ssl_server_socket_impl.cc 37 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/socket/ssl_server_socket_impl.h"
  5. #include <memory>
  6. #include <utility>
  7. #include "base/bind.h"
  8. #include "base/callback_helpers.h"
  9. #include "base/logging.h"
  10. #include "base/memory/raw_ptr.h"
  11. #include "base/memory/weak_ptr.h"
  12. #include "base/strings/string_util.h"
  13. #include "crypto/openssl_util.h"
  14. #include "crypto/rsa_private_key.h"
  15. #include "net/base/completion_once_callback.h"
  16. #include "net/base/net_errors.h"
  17. #include "net/cert/cert_verify_result.h"
  18. #include "net/cert/client_cert_verifier.h"
  19. #include "net/cert/x509_util.h"
  20. #include "net/log/net_log_event_type.h"
  21. #include "net/log/net_log_with_source.h"
  22. #include "net/socket/socket_bio_adapter.h"
  23. #include "net/ssl/openssl_ssl_util.h"
  24. #include "net/ssl/ssl_connection_status_flags.h"
  25. #include "net/ssl/ssl_info.h"
  26. #include "net/traffic_annotation/network_traffic_annotation.h"
  27. #include "third_party/abseil-cpp/absl/types/optional.h"
  28. #include "third_party/boringssl/src/include/openssl/bytestring.h"
  29. #include "third_party/boringssl/src/include/openssl/err.h"
  30. #include "third_party/boringssl/src/include/openssl/pool.h"
  31. #include "third_party/boringssl/src/include/openssl/ssl.h"
  32. #define GotoState(s) next_handshake_state_ = s
  33. namespace net {
  34. namespace {
  35. // This constant can be any non-negative/non-zero value (eg: it does not
  36. // overlap with any value of the net::Error range, including net::OK).
  37. const int kSSLServerSocketNoPendingResult = 1;
  38. } // namespace
  39. class SSLServerContextImpl::SocketImpl : public SSLServerSocket,
  40. public SocketBIOAdapter::Delegate {
  41. public:
  42. SocketImpl(SSLServerContextImpl* context,
  43. std::unique_ptr<StreamSocket> socket);
  44. SocketImpl(const SocketImpl&) = delete;
  45. SocketImpl& operator=(const SocketImpl&) = delete;
  46. ~SocketImpl() override;
  47. // SSLServerSocket interface.
  48. int Handshake(CompletionOnceCallback callback) override;
  49. // SSLSocket interface.
  50. int ExportKeyingMaterial(const base::StringPiece& label,
  51. bool has_context,
  52. const base::StringPiece& context,
  53. unsigned char* out,
  54. unsigned int outlen) override;
  55. // Socket interface (via StreamSocket).
  56. int Read(IOBuffer* buf,
  57. int buf_len,
  58. CompletionOnceCallback callback) override;
  59. int ReadIfReady(IOBuffer* buf,
  60. int buf_len,
  61. CompletionOnceCallback callback) override;
  62. int CancelReadIfReady() override;
  63. int Write(IOBuffer* buf,
  64. int buf_len,
  65. CompletionOnceCallback callback,
  66. const NetworkTrafficAnnotationTag& traffic_annotation) override;
  67. int SetReceiveBufferSize(int32_t size) override;
  68. int SetSendBufferSize(int32_t size) override;
  69. // StreamSocket implementation.
  70. int Connect(CompletionOnceCallback callback) override;
  71. void Disconnect() override;
  72. bool IsConnected() const override;
  73. bool IsConnectedAndIdle() const override;
  74. int GetPeerAddress(IPEndPoint* address) const override;
  75. int GetLocalAddress(IPEndPoint* address) const override;
  76. const NetLogWithSource& NetLog() const override;
  77. bool WasEverUsed() const override;
  78. bool WasAlpnNegotiated() const override;
  79. NextProto GetNegotiatedProtocol() const override;
  80. absl::optional<base::StringPiece> GetPeerApplicationSettings() const override;
  81. bool GetSSLInfo(SSLInfo* ssl_info) override;
  82. int64_t GetTotalReceivedBytes() const override;
  83. void ApplySocketTag(const SocketTag& tag) override;
  84. static SocketImpl* FromSSL(SSL* ssl);
  85. static ssl_verify_result_t CertVerifyCallback(SSL* ssl, uint8_t* out_alert);
  86. ssl_verify_result_t CertVerifyCallbackImpl(uint8_t* out_alert);
  87. static const SSL_PRIVATE_KEY_METHOD kPrivateKeyMethod;
  88. static ssl_private_key_result_t PrivateKeySignCallback(SSL* ssl,
  89. uint8_t* out,
  90. size_t* out_len,
  91. size_t max_out,
  92. uint16_t algorithm,
  93. const uint8_t* in,
  94. size_t in_len);
  95. static ssl_private_key_result_t PrivateKeyDecryptCallback(SSL* ssl,
  96. uint8_t* out,
  97. size_t* out_len,
  98. size_t max_out,
  99. const uint8_t* in,
  100. size_t in_len);
  101. static ssl_private_key_result_t PrivateKeyCompleteCallback(SSL* ssl,
  102. uint8_t* out,
  103. size_t* out_len,
  104. size_t max_out);
  105. ssl_private_key_result_t PrivateKeySignCallback(uint8_t* out,
  106. size_t* out_len,
  107. size_t max_out,
  108. uint16_t algorithm,
  109. const uint8_t* in,
  110. size_t in_len);
  111. ssl_private_key_result_t PrivateKeyCompleteCallback(uint8_t* out,
  112. size_t* out_len,
  113. size_t max_out);
  114. void OnPrivateKeyComplete(Error error, const std::vector<uint8_t>& signature);
  115. static int ALPNSelectCallback(SSL* ssl,
  116. const uint8_t** out,
  117. uint8_t* out_len,
  118. const uint8_t* in,
  119. unsigned in_len,
  120. void* arg);
  121. static ssl_select_cert_result_t SelectCertificateCallback(
  122. const SSL_CLIENT_HELLO* client_hello);
  123. // SocketBIOAdapter::Delegate implementation.
