ssl_connect_job.h 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SOCKET_SSL_CONNECT_JOB_H_
  5. #define NET_SOCKET_SSL_CONNECT_JOB_H_
  6. #include <stdint.h>
  7. #include <memory>
  8. #include <set>
  9. #include <string>
  10. #include <vector>
  11. #include "base/memory/ref_counted.h"
  12. #include "base/time/time.h"
  13. #include "net/base/completion_once_callback.h"
  14. #include "net/base/completion_repeating_callback.h"
  15. #include "net/base/net_export.h"
  16. #include "net/base/network_isolation_key.h"
  17. #include "net/base/privacy_mode.h"
  18. #include "net/dns/host_resolver_results.h"
  19. #include "net/dns/public/resolve_error_info.h"
  20. #include "net/socket/connect_job.h"
  21. #include "net/socket/connection_attempts.h"
  22. #include "net/socket/ssl_client_socket.h"
  23. #include "net/ssl/ssl_cert_request_info.h"
  24. #include "net/ssl/ssl_config_service.h"
  25. #include "third_party/abseil-cpp/absl/types/optional.h"
  26. namespace net {
  27. class HostPortPair;
  28. class HttpProxySocketParams;
  29. class SocketTag;
  30. class SOCKSSocketParams;
  31. class TransportSocketParams;
  32. class NET_EXPORT_PRIVATE SSLSocketParams
  33. : public base::RefCounted<SSLSocketParams> {
  34. public:
  35. enum ConnectionType { DIRECT, SOCKS_PROXY, HTTP_PROXY };
  36. // Exactly one of |direct_params|, |socks_proxy_params|, and
  37. // |http_proxy_params| must be non-NULL.
  38. SSLSocketParams(scoped_refptr<TransportSocketParams> direct_params,
  39. scoped_refptr<SOCKSSocketParams> socks_proxy_params,
  40. scoped_refptr<HttpProxySocketParams> http_proxy_params,
  41. const HostPortPair& host_and_port,
  42. const SSLConfig& ssl_config,
  43. PrivacyMode privacy_mode,
  44. NetworkIsolationKey network_isolation_key);
  45. SSLSocketParams(const SSLSocketParams&) = delete;
  46. SSLSocketParams& operator=(const SSLSocketParams&) = delete;
  47. // Returns the type of the underlying connection.
  48. ConnectionType GetConnectionType() const;
  49. // Must be called only when GetConnectionType() returns DIRECT.
  50. const scoped_refptr<TransportSocketParams>& GetDirectConnectionParams() const;
  51. // Must be called only when GetConnectionType() returns SOCKS_PROXY.
  52. const scoped_refptr<SOCKSSocketParams>& GetSocksProxyConnectionParams() const;
  53. // Must be called only when GetConnectionType() returns HTTP_PROXY.
  54. const scoped_refptr<HttpProxySocketParams>& GetHttpProxyConnectionParams()
  55. const;
  56. const HostPortPair& host_and_port() const { return host_and_port_; }
  57. const SSLConfig& ssl_config() const { return ssl_config_; }
  58. PrivacyMode privacy_mode() const { return privacy_mode_; }
  59. const NetworkIsolationKey& network_isolation_key() const {
  60. return network_isolation_key_;
  61. }
  62. private:
  63. friend class base::RefCounted<SSLSocketParams>;
  64. ~SSLSocketParams();
  65. const scoped_refptr<TransportSocketParams> direct_params_;
  66. const scoped_refptr<SOCKSSocketParams> socks_proxy_params_;
  67. const scoped_refptr<HttpProxySocketParams> http_proxy_params_;
  68. const HostPortPair host_and_port_;
  69. const SSLConfig ssl_config_;
  70. const PrivacyMode privacy_mode_;
  71. const NetworkIsolationKey network_isolation_key_;
  72. };
  73. // SSLConnectJob establishes a connection, through a proxy if needed, and then
  74. // handles the SSL handshake. It returns an SSLClientSocket on success.
  75. class NET_EXPORT_PRIVATE SSLConnectJob : public ConnectJob,
  76. public ConnectJob::Delegate {
  77. public:
  78. class NET_EXPORT_PRIVATE Factory {
  79. public:
  80. Factory() = default;
  81. virtual ~Factory() = default;
  82. virtual std::unique_ptr<SSLConnectJob> Create(
  83. RequestPriority priority,
  84. const SocketTag& socket_tag,
  85. const CommonConnectJobParams* common_connect_job_params,
  86. scoped_refptr<SSLSocketParams> params,
  87. ConnectJob::Delegate* delegate,
  88. const NetLogWithSource* net_log);
  89. };
  90. // Note: the SSLConnectJob does not own |messenger| so it must outlive the
  91. // job.
