1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
6 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
16 #include "base/memory/scoped_ptr.h"
17 #include "base/synchronization/lock.h"
18 #include "base/threading/platform_thread.h"
19 #include "base/time/time.h"
20 #include "net/base/completion_callback.h"
21 #include "net/base/host_port_pair.h"
22 #include "net/base/net_export.h"
23 #include "net/base/net_log.h"
24 #include "net/base/nss_memio.h"
25 #include "net/cert/cert_verify_result.h"
26 #include "net/cert/ct_verify_result.h"
27 #include "net/cert/x509_certificate.h"
28 #include "net/socket/ssl_client_socket.h"
29 #include "net/ssl/channel_id_service.h"
30 #include "net/ssl/ssl_config_service.h"
33 class SequencedTaskRunner;
40 class ChannelIDService;
42 class ClientSocketHandle;
43 class SingleRequestCertVerifier;
44 class TransportSecurityState;
45 class X509Certificate;
47 // An SSL client socket implemented with Mozilla NSS.
48 class SSLClientSocketNSS : public SSLClientSocket {
50 // Takes ownership of the |transport_socket|, which must already be connected.
51 // The hostname specified in |host_and_port| will be compared with the name(s)
52 // in the server's certificate during the SSL handshake. If SSL client
53 // authentication is requested, the host_and_port field of SSLCertRequestInfo
54 // will be populated with |host_and_port|. |ssl_config| specifies
57 // Because calls to NSS may block, such as due to needing to access slow
58 // hardware or needing to synchronously unlock protected tokens, calls to
59 // NSS may optionally be run on a dedicated thread. If synchronous/blocking
60 // behaviour is desired, for performance or compatibility, the current task
61 // runner should be supplied instead.
62 SSLClientSocketNSS(base::SequencedTaskRunner* nss_task_runner,
63 scoped_ptr<ClientSocketHandle> transport_socket,
64 const HostPortPair& host_and_port,
65 const SSLConfig& ssl_config,
66 const SSLClientSocketContext& context);
67 ~SSLClientSocketNSS() override;
69 // SSLClientSocket implementation.
70 std::string GetSessionCacheKey() const override;
71 bool InSessionCache() const override;
72 void SetHandshakeCompletionCallback(const base::Closure& callback) override;
73 void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info) override;
74 NextProtoStatus GetNextProto(std::string* proto) override;
76 // SSLSocket implementation.
77 int ExportKeyingMaterial(const base::StringPiece& label,
79 const base::StringPiece& context,
81 unsigned int outlen) override;
82 int GetTLSUniqueChannelBinding(std::string* out) override;
84 // StreamSocket implementation.
85 int Connect(const CompletionCallback& callback) override;
86 void Disconnect() override;
87 bool IsConnected() const override;
88 bool IsConnectedAndIdle() const override;
89 int GetPeerAddress(IPEndPoint* address) const override;
90 int GetLocalAddress(IPEndPoint* address) const override;
91 const BoundNetLog& NetLog() const override;
92 void SetSubresourceSpeculation() override;
93 void SetOmniboxSpeculation() override;
94 bool WasEverUsed() const override;
95 bool UsingTCPFastOpen() const override;
96 bool GetSSLInfo(SSLInfo* ssl_info) override;
98 // Socket implementation.
99 int Read(IOBuffer* buf,
101 const CompletionCallback& callback) override;
102 int Write(IOBuffer* buf,
104 const CompletionCallback& callback) override;
105 int SetReceiveBufferSize(int32 size) override;
106 int SetSendBufferSize(int32 size) override;
107 ChannelIDService* GetChannelIDService() const override;
110 // SSLClientSocket implementation.
111 scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
115 // Helper class to handle marshalling any NSS interaction to and from the
116 // NSS and network task runners. Not every call needs to happen on the Core
122 STATE_HANDSHAKE_COMPLETE,
124 STATE_VERIFY_CERT_COMPLETE,
130 // Initializes NSS SSL options. Returns a net error code.
131 int InitializeSSLOptions();
133 // Initializes the socket peer name in SSL. Returns a net error code.
134 int InitializeSSLPeerName();
136 void DoConnectCallback(int result);
137 void OnHandshakeIOComplete(int result);
139 int DoHandshakeLoop(int last_io_result);
141 int DoHandshakeComplete(int result);
142 int DoVerifyCert(int result);
143 int DoVerifyCertComplete(int result);
147 // The following methods are for debugging bug 65948. Will remove this code
148 // after fixing bug 65948.
149 void EnsureThreadIdAssigned() const;
150 bool CalledOnValidThread() const;
152 // Adds the SignedCertificateTimestamps from ct_verify_result_ to |ssl_info|.
153 // SCTs are held in three separate vectors in ct_verify_result, each
154 // vetor representing a particular verification state, this method associates
155 // each of the SCTs with the corresponding SCTVerifyStatus as it adds it to
156 // the |ssl_info|.signed_certificate_timestamps list.
157 void AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const;
159 // The task runner used to perform NSS operations.
160 scoped_refptr<base::SequencedTaskRunner> nss_task_runner_;
161 scoped_ptr<ClientSocketHandle> transport_;
162 HostPortPair host_and_port_;
163 SSLConfig ssl_config_;
165 scoped_refptr<Core> core_;
167 CompletionCallback user_connect_callback_;
169 CertVerifyResult server_cert_verify_result_;
171 CertVerifier* const cert_verifier_;
172 scoped_ptr<SingleRequestCertVerifier> verifier_;
174 // Certificate Transparency: Verifier and result holder.
175 ct::CTVerifyResult ct_verify_result_;
176 CTVerifier* cert_transparency_verifier_;
178 // The service for retrieving Channel ID keys. May be NULL.
179 ChannelIDService* channel_id_service_;
181 // ssl_session_cache_shard_ is an opaque string that partitions the SSL
182 // session cache. i.e. sessions created with one value will not attempt to
183 // resume on the socket with a different value.
184 const std::string ssl_session_cache_shard_;
186 // True if the SSL handshake has been completed.
187 bool completed_handshake_;
189 State next_handshake_state_;
191 // The NSS SSL state machine. This is owned by |core_|.
192 // TODO(rsleevi): http://crbug.com/130616 - Remove this member once
193 // ExportKeyingMaterial is updated to be asynchronous.
196 BoundNetLog net_log_;
198 base::TimeTicks start_cert_verification_time_;
200 TransportSecurityState* transport_security_state_;
202 // pinning_failure_log contains a message produced by
203 // TransportSecurityState::CheckPublicKeyPins in the event of a
204 // pinning failure. It is a (somewhat) human-readable string.
205 std::string pinning_failure_log_;
207 // The following two variables are added for debugging bug 65948. Will
208 // remove this code after fixing bug 65948.
209 // Added the following code Debugging in release mode.
210 mutable base::Lock lock_;
211 // This is mutable so that CalledOnValidThread can set it.
212 // It's guarded by |lock_|.
213 mutable base::PlatformThreadId valid_thread_id_;
218 #endif // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_