  124. void OnReadReady() override;
  125. void OnWriteReady() override;
  126. private:
  127. enum State {
  128. STATE_NONE,
  129. STATE_HANDSHAKE,
  130. };
  131. void OnHandshakeIOComplete(int result);
  132. int DoPayloadRead(IOBuffer* buf, int buf_len);
  133. int DoPayloadWrite();
  134. int DoHandshakeLoop(int last_io_result);
  135. int DoHandshake();
  136. void DoHandshakeCallback(int result);
  137. void DoReadCallback(int result);
  138. void DoWriteCallback(int result);
  139. int Init();
  140. void ExtractClientCert();
  141. raw_ptr<SSLServerContextImpl> context_;
  142. NetLogWithSource net_log_;
  143. CompletionOnceCallback user_handshake_callback_;
  144. CompletionOnceCallback user_read_callback_;
  145. CompletionOnceCallback user_write_callback_;
  146. // SSLPrivateKey signature.
  147. int signature_result_;
  148. std::vector<uint8_t> signature_;
  149. // Used by Read function.
  150. scoped_refptr<IOBuffer> user_read_buf_;
  151. int user_read_buf_len_ = 0;
  152. // Used by Write function.
  153. scoped_refptr<IOBuffer> user_write_buf_;
  154. int user_write_buf_len_ = 0;
  155. // OpenSSL stuff
  156. bssl::UniquePtr<SSL> ssl_;
  157. // Whether we received any data in early data.
  158. bool early_data_received_ = false;
  159. // StreamSocket for sending and receiving data.
  160. std::unique_ptr<StreamSocket> transport_socket_;
  161. std::unique_ptr<SocketBIOAdapter> transport_adapter_;
  162. // Certificate for the client.
  163. scoped_refptr<X509Certificate> client_cert_;
  164. State next_handshake_state_ = STATE_NONE;
  165. bool completed_handshake_ = false;
  166. NextProto negotiated_protocol_ = kProtoUnknown;
  167. base::WeakPtrFactory<SocketImpl> weak_factory_{this};
  168. };
  169. SSLServerContextImpl::SocketImpl::SocketImpl(
  170. SSLServerContextImpl* context,
  171. std::unique_ptr<StreamSocket> transport_socket)
  172. : context_(context),
  173. signature_result_(kSSLServerSocketNoPendingResult),
  174. transport_socket_(std::move(transport_socket)) {}
  175. SSLServerContextImpl::SocketImpl::~SocketImpl() {
  176. if (ssl_) {
  177. // Calling SSL_shutdown prevents the session from being marked as
  178. // unresumable.
  179. SSL_shutdown(ssl_.get());
  180. ssl_.reset();
  181. }
  182. }
  183. // static
  184. const SSL_PRIVATE_KEY_METHOD
  185. SSLServerContextImpl::SocketImpl::kPrivateKeyMethod = {
  186. &SSLServerContextImpl::SocketImpl::PrivateKeySignCallback,
  187. &SSLServerContextImpl::SocketImpl::PrivateKeyDecryptCallback,
  188. &SSLServerContextImpl::SocketImpl::PrivateKeyCompleteCallback,
  189. };
  190. // static
  191. ssl_private_key_result_t
  192. SSLServerContextImpl::SocketImpl::PrivateKeySignCallback(SSL* ssl,
  193. uint8_t* out,
  194. size_t* out_len,
  195. size_t max_out,
  196. uint16_t algorithm,
  197. const uint8_t* in,
  198. size_t in_len) {
  199. return FromSSL(ssl)->PrivateKeySignCallback(out, out_len, max_out, algorithm,
  200. in, in_len);
  201. }
  202. // static
  203. ssl_private_key_result_t
  204. SSLServerContextImpl::SocketImpl::PrivateKeyDecryptCallback(SSL* ssl,
  205. uint8_t* out,
  206. size_t* out_len,
  207. size_t max_out,
  208. const uint8_t* in,
  209. size_t in_len) {
  210. // Decrypt is not supported.
