ssl_client_socket.h 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
  5. #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
  6. #include <stdint.h>
  7. #include <memory>
  8. #include <vector>
  9. #include "base/gtest_prod_util.h"
  10. #include "base/memory/raw_ptr.h"
  11. #include "base/observer_list.h"
  12. #include "net/base/net_export.h"
  13. #include "net/cert/cert_database.h"
  14. #include "net/socket/ssl_socket.h"
  15. #include "net/ssl/ssl_client_auth_cache.h"
  16. #include "net/ssl/ssl_config_service.h"
  17. namespace net {
  18. class CTPolicyEnforcer;
  19. class CertVerifier;
  20. class HostPortPair;
  21. class SCTAuditingDelegate;
  22. class SSLClientSessionCache;
  23. struct SSLConfig;
  24. class SSLKeyLogger;
  25. class StreamSocket;
  26. class TransportSecurityState;
  27. // A client socket that uses SSL as the transport layer.
  28. //
  29. // NOTE: The SSL handshake occurs within the Connect method after a TCP
  30. // connection is established. If a SSL error occurs during the handshake,
  31. // Connect will fail.
  32. //
  33. class NET_EXPORT SSLClientSocket : public SSLSocket {
  34. public:
  35. SSLClientSocket();
  36. // Called in response to |ERR_ECH_NOT_NEGOTIATED| in Connect(), to determine
  37. // how to retry the connection, up to some limit. If this method returns a
  38. // non-empty string, it is the serialized updated ECHConfigList provided by
  39. // the server. The connection can be retried with the new value. If it returns
  40. // an empty string, the server has indicated ECH has been disabled. The
  41. // connection can be retried with ECH disabled.
  42. virtual std::vector<uint8_t> GetECHRetryConfigs() = 0;
  43. // Log SSL key material to |logger|. Must be called before any
  44. // SSLClientSockets are created.
  45. //
  46. // TODO(davidben): Switch this to a parameter on the SSLClientSocketContext
  47. // once https://crbug.com/458365 is resolved.
  48. static void SetSSLKeyLogger(std::unique_ptr<SSLKeyLogger> logger);
  49. protected:
  50. void set_signed_cert_timestamps_received(
  51. bool signed_cert_timestamps_received) {
  52. signed_cert_timestamps_received_ = signed_cert_timestamps_received;
  53. }
  54. void set_stapled_ocsp_response_received(bool stapled_ocsp_response_received) {
  55. stapled_ocsp_response_received_ = stapled_ocsp_response_received;
  56. }
  57. // Serialize |next_protos| in the wire format for ALPN: protocols are listed
  58. // in order, each prefixed by a one-byte length.
  59. static std::vector<uint8_t> SerializeNextProtos(
  60. const NextProtoVector& next_protos);
  61. private:
  62. FRIEND_TEST_ALL_PREFIXES(SSLClientSocket, SerializeNextProtos);
  63. // For signed_cert_timestamps_received_ and stapled_ocsp_response_received_.
  64. FRIEND_TEST_ALL_PREFIXES(SSLClientSocketVersionTest,
  65. ConnectSignedCertTimestampsTLSExtension);
  66. FRIEND_TEST_ALL_PREFIXES(SSLClientSocketVersionTest,
  67. ConnectSignedCertTimestampsEnablesOCSP);
  68. // True if SCTs were received via a TLS extension.
  69. bool signed_cert_timestamps_received_ = false;
  70. // True if a stapled OCSP response was received.
  71. bool stapled_ocsp_response_received_ = false;
  72. };
  73. // Shared state and configuration across multiple SSLClientSockets.
  74. class NET_EXPORT SSLClientContext : public SSLConfigService::Observer,
  75. public CertDatabase::Observer {
  76. public:
  77. class NET_EXPORT Observer : public base::CheckedObserver {
  78. public:
  79. // Called when SSL configuration for all hosts changed. Newly-created
  80. // SSLClientSockets will pick up the new configuration. Note that changes
  81. // which only apply to one server will result in a call to
  82. // OnSSLConfigForServerChanged() instead.
  83. virtual void OnSSLConfigChanged(bool is_cert_database_change) = 0;
  84. // Called when SSL configuration for |server| changed. Newly-created
  85. // SSLClientSockets to |server| will pick up the new configuration.
  86. virtual void OnSSLConfigForServerChanged(const HostPortPair& server) = 0;
  87. };
  88. // Creates a new SSLClientContext with the specified parameters. The
  89. // SSLClientContext may not outlive the input parameters.
  90. //
  91. // |ssl_config_service| may be null to always use the default
  92. // SSLContextConfig. |ssl_client_session_cache| may be null to disable session
  93. // caching. |sct_auditing_delegate| may be null to disable SCT auditing.
