the logs a bit harder.) // State handlers can and often do call GotoState just // to stay in the current state. State state = next_handshake_state_; GotoState(STATE_NONE); switch (state) { case STATE_HANDSHAKE: rv = DoHandshake(); break; case STATE_CHANNEL_ID_LOOKUP: DCHECK_EQ(OK, rv); rv = DoChannelIDLookup(); break; case STATE_CHANNEL_ID_LOOKUP_COMPLETE: rv = DoChannelIDLookupComplete(rv); break; case STATE_VERIFY_CERT: DCHECK_EQ(OK, rv); rv = DoVerifyCert(rv); break; case STATE_VERIFY_CERT_COMPLETE: rv = DoVerifyCertComplete(rv); break; case STATE_NONE: default: rv = ERR_UNEXPECTED; NOTREACHED() << "unexpected state" << state; break; } bool network_moved = DoTransportIO(); if (network_moved && next_handshake_state_ == STATE_HANDSHAKE) { // In general we exit the loop if rv is ERR_IO_PENDING. In this // special case we keep looping even if rv is ERR_IO_PENDING because // the transport IO may allow DoHandshake to make progress. rv = OK; // This causes us to stay in the loop. } } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE); return rv; } int SSLClientSocketOpenSSL::DoReadLoop() { bool network_moved; int rv; do { rv = DoPayloadRead(); network_moved = DoTransportIO(); } while (rv == ERR_IO_PENDING && network_moved); return rv; } int SSLClientSocketOpenSSL::DoWriteLoop() { bool network_moved; int rv; do { rv = DoPayloadWrite(); network_moved = DoTransportIO(); } while (rv == ERR_IO_PENDING && network_moved); return rv; } int SSLClientSocketOpenSSL::DoPayloadRead() { crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); int rv; if (pending_read_error_ != kNoPendingReadResult) { rv = pending_read_error_; pending_read_error_ = kNoPendingReadResult; if (rv == 0) { net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, rv, user_read_buf_->data()); } else { net_log_.AddEvent( NetLog::TYPE_SSL_READ_ERROR, CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, pending_read_error_info_)); } pending_read_ssl_error_ = SSL_ERROR_NONE; pending_read_error_info_ = OpenSSLErrorInfo(); return rv; } int total_bytes_read = 0; do { rv = SSL_read(ssl_, user_read_buf_->data() + total_bytes_read, user_read_buf_len_ - total_bytes_read); if (rv > 0) total_bytes_read += rv; } while (total_bytes_read < user_read_buf_len_ && rv > 0); if (total_bytes_read == user_read_buf_len_) { rv = total_bytes_read; } else { // Otherwise, an error occurred (rv <= 0). The error needs to be handled // immediately, while the OpenSSL errors are still available in // thread-local storage. However, the handled/remapped error code should // only be returned if no application data was already read; if it was, the // error code should be deferred until the next call of DoPayloadRead. // // If no data was read, |*next_result| will point to the return value of // this function. If at least some data was read, |*next_result| will point // to |pending_read_error_|, to be returned in a future call to // DoPayloadRead() (e.g.: after the current data is handled). int *next_result = &rv; if (total_bytes_read > 0) { pending_read_error_ = rv; rv = total_bytes_read; next_result = &pending_read_error_; } if (client_auth_cert_needed_) { *next_result = ERR_SSL_CLIENT_AUTH_CERT_NEEDED; } else if (*next_result < 0) { pending_read_ssl_error_ = SSL_get_error(ssl_, *next_result); *next_result = MapOpenSSLErrorWithDetails(pending_read_ssl_error_, err_tracer, &pending_read_error_info_); // Many servers do not reliably send a close_notify alert when shutting // down a connection, and instead terminate the TCP connection. This is // reported as ERR_CONNECTION_CLOSED. Because of this, map the unclean // shutdown to a graceful EOF, instead of treating it as an error as it // should be. if (*next_result == ERR_CONNECTION_CLOSED) *next_result = 0; if (rv > 0 && *next_result == ERR_IO_PENDING) { // If at least some data was read from SSL_read(), do not treat // insufficient data as an error to return in the next call to // DoPayloadRead() - instead, let the call fall through to check // SSL_read() again. This is because DoTransportIO() may complete // in between the next call to DoPayloadRead(), and thus it is // important to check SSL_read() on subsequent invocations to see // if a complete record may now be read. *next_result = kNoPendingReadResult; } } } if (rv >= 0) { net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, rv, user_read_buf_->data()); } else if (rv != ERR_IO_PENDING) { net_log_.AddEvent( NetLog::TYPE_SSL_READ_ERROR, CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_, pending_read_error_info_)); pending_read_ssl_error_ = SSL_ERROR_NONE; pending_read_error_info_ = OpenSSLErrorInfo(); } return rv; } int