  211. return ssl_private_key_failure;
  212. }
  213. // static
  214. ssl_private_key_result_t
  215. SSLServerContextImpl::SocketImpl::PrivateKeyCompleteCallback(SSL* ssl,
  216. uint8_t* out,
  217. size_t* out_len,
  218. size_t max_out) {
  219. return FromSSL(ssl)->PrivateKeyCompleteCallback(out, out_len, max_out);
  220. }
  221. ssl_private_key_result_t
  222. SSLServerContextImpl::SocketImpl::PrivateKeySignCallback(uint8_t* out,
  223. size_t* out_len,
  224. size_t max_out,
  225. uint16_t algorithm,
  226. const uint8_t* in,
  227. size_t in_len) {
  228. DCHECK(context_);
  229. DCHECK(context_->private_key_);
  230. signature_result_ = ERR_IO_PENDING;
  231. context_->private_key_->Sign(
  232. algorithm, base::make_span(in, in_len),
  233. base::BindOnce(&SSLServerContextImpl::SocketImpl::OnPrivateKeyComplete,
  234. weak_factory_.GetWeakPtr()));
  235. return ssl_private_key_retry;
  236. }
  237. ssl_private_key_result_t
  238. SSLServerContextImpl::SocketImpl::PrivateKeyCompleteCallback(uint8_t* out,
  239. size_t* out_len,
  240. size_t max_out) {
  241. if (signature_result_ == ERR_IO_PENDING)
  242. return ssl_private_key_retry;
  243. if (signature_result_ != OK) {
  244. OpenSSLPutNetError(FROM_HERE, signature_result_);
  245. return ssl_private_key_failure;
  246. }
  247. if (signature_.size() > max_out) {
  248. OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
  249. return ssl_private_key_failure;
  250. }
  251. memcpy(out, signature_.data(), signature_.size());
  252. *out_len = signature_.size();
  253. signature_.clear();
  254. return ssl_private_key_success;
  255. }
  256. void SSLServerContextImpl::SocketImpl::OnPrivateKeyComplete(
  257. Error error,
  258. const std::vector<uint8_t>& signature) {
  259. DCHECK_EQ(ERR_IO_PENDING, signature_result_);
  260. DCHECK(signature_.empty());
  261. signature_result_ = error;
  262. if (signature_result_ == OK)
  263. signature_ = signature;
  264. DoHandshakeLoop(ERR_IO_PENDING);
  265. }
  266. // static
  267. int SSLServerContextImpl::SocketImpl::ALPNSelectCallback(SSL* ssl,
  268. const uint8_t** out,
  269. uint8_t* out_len,
  270. const uint8_t* in,
  271. unsigned in_len,
  272. void* arg) {
  273. SSLServerContextImpl::SocketImpl* socket = FromSSL(ssl);
  274. // Iterate over the server protocols in preference order.
  275. for (NextProto server_proto :
  276. socket->context_->ssl_server_config_.alpn_protos) {
  277. const char* server_proto_str = NextProtoToString(server_proto);
  278. // See if the client advertised the corresponding protocol.
  279. CBS cbs;
  280. CBS_init(&cbs, in, in_len);
  281. while (CBS_len(&cbs) != 0) {
  282. CBS client_proto;
  283. if (!CBS_get_u8_length_prefixed(&cbs, &client_proto)) {
  284. return SSL_TLSEXT_ERR_NOACK;
  285. }
  286. if (base::StringPiece(
  287. reinterpret_cast<const char*>(CBS_data(&client_proto)),
  288. CBS_len(&client_proto)) == server_proto_str) {
  289. *out = CBS_data(&client_proto);
  290. *out_len = CBS_len(&client_proto);
  291. const auto& application_settings =
  292. socket->context_->ssl_server_config_.application_settings;
  293. auto it = application_settings.find(server_proto);
  294. if (it != application_settings.end()) {
  295. const std::vector<uint8_t>& data = it->second;
  296. SSL_add_application_settings(ssl, CBS_data(&client_proto),
  297. CBS_len(&client_proto), data.data(),
  298. data.size());
  299. }
  300. return SSL_TLSEXT_ERR_OK;
  301. }
  302. }
  303. }
  304. return SSL_TLSEXT_ERR_NOACK;
  305. }
  306. ssl_select_cert_result_t
  307. SSLServerContextImpl::SocketImpl::SelectCertificateCallback(
  308. const SSL_CLIENT_HELLO* client_hello) {
  309. SSLServerContextImpl::SocketImpl* socket = FromSSL(client_hello->ssl);
  310. const SSLServerConfig& config = socket->context_->ssl_server_config_;
  311. if (!config.client_hello_callback_for_testing.is_null() &&
  312. !config.client_hello_callback_for_testing.Run(client_hello)) {
  313. return ssl_select_cert_error;
  314. }
  315. return ssl_select_cert_success;
  316. }
  317. int SSLServerContextImpl::SocketImpl::Handshake(
  318. CompletionOnceCallback callback) {
  319. net_log_.BeginEvent(NetLogEventType::SSL_SERVER_HANDSHAKE);
  320. // Set up new ssl object.
  321. int rv = Init();
  322. if (rv != OK) {
  323. LOG(ERROR) << "Failed to initialize OpenSSL: rv=" << rv;
  324. net_log_.EndEventWithNetErrorCode(NetLogEventType::SSL_SERVER_HANDSHAKE,
  325. rv);
  326. return rv;
  327. }
  328. // Set SSL to server mode. Handshake happens in the loop below.