  94. SSLClientContext(SSLConfigService* ssl_config_service,
  95. CertVerifier* cert_verifier,
  96. TransportSecurityState* transport_security_state,
  97. CTPolicyEnforcer* ct_policy_enforcer,
  98. SSLClientSessionCache* ssl_client_session_cache,
  99. SCTAuditingDelegate* sct_auditing_delegate);
  100. SSLClientContext(const SSLClientContext&) = delete;
  101. SSLClientContext& operator=(const SSLClientContext&) = delete;
  102. ~SSLClientContext() override;
  103. const SSLContextConfig& config() { return config_; }
  104. SSLConfigService* ssl_config_service() { return ssl_config_service_; }
  105. CertVerifier* cert_verifier() { return cert_verifier_; }
  106. TransportSecurityState* transport_security_state() {
  107. return transport_security_state_;
  108. }
  109. CTPolicyEnforcer* ct_policy_enforcer() { return ct_policy_enforcer_; }
  110. SSLClientSessionCache* ssl_client_session_cache() {
  111. return ssl_client_session_cache_;
  112. }
  113. SCTAuditingDelegate* sct_auditing_delegate() {
  114. return sct_auditing_delegate_;
  115. }
  116. // Returns whether ECH (Encrypted ClientHello) should be enabled. This
  117. // function checks both config() and feature flags.
  118. bool EncryptedClientHelloEnabled() const;
  119. // Creates a new SSLClientSocket which can then be used to establish an SSL
  120. // connection to |host_and_port| over the already-connected |stream_socket|.
  121. std::unique_ptr<SSLClientSocket> CreateSSLClientSocket(
  122. std::unique_ptr<StreamSocket> stream_socket,
  123. const HostPortPair& host_and_port,
  124. const SSLConfig& ssl_config);
  125. // Looks up the client certificate preference for |server|. If one is found,
  126. // returns true and sets |client_cert| and |private_key| to the certificate
  127. // and key. Note these may be null if the preference is to continue with no
  128. // client certificate. Returns false if no preferences are configured,
  129. // which means client certificate requests should be reported as
  130. // ERR_SSL_CLIENT_AUTH_CERT_NEEDED.
  131. bool GetClientCertificate(const HostPortPair& server,
  132. scoped_refptr<X509Certificate>* client_cert,
  133. scoped_refptr<SSLPrivateKey>* private_key);
  134. // Configures all subsequent connections to |server| to authenticate with
  135. // |client_cert| and |private_key| when requested. If there is already a
  136. // client certificate for |server|, it will be overwritten. |client_cert| and
  137. // |private_key| may be null to indicate that no client certificate should be
  138. // sent to |server|.
  139. //
  140. // Note this method will synchronously call OnSSLConfigForServerChanged() on
  141. // observers.
  142. void SetClientCertificate(const HostPortPair& server,
  143. scoped_refptr<X509Certificate> client_cert,
  144. scoped_refptr<SSLPrivateKey> private_key);
  145. // Clears a client certificate preference for |server| set by
  146. // SetClientCertificate(). Returns true if one was removed and false
  147. // otherwise.
  148. //
  149. // Note this method will synchronously call OnSSLConfigForServerChanged() on
  150. // observers.
  151. bool ClearClientCertificate(const HostPortPair& server);
  152. // Add an observer to be notified when configuration has changed.
  153. // RemoveObserver() must be called before |observer| is destroyed.
  154. void AddObserver(Observer* observer);
  155. // Remove an observer added with AddObserver().
  156. void RemoveObserver(Observer* observer);
  157. // SSLConfigService::Observer:
  158. void OnSSLContextConfigChanged() override;
  159. // CertDatabase::Observer:
  160. void OnCertDBChanged() override;
  161. private:
  162. void NotifySSLConfigChanged(bool is_cert_database_change);
  163. void NotifySSLConfigForServerChanged(const HostPortPair& server);
  164. SSLContextConfig config_;
  165. raw_ptr<SSLConfigService> ssl_config_service_;
  166. raw_ptr<CertVerifier> cert_verifier_;
  167. raw_ptr<TransportSecurityState> transport_security_state_;
  168. raw_ptr<CTPolicyEnforcer> ct_policy_enforcer_;
  169. raw_ptr<SSLClientSessionCache> ssl_client_session_cache_;
  170. raw_ptr<SCTAuditingDelegate> sct_auditing_delegate_;
  171. SSLClientAuthCache ssl_client_auth_cache_;
  172. base::ObserverList<Observer, true /* check_empty */> observers_;
  173. };
  174. } // namespace net
  175. #endif // NET_SOCKET_SSL_CLIENT_SOCKET_H_