SSLClientSocketOpenSSL::DoPayloadWrite() { crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_); if (rv >= 0) { net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT, rv, user_write_buf_->data()); return rv; } int ssl_error = SSL_get_error(ssl_, rv); OpenSSLErrorInfo error_info; int net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info); if (net_error != ERR_IO_PENDING) { net_log_.AddEvent( NetLog::TYPE_SSL_WRITE_ERROR, CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info)); } return net_error; } int SSLClientSocketOpenSSL::BufferSend(void) { if (transport_send_busy_) return ERR_IO_PENDING; size_t buffer_read_offset; uint8_t* read_buf; size_t max_read; int status = BIO_zero_copy_get_read_buf(transport_bio_, &read_buf, &buffer_read_offset, &max_read); DCHECK_EQ(status, 1); // Should never fail. if (!max_read) return 0; // Nothing pending in the OpenSSL write BIO. CHECK_EQ(read_buf, reinterpret_cast(send_buffer_->StartOfBuffer())); CHECK_LT(buffer_read_offset, static_cast(send_buffer_->capacity())); send_buffer_->set_offset(buffer_read_offset); int rv = transport_->socket()->Write( send_buffer_.get(), max_read, base::Bind(&SSLClientSocketOpenSSL::BufferSendComplete, base::Unretained(this))); if (rv == ERR_IO_PENDING) { transport_send_busy_ = true; } else { TransportWriteComplete(rv); } return rv; } int SSLClientSocketOpenSSL::BufferRecv(void) { if (transport_recv_busy_) return ERR_IO_PENDING; // Determine how much was requested from |transport_bio_| that was not // actually available. size_t requested = BIO_ctrl_get_read_request(transport_bio_); if (requested == 0) { // This is not a perfect match of error codes, as no operation is // actually pending. However, returning 0 would be interpreted as // a possible sign of EOF, which is also an inappropriate match. return ERR_IO_PENDING; } // Known Issue: While only reading |requested| data is the more correct // implementation, it has the downside of resulting in frequent reads: // One read for the SSL record header (~5 bytes) and one read for the SSL // record body. Rather than issuing these reads to the underlying socket // (and constantly allocating new IOBuffers), a single Read() request to // fill |transport_bio_| is issued. As long as an SSL client socket cannot // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL // traffic, this over-subscribed Read()ing will not cause issues. size_t buffer_write_offset; uint8_t* write_buf; size_t max_write; int status = BIO_zero_copy_get_write_buf(transport_bio_, &write_buf, &buffer_write_offset, &max_write); DCHECK_EQ(status, 1); // Should never fail. if (!max_write) return ERR_IO_PENDING; CHECK_EQ(write_buf, reinterpret_cast(recv_buffer_->StartOfBuffer())); CHECK_LT(buffer_write_offset, static_cast(recv_buffer_->capacity())); recv_buffer_->set_offset(buffer_write_offset); int rv = transport_->socket()->Read( recv_buffer_.get(), max_write, base::Bind(&SSLClientSocketOpenSSL::BufferRecvComplete, base::Unretained(this))); if (rv == ERR_IO_PENDING) { transport_recv_busy_ = true; } else { rv = TransportReadComplete(rv); } return rv; } void SSLClientSocketOpenSSL::BufferSendComplete(int result) { TransportWriteComplete(result); OnSendComplete(result); } void SSLClientSocketOpenSSL::BufferRecvComplete(int result) { result = TransportReadComplete(result); OnRecvComplete(result); } void SSLClientSocketOpenSSL::TransportWriteComplete(int result) { DCHECK(ERR_IO_PENDING != result); int bytes_written = 0; if (result < 0) { // Record the error. Save it to be reported in a future read or write on // transport_bio_'s peer. transport_write_error_ = result; } else { bytes_written = result; } DCHECK_GE(send_buffer_->RemainingCapacity(), bytes_written); int ret = BIO_zero_copy_get_read_buf_done(transport_bio_, bytes_written); DCHECK_EQ(1, ret); transport_send_busy_ = false; } int SSLClientSocketOpenSSL::TransportReadComplete(int result) { DCHECK(ERR_IO_PENDING != result); // If an EOF, canonicalize to ERR_CONNECTION_CLOSED here so MapOpenSSLError // does not report success. if (result == 0) result = ERR_CONNECTION_CLOSED; int bytes_read = 0; if (result < 0) { DVLOG(1) << "TransportReadComplete result " << result; // Received an error. Save it to be reported in a future read on // transport_bio_'s peer. transport_read_error_ = result; } else { bytes_read = result; } DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read); int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read); DCHECK_EQ(1, ret); transport_recv_busy_ = false; return result; } int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::ClientCertRequestCallback")); DVLOG(3) << "OpenSSL ClientCertRequestCallback called"; DCHECK(ssl == ssl_); net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED); // Clear any currently configured certificates. SSL_certs_clear(ssl_); #if defined(OS_IOS) // TODO(droger): Support client auth on iOS. See http://crbug.com/145954). LOG(WARNING) << "Client auth is not supported"; #else // !defined(OS_IOS) if (!ssl_config_.send_client_cert) { // First pass: we know that a client certificate is needed, but we do not // have one at hand. client_auth_cert_needed_ = true; STACK_OF(X509_NAME) *authorities = SSL_get_client_CA_list(ssl); for (size_t i = 0; i < sk_X509_NAME_num(authorities); i++) { X509_NAME *ca_name = (X509_NAME *)sk_X509_NAME_value(authorities, i); unsigned char* str = NULL; int length = i2d_X509_NAME(ca_name, &str); cert_authorities_.push_back(std::string( reinterpret_cast(str), static_cast(length))); OPENSSL_free(str); } const unsigned char* client_cert_types; size_t num_client_cert_types = SSL_get0_certificate_types(ssl, &client_cert_types); for (size_t i = 0; i < num_client_cert_types; i++) { cert_key_types_.push_back( static_cast(client_cert_types[i])); } return -1; // Suspends handshake. } // Second pass: a client certificate should have been selected. if (ssl_config_.client_cert.get()) { ScopedX509 leaf_x509 = OSCertHandleToOpenSSL(ssl_config_.client_cert->os_cert_handle()); if (!leaf_x509) { LOG(WARNING) << "Failed to import certificate"; OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT); return -1; } ScopedX509Stack chain = OSCertHandlesToOpenSSL( ssl_config_.client_cert->GetIntermediateCertificates()); if (!chain) { LOG(WARNING) << "Failed to import intermediate certificates"; OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT); return -1; } // TODO(davidben): With Linux client auth support, this should be // conditioned on OS_ANDROID and then, with https://crbug.com/394131, // removed altogether. OpenSSLClientKeyStore is mostly an artifact of the // net/ client auth API lacking a private key handle. #if defined(USE_OPENSSL_CERTS) crypto::ScopedEVP_PKEY privkey = OpenSSLClientKeyStore::GetInstance()->FetchClientCertPrivateKey( ssl_config_.client_cert.get()); #else // !defined(USE_OPENSSL_CERTS) crypto::ScopedEVP_PKEY privkey = FetchClientCertPrivateKey(ssl_config_.client_cert.get()); #endif // defined(USE_OPENSSL_CERTS) if (!privkey) { // Could not find the private key. Fail the handshake and surface an // appropriate error to the caller. LOG(WARNING) << "Client cert found without private key"; OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY); return -1; } if (!SSL_use_certificate(ssl_, leaf_x509.get()) || !SSL_use_PrivateKey(ssl_, privkey.get()) || !SSL_set1_chain(ssl_, chain.get())) { LOG(WARNING) << "Failed to set client certificate"; return -1; } int cert_count = 1 + sk_X509_num(chain.get()); net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, NetLog::IntegerCallback("cert_count", cert_count)); return 1; } #endif // defined(OS_IOS) // Send no client certificate. net_log_.AddEvent(NetLog::TYPE_SSL_CLIENT_CERT_PROVIDED, NetLog::IntegerCallback("cert_count", 0)); return 1; } int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::CertVerifyCallback")); if (!completed_connect_) { // If the first handshake hasn't completed then we accept any certificates // because we verify after the handshake. return 1; } // Disallow the server certificate to change in a renegotiation. if (server_cert_chain_->empty()) { LOG(ERROR) << "Received invalid certificate chain between handshakes"; return 0; } base::StringPiece old_der, new_der; if (store_ctx->cert == NULL || !x509_util::GetDER(server_cert_chain_->Get(0), &old_der) || !x509_util::GetDER(store_ctx->cert, &new_der)) { LOG(ERROR) << "Failed to encode certificates"; return 0; } if (old_der != new_der) { LOG(ERROR) << "Server certificate changed between handshakes"; return 0; } return 1; } // SelectNextProtoCallback is called by OpenSSL during the handshake. If the // server supports NPN, selects a protocol from the list that the server // provides. According to third_party/openssl/openssl/ssl/ssl_lib.c, the // callback can assume that |in| is syntactically valid. int SSLClientSocketOpenSSL::SelectNextProtoCallback(unsigned char** out, unsigned char* outlen, const unsigned char* in, unsigned int inlen) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::SelectNextProtoCallback")); if (ssl_config_.next_protos.empty()) { *out = reinterpret_cast( const_cast(kDefaultSupportedNPNProtocol)); *outlen = arraysize(kDefaultSupportedNPNProtocol) - 1; npn_status_ = kNextProtoUnsupported; return SSL_TLSEXT_ERR_OK; } // Assume there's no overlap between our protocols and the server's list. npn_status_ = kNextProtoNoOverlap; // For each protocol in server preference order, see if we support it. for (unsigned int i = 0; i < inlen; i += in[i] + 1) { for (NextProto next_proto : ssl_config_.next_protos) { const std::string proto = NextProtoToString(next_proto); if (in[i] == proto.size() && memcmp(&in[i + 1], proto.data(), in[i]) == 0) { // We found a match. *out = const_cast(in) + i + 1; *outlen = in[i]; npn_status_ = kNextProtoNegotiated; break; } } if (npn_status_ == kNextProtoNegotiated) break; } // If we didn't find a protocol, we select the first one from our list. if (npn_status_ == kNextProtoNoOverlap) { // NextProtoToString returns a pointer to a static string. const char* proto = NextProtoToString(ssl_config_.next_protos[0]); *out = reinterpret_cast(const_cast(proto)); *outlen = strlen(proto); } npn_proto_.assign(reinterpret_cast(*out), *outlen); DVLOG(2) << "next protocol: '" << npn_proto_ << "' status: " << npn_status_; set_negotiation_extension(kExtensionNPN); return SSL_TLSEXT_ERR_OK; } long SSLClientSocketOpenSSL::MaybeReplayTransportError( BIO *bio, int cmd, const char *argp, int argi, long argl, long retvalue) { if (cmd == (BIO_CB_READ|BIO_CB_RETURN) && retvalue <= 0) { // If there is no more data in the buffer, report any pending errors that // were observed. Note that both the readbuf and the writebuf are checked // for errors, since the application may have encountered a socket error // while writing that would otherwise not be reported until the application // attempted to write again - which it may never do. See // https://crbug.com/249848. if (transport_read_error_ != OK) { OpenSSLPutNetError(FROM_HERE, transport_read_error_); return -1; } if (transport_write_error_ != OK) { OpenSSLPutNetError(FROM_HERE, transport_write_error_); return -1; } } else if (cmd == BIO_CB_WRITE) { // Because of the write buffer, this reports a failure from the previous // write payload. If the current payload fails to write, the error will be // reported in a future write or read to |bio|. if (transport_write_error_ != OK) { OpenSSLPutNetError(FROM_HERE, transport_write_error_); return -1; } } return retvalue; } // static long SSLClientSocketOpenSSL::BIOCallback( BIO *bio, int cmd, const char *argp, int argi, long argl, long retvalue) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::BIOCallback")); SSLClientSocketOpenSSL* socket = reinterpret_cast( BIO_get_callback_arg(bio)); CHECK(socket); return socket->MaybeReplayTransportError( bio, cmd, argp, argi, argl, retvalue); } // static void SSLClientSocketOpenSSL::InfoCallback(const SSL* ssl, int type, int /*val*/) { // TODO(vadimt): Remove ScopedTracker below once crbug.com/424386 is fixed. tracked_objects::ScopedTracker tracking_profile( FROM_HERE_WITH_EXPLICIT_FUNCTION( "424386 SSLClientSocketOpenSSL::InfoCallback")); if (type == SSL_CB_HANDSHAKE_DONE) { SSLClientSocketOpenSSL* ssl_socket = SSLContext::GetInstance()->GetClientSocketFromSSL(ssl); ssl_socket->handshake_succeeded_ = true; ssl_socket->CheckIfHandshakeFinished(); } } // Determines if both the handshake and certificate verification have completed // successfully, and calls the handshake completion callback if that is the // case. // // CheckIfHandshakeFinished is called twice per connection: once after // MarkSSLSessionAsGood, when the certificate has been verified, and // once via an OpenSSL callback when the handshake has completed. On the // second call, when the certificate has been verified and the handshake // has completed, the connection's handshake completion callback is run. void SSLClientSocketOpenSSL::CheckIfHandshakeFinished() { if (handshake_succeeded_ && marked_session_as_good_) OnHandshakeCompletion(); } void SSLClientSocketOpenSSL::AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const { for (ct::SCTList::const_iterator iter = ct_verify_result_.verified_scts.begin(); iter != ct_verify_result_.verified_scts.end(); ++iter) { ssl_info->signed_certificate_timestamps.push_back( SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_OK)); } for (ct::SCTList::const_iterator iter = ct_verify_result_.invalid_scts.begin(); iter != ct_verify_result_.invalid_scts.end(); ++iter) { ssl_info->signed_certificate_timestamps.push_back( SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_INVALID)); } for (ct::SCTList::const_iterator iter = ct_verify_result_.unknown_logs_scts.begin(); iter != ct_verify_result_.unknown_logs_scts.end(); ++iter) { ssl_info->signed_certificate_timestamps.push_back( SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_LOG_UNKNOWN)); } } scoped_refptr SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { return server_cert_; } } // namespace net