  329. SSL_set_accept_state(ssl_.get());
  330. GotoState(STATE_HANDSHAKE);
  331. rv = DoHandshakeLoop(OK);
  332. if (rv == ERR_IO_PENDING) {
  333. user_handshake_callback_ = std::move(callback);
  334. } else {
  335. net_log_.EndEventWithNetErrorCode(NetLogEventType::SSL_SERVER_HANDSHAKE,
  336. rv);
  337. }
  338. return rv > OK ? OK : rv;
  339. }
  340. int SSLServerContextImpl::SocketImpl::ExportKeyingMaterial(
  341. const base::StringPiece& label,
  342. bool has_context,
  343. const base::StringPiece& context,
  344. unsigned char* out,
  345. unsigned int outlen) {
  346. if (!IsConnected())
  347. return ERR_SOCKET_NOT_CONNECTED;
  348. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  349. int rv = SSL_export_keying_material(
  350. ssl_.get(), out, outlen, label.data(), label.size(),
  351. reinterpret_cast<const unsigned char*>(context.data()), context.length(),
  352. context.length() > 0);
  353. if (rv != 1) {
  354. int ssl_error = SSL_get_error(ssl_.get(), rv);
  355. LOG(ERROR) << "Failed to export keying material;"
  356. << " returned " << rv << ", SSL error code " << ssl_error;
  357. return MapOpenSSLError(ssl_error, err_tracer);
  358. }
  359. return OK;
  360. }
  361. int SSLServerContextImpl::SocketImpl::Read(IOBuffer* buf,
  362. int buf_len,
  363. CompletionOnceCallback callback) {
  364. int rv = ReadIfReady(buf, buf_len, std::move(callback));
  365. if (rv == ERR_IO_PENDING) {
  366. user_read_buf_ = buf;
  367. user_read_buf_len_ = buf_len;
  368. }
  369. return rv;
  370. }
  371. int SSLServerContextImpl::SocketImpl::ReadIfReady(
  372. IOBuffer* buf,
  373. int buf_len,
  374. CompletionOnceCallback callback) {
  375. DCHECK(user_read_callback_.is_null());
  376. DCHECK(user_handshake_callback_.is_null());
  377. DCHECK(!user_read_buf_);
  378. DCHECK(!callback.is_null());
  379. DCHECK(completed_handshake_);
  380. int rv = DoPayloadRead(buf, buf_len);
  381. if (rv == ERR_IO_PENDING) {
  382. user_read_callback_ = std::move(callback);
  383. }
  384. return rv;
  385. }
  386. int SSLServerContextImpl::SocketImpl::CancelReadIfReady() {
  387. DCHECK(user_read_callback_);
  388. DCHECK(!user_read_buf_);
  389. // Cancel |user_read_callback_|, because caller does not expect the callback
  390. // to be invoked after they have canceled the ReadIfReady.
  391. //
  392. // We do not pass the signal on to |stream_socket_| or |transport_adapter_|.
  393. // When it completes, it will signal OnReadReady(), which will notice there is
  394. // no read operation to progress and skip it. Unlike with SSLClientSocket,
  395. // SSL and transport reads are more aligned, but this avoids making
  396. // assumptions or breaking the SocketBIOAdapter's state.
  397. user_read_callback_.Reset();
  398. return OK;
  399. }
  400. int SSLServerContextImpl::SocketImpl::Write(
  401. IOBuffer* buf,
  402. int buf_len,
  403. CompletionOnceCallback callback,
  404. const NetworkTrafficAnnotationTag& traffic_annotation) {
  405. DCHECK(user_write_callback_.is_null());
  406. DCHECK(!user_write_buf_);
  407. DCHECK(!callback.is_null());
  408. user_write_buf_ = buf;
  409. user_write_buf_len_ = buf_len;
  410. int rv = DoPayloadWrite();
  411. if (rv == ERR_IO_PENDING) {
  412. user_write_callback_ = std::move(callback);
  413. } else {
  414. user_write_buf_ = nullptr;
  415. user_write_buf_len_ = 0;
  416. }
  417. return rv;
  418. }
  419. int SSLServerContextImpl::SocketImpl::SetReceiveBufferSize(int32_t size) {
  420. return transport_socket_->SetReceiveBufferSize(size);
  421. }
  422. int SSLServerContextImpl::SocketImpl::SetSendBufferSize(int32_t size) {
  423. return transport_socket_->SetSendBufferSize(size);
  424. }
  425. int SSLServerContextImpl::SocketImpl::Connect(CompletionOnceCallback callback) {
  426. NOTIMPLEMENTED();
  427. return ERR_NOT_IMPLEMENTED;
  428. }
  429. void SSLServerContextImpl::SocketImpl::Disconnect() {
  430. transport_socket_->Disconnect();
  431. }
  432. bool SSLServerContextImpl::SocketImpl::IsConnected() const {
  433. // TODO(wtc): Find out if we should check transport_socket_->IsConnected()
  434. // as well.
  435. return completed_handshake_;
  436. }
  437. bool SSLServerContextImpl::SocketImpl::IsConnectedAndIdle() const {
  438. return completed_handshake_ && transport_socket_->IsConnectedAndIdle();
  439. }
  440. int SSLServerContextImpl::SocketImpl::GetPeerAddress(
  441. IPEndPoint* address) const {
  442. if (!IsConnected())
  443. return ERR_SOCKET_NOT_CONNECTED;
  444. return transport_socket_->GetPeerAddress(address);
  445. }
  446. int SSLServerContextImpl::SocketImpl::GetLocalAddress(
  447. IPEndPoint* address) const {
  448. if (!IsConnected())
  449. return ERR_SOCKET_NOT_CONNECTED;
  450. return transport_socket_->GetLocalAddress(address);
  451. }
  452. const NetLogWithSource& SSLServerContextImpl::SocketImpl::NetLog() const {
  453. return net_log_;
  454. }
  455. bool SSLServerContextImpl::SocketImpl::WasEverUsed() const {
  456. return transport_socket_->WasEverUsed();
  457. }
  458. bool SSLServerContextImpl::SocketImpl::WasAlpnNegotiated() const {