  92. SSLConnectJob(RequestPriority priority,
  93. const SocketTag& socket_tag,
  94. const CommonConnectJobParams* common_connect_job_params,
  95. scoped_refptr<SSLSocketParams> params,
  96. ConnectJob::Delegate* delegate,
  97. const NetLogWithSource* net_log);
  98. SSLConnectJob(const SSLConnectJob&) = delete;
  99. SSLConnectJob& operator=(const SSLConnectJob&) = delete;
  100. ~SSLConnectJob() override;
  101. // ConnectJob methods.
  102. LoadState GetLoadState() const override;
  103. bool HasEstablishedConnection() const override;
  104. // ConnectJob::Delegate methods.
  105. void OnConnectJobComplete(int result, ConnectJob* job) override;
  106. void OnNeedsProxyAuth(const HttpResponseInfo& response,
  107. HttpAuthController* auth_controller,
  108. base::OnceClosure restart_with_auth_callback,
  109. ConnectJob* job) override;
  110. ConnectionAttempts GetConnectionAttempts() const override;
  111. ResolveErrorInfo GetResolveErrorInfo() const override;
  112. bool IsSSLError() const override;
  113. scoped_refptr<SSLCertRequestInfo> GetCertRequestInfo() override;
  114. // Returns the timeout for the SSL handshake. This is the same for all
  115. // connections regardless of whether or not there is a proxy in use.
  116. static base::TimeDelta HandshakeTimeoutForTesting();
  117. private:
  118. enum State {
  119. STATE_TRANSPORT_CONNECT,
  120. STATE_TRANSPORT_CONNECT_COMPLETE,
  121. STATE_SOCKS_CONNECT,
  122. STATE_SOCKS_CONNECT_COMPLETE,
  123. STATE_TUNNEL_CONNECT,
  124. STATE_TUNNEL_CONNECT_COMPLETE,
  125. STATE_SSL_CONNECT,
  126. STATE_SSL_CONNECT_COMPLETE,
  127. STATE_NONE,
  128. };
  129. void OnIOComplete(int result);
  130. // Runs the state transition loop.
  131. int DoLoop(int result);
  132. int DoTransportConnect();
  133. int DoTransportConnectComplete(int result);
  134. int DoSOCKSConnect();
  135. int DoSOCKSConnectComplete(int result);
  136. int DoTunnelConnect();
  137. int DoTunnelConnectComplete(int result);
  138. int DoSSLConnect();
  139. int DoSSLConnectComplete(int result);
  140. // Returns the initial state for the state machine based on the
  141. // |connection_type|.
  142. static State GetInitialState(SSLSocketParams::ConnectionType connection_type);
  143. // Starts the SSL connection process. Returns OK on success and
  144. // ERR_IO_PENDING if it cannot immediately service the request.
  145. // Otherwise, it returns a net error code.
  146. int ConnectInternal() override;
  147. void ResetStateForRestart();
  148. void ChangePriorityInternal(RequestPriority priority) override;
  149. scoped_refptr<SSLSocketParams> params_;
  150. State next_state_;
  151. CompletionRepeatingCallback callback_;
  152. std::unique_ptr<ConnectJob> nested_connect_job_;
  153. std::unique_ptr<StreamSocket> nested_socket_;
  154. std::unique_ptr<SSLClientSocket> ssl_socket_;
  155. // True once SSL negotiation has started.
  156. bool ssl_negotiation_started_ = false;
  157. // True if legacy crypto should be disabled for the job's current connection
  158. // attempt. On error, the connection will be retried with legacy crypto
  159. // enabled.
  160. bool disable_legacy_crypto_with_fallback_ = true;
  161. scoped_refptr<SSLCertRequestInfo> ssl_cert_request_info_;
  162. ConnectionAttempts connection_attempts_;
  163. ResolveErrorInfo resolve_error_info_;
  164. // The address of the server the connect job is connected to. Populated if
  165. // and only if the connect job is connected *directly* to the server (not
  166. // through an HTTPS CONNECT request or a SOCKS proxy).
  167. IPEndPoint server_address_;
  168. // Any DNS aliases for the remote endpoint. Includes all known aliases, e.g.
  169. // from A, AAAA, or HTTPS, not just from the address used for the connection,
  170. // in no particular order. Stored because `nested_connect_job_` has a limited
  171. // lifetime and the aliases can no longer be retrieved from there by by the
  172. // time that the aliases are needed to be passed in SetSocket.
  173. std::set<std::string> dns_aliases_;
  174. // The endpoint result used by `nested_connect_job_`. Stored because
  175. // `nested_connect_job_` has a limited lifetime.
  176. absl::optional<HostResolverEndpointResult> endpoint_result_;
  177. // If not `absl::nullopt`, the ECH retry configs to use in the ECH recovery
  178. // flow. `endpoint_result_` will then contain the endpoint to reconnect to.
  179. absl::optional<std::vector<uint8_t>> ech_retry_configs_;
  180. };
  181. } // namespace net
  182. #endif // NET_SOCKET_SSL_CONNECT_JOB_H_