  459. return negotiated_protocol_ != kProtoUnknown;
  460. }
  461. NextProto SSLServerContextImpl::SocketImpl::GetNegotiatedProtocol() const {
  462. return negotiated_protocol_;
  463. }
  464. absl::optional<base::StringPiece>
  465. SSLServerContextImpl::SocketImpl::GetPeerApplicationSettings() const {
  466. if (!SSL_has_application_settings(ssl_.get())) {
  467. return absl::nullopt;
  468. }
  469. const uint8_t* out_data;
  470. size_t out_len;
  471. SSL_get0_peer_application_settings(ssl_.get(), &out_data, &out_len);
  472. return base::StringPiece{reinterpret_cast<const char*>(out_data), out_len};
  473. }
  474. bool SSLServerContextImpl::SocketImpl::GetSSLInfo(SSLInfo* ssl_info) {
  475. ssl_info->Reset();
  476. if (!completed_handshake_)
  477. return false;
  478. ssl_info->cert = client_cert_;
  479. const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_.get());
  480. CHECK(cipher);
  481. SSLConnectionStatusSetCipherSuite(
  482. static_cast<uint16_t>(SSL_CIPHER_get_id(cipher)),
  483. &ssl_info->connection_status);
  484. SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_.get()),
  485. &ssl_info->connection_status);
  486. ssl_info->early_data_received = early_data_received_;
  487. ssl_info->encrypted_client_hello = SSL_ech_accepted(ssl_.get());
  488. ssl_info->handshake_type = SSL_session_reused(ssl_.get())
  489. ? SSLInfo::HANDSHAKE_RESUME
  490. : SSLInfo::HANDSHAKE_FULL;
  491. return true;
  492. }
  493. int64_t SSLServerContextImpl::SocketImpl::GetTotalReceivedBytes() const {
  494. return transport_socket_->GetTotalReceivedBytes();
  495. }
  496. void SSLServerContextImpl::SocketImpl::ApplySocketTag(const SocketTag& tag) {
  497. NOTIMPLEMENTED();
  498. }
  499. void SSLServerContextImpl::SocketImpl::OnReadReady() {
  500. if (next_handshake_state_ == STATE_HANDSHAKE) {
  501. // In handshake phase. The parameter to OnHandshakeIOComplete is unused.
  502. OnHandshakeIOComplete(OK);
  503. return;
  504. }
  505. // BoringSSL does not support renegotiation as a server, so the only other
  506. // operation blocked on Read is DoPayloadRead.
  507. if (!user_read_buf_) {
  508. if (!user_read_callback_.is_null()) {
  509. DoReadCallback(OK);
  510. }
  511. return;
  512. }
  513. int rv = DoPayloadRead(user_read_buf_.get(), user_read_buf_len_);
  514. if (rv != ERR_IO_PENDING)
  515. DoReadCallback(rv);
  516. }
  517. void SSLServerContextImpl::SocketImpl::OnWriteReady() {
  518. if (next_handshake_state_ == STATE_HANDSHAKE) {
  519. // In handshake phase. The parameter to OnHandshakeIOComplete is unused.
  520. OnHandshakeIOComplete(OK);
  521. return;
  522. }
  523. // BoringSSL does not support renegotiation as a server, so the only other
  524. // operation blocked on Read is DoPayloadWrite.
  525. if (!user_write_buf_)
  526. return;
  527. int rv = DoPayloadWrite();
  528. if (rv != ERR_IO_PENDING)
  529. DoWriteCallback(rv);
  530. }
  531. void SSLServerContextImpl::SocketImpl::OnHandshakeIOComplete(int result) {
  532. int rv = DoHandshakeLoop(result);
  533. if (rv == ERR_IO_PENDING)
  534. return;
  535. net_log_.EndEventWithNetErrorCode(NetLogEventType::SSL_SERVER_HANDSHAKE, rv);
  536. if (!user_handshake_callback_.is_null())
  537. DoHandshakeCallback(rv);
  538. }
  539. int SSLServerContextImpl::SocketImpl::DoPayloadRead(IOBuffer* buf,
  540. int buf_len) {
  541. DCHECK(completed_handshake_);
  542. DCHECK_EQ(STATE_NONE, next_handshake_state_);
  543. DCHECK(buf);
  544. DCHECK_GT(buf_len, 0);
  545. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  546. int rv = SSL_read(ssl_.get(), buf->data(), buf_len);
  547. if (rv >= 0) {
  548. if (SSL_in_early_data(ssl_.get()))
  549. early_data_received_ = true;
  550. return rv;
  551. }
  552. int ssl_error = SSL_get_error(ssl_.get(), rv);
  553. OpenSSLErrorInfo error_info;
  554. int net_error =
  555. MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
  556. if (net_error != ERR_IO_PENDING) {
  557. NetLogOpenSSLError(net_log_, NetLogEventType::SSL_READ_ERROR, net_error,
  558. ssl_error, error_info);
  559. }
  560. return net_error;
  561. }
  562. int SSLServerContextImpl::SocketImpl::DoPayloadWrite() {
  563. DCHECK(completed_handshake_);
  564. DCHECK_EQ(STATE_NONE, next_handshake_state_);
  565. DCHECK(user_write_buf_);
  566. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  567. int rv = SSL_write(ssl_.get(), user_write_buf_->data(), user_write_buf_len_);
  568. if (rv >= 0)
  569. return rv;
  570. int ssl_error = SSL_get_error(ssl_.get(), rv);
  571. OpenSSLErrorInfo error_info;
  572. int net_error =
  573. MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
  574. if (net_error != ERR_IO_PENDING) {
  575. NetLogOpenSSLError(net_log_, NetLogEventType::SSL_WRITE_ERROR, net_error,
  576. ssl_error, error_info);
  577. }
  578. return net_error;
  579. }
  580. int SSLServerContextImpl::SocketImpl::DoHandshakeLoop(int last_io_result) {
  581. int rv = last_io_result;
  582. do {
  583. // Default to STATE_NONE for next state.
  584. // (This is a quirk carried over from the windows
  585. // implementation. It makes reading the logs a bit harder.)
  586. // State handlers can and often do call GotoState just
  587. // to stay in the current state.
  588. State state = next_handshake_state_;
  589. GotoState(STATE_NONE);
  590. switch (state) {
  591. case STATE_HANDSHAKE:
  592. rv = DoHandshake();
  593. break;
  594. case STATE_NONE:
  595. default:
  596. rv = ERR_UNEXPECTED;
  597. LOG(DFATAL) << "unexpected state " << state;
  598. break;
  599. }
  600. } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE);
  601. return rv;
  602. }
  603. int SSLServerContextImpl::SocketImpl::DoHandshake() {
  604. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  605. int net_error = OK;
  606. int rv = SSL_do_handshake(ssl_.get());
  607. if (rv == 1) {
  608. const STACK_OF(CRYPTO_BUFFER)* certs =
  609. SSL_get0_peer_certificates(ssl_.get());
  610. if (certs) {
  611. client_cert_ = x509_util::CreateX509CertificateFromBuffers(certs);
  612. if (!client_cert_)
  613. return ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT;
  614. }
  615. const uint8_t* alpn_proto = nullptr;
  616. unsigned alpn_len = 0;
  617. SSL_get0_alpn_selected(ssl_.get(), &alpn_proto, &alpn_len);
  618. if (alpn_len > 0) {
  619. base::StringPiece proto(reinterpret_cast<const char*>(alpn_proto),
  620. alpn_len);
  621. negotiated_protocol_ = NextProtoFromString(proto);
  622. }
  623. if (context_->ssl_server_config_.alert_after_handshake_for_testing) {
  624. SSL_send_fatal_alert(ssl_.get(),
  625. context_->ssl_server_config_
  626. .alert_after_handshake_for_testing.value());
  627. return ERR_FAILED;
  628. }
  629. completed_handshake_ = true;
  630. } else {
  631. int ssl_error = SSL_get_error(ssl_.get(), rv);
  632. if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) {
  633. DCHECK(context_->private_key_);
  634. GotoState(STATE_HANDSHAKE);
  635. return ERR_IO_PENDING;
  636. }
  637. OpenSSLErrorInfo error_info;
  638. net_error = MapOpenSSLErrorWithDetails(ssl_error, err_tracer, &error_info);
  639. // SSL_R_CERTIFICATE_VERIFY_FAILED's mapping is different between client and
  640. // server.
  641. if (ERR_GET_LIB(error_info.error_code) == ERR_LIB_SSL &&
  642. ERR_GET_REASON(error_info.error_code) ==
  643. SSL_R_CERTIFICATE_VERIFY_FAILED) {
  644. net_error = ERR_BAD_SSL_CLIENT_AUTH_CERT;
  645. }
  646. // If not done, stay in this state
  647. if (net_error == ERR_IO_PENDING) {
  648. GotoState(STATE_HANDSHAKE);
  649. } else {
  650. LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code "
  651. << ssl_error << ", net_error " << net_error;
  652. NetLogOpenSSLError(net_log_, NetLogEventType::SSL_HANDSHAKE_ERROR,
  653. net_error, ssl_error, error_info);
  654. }
  655. }
  656. return net_error;
  657. }
  658. void SSLServerContextImpl::SocketImpl::DoHandshakeCallback(int rv) {
  659. DCHECK_NE(rv, ERR_IO_PENDING);
  660. std::move(user_handshake_callback_).Run(rv > OK ? OK : rv);
  661. }
  662. void SSLServerContextImpl::SocketImpl::DoReadCallback(int rv) {
  663. DCHECK(rv != ERR_IO_PENDING);
  664. DCHECK(!user_read_callback_.is_null());
  665. user_read_buf_ = nullptr;
  666. user_read_buf_len_ = 0;
  667. std::move(user_read_callback_).Run(rv);
  668. }
  669. void SSLServerContextImpl::SocketImpl::DoWriteCallback(int rv) {
  670. DCHECK(rv != ERR_IO_PENDING);
  671. DCHECK(!user_write_callback_.is_null());
  672. user_write_buf_ = nullptr;
  673. user_write_buf_len_ = 0;
  674. std::move(user_write_callback_).Run(rv);
  675. }
  676. int SSLServerContextImpl::SocketImpl::Init() {
  677. static const int kBufferSize = 17 * 1024;
  678. crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  679. ssl_.reset(SSL_new(context_->ssl_ctx_.get()));
  680. if (!ssl_ || !SSL_set_app_data(ssl_.get(), this)) {
  681. return ERR_UNEXPECTED;
  682. }
  683. SSL_set_shed_handshake_config(ssl_.get(), 1);
  684. // Set certificate and private key.
  685. if (context_->pkey_) {
  686. DCHECK(context_->cert_->cert_buffer());
  687. if (!SetSSLChainAndKey(ssl_.get(), context_->cert_.get(),
  688. context_->pkey_.get(), nullptr)) {
  689. return ERR_UNEXPECTED;
  690. }
  691. } else {
  692. DCHECK(context_->private_key_);
  693. if (!SetSSLChainAndKey(ssl_.get(), context_->cert_.get(), nullptr,
  694. &kPrivateKeyMethod)) {
  695. return ERR_UNEXPECTED;
  696. }
  697. std::vector<uint16_t> preferences =
  698. context_->private_key_->GetAlgorithmPreferences();
  699. SSL_set_signing_algorithm_prefs(ssl_.get(), preferences.data(),
  700. preferences.size());
  701. }
  702. if (context_->ssl_server_config_.signature_algorithm_for_testing
  703. .has_value()) {
  704. uint16_t id = *context_->ssl_server_config_.signature_algorithm_for_testing;
  705. CHECK(SSL_set_signing_algorithm_prefs(ssl_.get(), &id, 1));
  706. }
  707. const std::vector<int>& curves =
  708. context_->ssl_server_config_.curves_for_testing;
  709. if (!curves.empty()) {
  710. CHECK(SSL_set1_curves(ssl_.get(), curves.data(), curves.size()));
  711. }
  712. transport_adapter_ = std::make_unique<SocketBIOAdapter>(
  713. transport_socket_.get(), kBufferSize, kBufferSize, this);
  714. BIO* transport_bio = transport_adapter_->bio();
  715. BIO_up_ref(transport_bio); // SSL_set0_rbio takes ownership.
  716. SSL_set0_rbio(ssl_.get(), transport_bio);
  717. BIO_up_ref(transport_bio); // SSL_set0_wbio takes ownership.
  718. SSL_set0_wbio(ssl_.get(), transport_bio);
  719. return OK;
  720. }
  721. SSLServerContextImpl::SocketImpl* SSLServerContextImpl::SocketImpl::FromSSL(
  722. SSL* ssl) {
  723. SocketImpl* socket = reinterpret_cast<SocketImpl*>(SSL_get_app_data(ssl));
  724. DCHECK(socket);
  725. return socket;
  726. }
  727. // static
  728. ssl_verify_result_t SSLServerContextImpl::SocketImpl::CertVerifyCallback(
  729. SSL* ssl,
  730. uint8_t* out_alert) {
  731. return FromSSL(ssl)->CertVerifyCallbackImpl(out_alert);
  732. }
  733. ssl_verify_result_t SSLServerContextImpl::SocketImpl::CertVerifyCallbackImpl(
  734. uint8_t* out_alert) {
  735. ClientCertVerifier* verifier =
  736. context_->ssl_server_config_.client_cert_verifier;
  737. // If a verifier was not supplied, all certificates are accepted.
  738. if (!verifier)
  739. return ssl_verify_ok;
  740. scoped_refptr<X509Certificate> client_cert =
  741. x509_util::CreateX509CertificateFromBuffers(
  742. SSL_get0_peer_certificates(ssl_.get()));
  743. if (!client_cert) {
  744. *out_alert = SSL_AD_BAD_CERTIFICATE;
  745. return ssl_verify_invalid;
  746. }
  747. // TODO(davidben): Support asynchronous verifiers. http://crbug.com/347402
  748. std::unique_ptr<ClientCertVerifier::Request> ignore_async;
  749. int res = verifier->Verify(client_cert.get(), CompletionOnceCallback(),
  750. &ignore_async);
  751. DCHECK_NE(res, ERR_IO_PENDING);
  752. if (res != OK) {
  753. // TODO(davidben): Map from certificate verification failure to alert.
  754. *out_alert = SSL_AD_CERTIFICATE_UNKNOWN;
  755. return ssl_verify_invalid;
  756. }
  757. return ssl_verify_ok;
  758. }
  759. std::unique_ptr<SSLServerContext> CreateSSLServerContext(
  760. X509Certificate* certificate,
  761. EVP_PKEY* pkey,
  762. const SSLServerConfig& ssl_server_config) {
  763. return std::make_unique<SSLServerContextImpl>(certificate, pkey,
  764. ssl_server_config);
  765. }
  766. std::unique_ptr<SSLServerContext> CreateSSLServerContext(
  767. X509Certificate* certificate,
  768. const crypto::RSAPrivateKey& key,
  769. const SSLServerConfig& ssl_server_config) {
  770. return std::make_unique<SSLServerContextImpl>(certificate, key.key(),
  771. ssl_server_config);
  772. }
  773. std::unique_ptr<SSLServerContext> CreateSSLServerContext(
  774. X509Certificate* certificate,
  775. scoped_refptr<SSLPrivateKey> key,
  776. const SSLServerConfig& ssl_config) {
  777. return std::make_unique<SSLServerContextImpl>(certificate, key, ssl_config);
  778. }
  779. SSLServerContextImpl::SSLServerContextImpl(
  780. X509Certificate* certificate,
  781. scoped_refptr<net::SSLPrivateKey> key,
  782. const SSLServerConfig& ssl_server_config)
  783. : ssl_server_config_(ssl_server_config),
  784. cert_(certificate),
  785. private_key_(key) {
  786. CHECK(private_key_);
  787. Init();
  788. }
  789. SSLServerContextImpl::SSLServerContextImpl(
  790. X509Certificate* certificate,
  791. EVP_PKEY* pkey,
  792. const SSLServerConfig& ssl_server_config)
  793. : ssl_server_config_(ssl_server_config), cert_(certificate) {
  794. CHECK(pkey);
  795. pkey_ = bssl::UpRef(pkey);
  796. Init();
  797. }
  798. void SSLServerContextImpl::Init() {
  799. crypto::EnsureOpenSSLInit();
  800. ssl_ctx_.reset(SSL_CTX_new(TLS_with_buffers_method()));
  801. SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_SERVER);
  802. uint8_t session_ctx_id = 0;
  803. SSL_CTX_set_session_id_context(ssl_ctx_.get(), &session_ctx_id,
  804. sizeof(session_ctx_id));
  805. // Deduplicate all certificates minted from the SSL_CTX in memory.
  806. SSL_CTX_set0_buffer_pool(ssl_ctx_.get(), x509_util::GetBufferPool());
  807. int verify_mode = 0;
  808. switch (ssl_server_config_.client_cert_type) {
  809. case SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT:
  810. verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
  811. [[fallthrough]];
  812. case SSLServerConfig::ClientCertType::OPTIONAL_CLIENT_CERT:
  813. verify_mode |= SSL_VERIFY_PEER;
  814. SSL_CTX_set_custom_verify(ssl_ctx_.get(), verify_mode,
  815. SocketImpl::CertVerifyCallback);
  816. break;
  817. case SSLServerConfig::ClientCertType::NO_CLIENT_CERT:
  818. break;
  819. }
  820. SSL_CTX_set_early_data_enabled(ssl_ctx_.get(),
  821. ssl_server_config_.early_data_enabled);
  822. DCHECK_LT(SSL3_VERSION, ssl_server_config_.version_min);
  823. DCHECK_LT(SSL3_VERSION, ssl_server_config_.version_max);
  824. CHECK(SSL_CTX_set_min_proto_version(ssl_ctx_.get(),
  825. ssl_server_config_.version_min));
  826. CHECK(SSL_CTX_set_max_proto_version(ssl_ctx_.get(),
  827. ssl_server_config_.version_max));
  828. // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
  829. // set everything we care about to an absolute value.
  830. SslSetClearMask options;
  831. options.ConfigureFlag(SSL_OP_NO_COMPRESSION, true);
  832. SSL_CTX_set_options(ssl_ctx_.get(), options.set_mask);
  833. SSL_CTX_clear_options(ssl_ctx_.get(), options.clear_mask);
  834. // Same as above, this time for the SSL mode.
  835. SslSetClearMask mode;
  836. mode.ConfigureFlag(SSL_MODE_RELEASE_BUFFERS, true);
  837. SSL_CTX_set_mode(ssl_ctx_.get(), mode.set_mask);
  838. SSL_CTX_clear_mode(ssl_ctx_.get(), mode.clear_mask);
  839. if (ssl_server_config_.cipher_suite_for_testing.has_value()) {
  840. const SSL_CIPHER* cipher =
  841. SSL_get_cipher_by_value(*ssl_server_config_.cipher_suite_for_testing);
  842. CHECK(cipher);
  843. CHECK(SSL_CTX_set_strict_cipher_list(ssl_ctx_.get(),
  844. SSL_CIPHER_get_name(cipher)));
  845. } else {
  846. // See SSLServerConfig::disabled_cipher_suites for description of the suites
  847. // disabled by default. Note that !SHA256 and !SHA384 only remove
  848. // HMAC-SHA256 and HMAC-SHA384 cipher suites, not GCM cipher suites with
  849. // SHA256 or SHA384 as the handshake hash.
  850. std::string command("DEFAULT:!AESGCM+AES256:!aPSK");
  851. // SSLPrivateKey only supports ECDHE-based ciphers because it lacks decrypt.
  852. if (ssl_server_config_.require_ecdhe || (!pkey_ && private_key_))
  853. command.append(":!kRSA");
  854. // Remove any disabled ciphers.
  855. for (uint16_t id : ssl_server_config_.disabled_cipher_suites) {
  856. const SSL_CIPHER* cipher = SSL_get_cipher_by_value(id);
  857. if (cipher) {
  858. command.append(":!");
  859. command.append(SSL_CIPHER_get_name(cipher));
  860. }
  861. }
  862. CHECK(SSL_CTX_set_strict_cipher_list(ssl_ctx_.get(), command.c_str()));
  863. }
  864. if (ssl_server_config_.client_cert_type !=
  865. SSLServerConfig::ClientCertType::NO_CLIENT_CERT &&
  866. !ssl_server_config_.cert_authorities.empty()) {
  867. bssl::UniquePtr<STACK_OF(CRYPTO_BUFFER)> stack(sk_CRYPTO_BUFFER_new_null());
  868. for (const auto& authority : ssl_server_config_.cert_authorities) {
  869. sk_CRYPTO_BUFFER_push(stack.get(),
  870. x509_util::CreateCryptoBuffer(authority).release());
  871. }
  872. SSL_CTX_set0_client_CAs(ssl_ctx_.get(), stack.release());
  873. }
  874. SSL_CTX_set_alpn_select_cb(ssl_ctx_.get(), &SocketImpl::ALPNSelectCallback,
  875. nullptr);
  876. if (!ssl_server_config_.ocsp_response.empty()) {
  877. SSL_CTX_set_ocsp_response(ssl_ctx_.get(),
  878. ssl_server_config_.ocsp_response.data(),
  879. ssl_server_config_.ocsp_response.size());
  880. }
  881. if (!ssl_server_config_.signed_cert_timestamp_list.empty()) {
  882. SSL_CTX_set_signed_cert_timestamp_list(
  883. ssl_ctx_.get(), ssl_server_config_.signed_cert_timestamp_list.data(),
  884. ssl_server_config_.signed_cert_timestamp_list.size());
  885. }
  886. if (ssl_server_config_.ech_keys) {
  887. CHECK(SSL_CTX_set1_ech_keys(ssl_ctx_.get(),
  888. ssl_server_config_.ech_keys.get()));
  889. }
  890. SSL_CTX_set_select_certificate_cb(ssl_ctx_.get(),
  891. &SocketImpl::SelectCertificateCallback);
  892. }
  893. SSLServerContextImpl::~SSLServerContextImpl() = default;
  894. std::unique_ptr<SSLServerSocket> SSLServerContextImpl::CreateSSLServerSocket(
  895. std::unique_ptr<StreamSocket> socket) {
  896. return std::make_unique<SocketImpl>(this, std::move(socket));
  897. }
  898. } // namespace net