1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/socket/ssl_client_socket_pool.h"
6
7 #include "base/bind.h"
8 #include "base/bind_helpers.h"
9 #include "base/metrics/field_trial.h"
10 #include "base/metrics/histogram.h"
11 #include "base/metrics/sparse_histogram.h"
12 #include "base/stl_util.h"
13 #include "base/values.h"
14 #include "net/base/host_port_pair.h"
15 #include "net/base/net_errors.h"
16 #include "net/http/http_proxy_client_socket.h"
17 #include "net/http/http_proxy_client_socket_pool.h"
18 #include "net/socket/client_socket_factory.h"
19 #include "net/socket/client_socket_handle.h"
20 #include "net/socket/socks_client_socket_pool.h"
21 #include "net/socket/ssl_client_socket.h"
22 #include "net/socket/transport_client_socket_pool.h"
23 #include "net/ssl/ssl_cert_request_info.h"
24 #include "net/ssl/ssl_connection_status_flags.h"
25 #include "net/ssl/ssl_info.h"
26
27 namespace net {
28
SSLSocketParams(const scoped_refptr<TransportSocketParams> & direct_params,const scoped_refptr<SOCKSSocketParams> & socks_proxy_params,const scoped_refptr<HttpProxySocketParams> & http_proxy_params,const HostPortPair & host_and_port,const SSLConfig & ssl_config,PrivacyMode privacy_mode,int load_flags,bool force_spdy_over_ssl,bool want_spdy_over_npn)29 SSLSocketParams::SSLSocketParams(
30 const scoped_refptr<TransportSocketParams>& direct_params,
31 const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
32 const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
33 const HostPortPair& host_and_port,
34 const SSLConfig& ssl_config,
35 PrivacyMode privacy_mode,
36 int load_flags,
37 bool force_spdy_over_ssl,
38 bool want_spdy_over_npn)
39 : direct_params_(direct_params),
40 socks_proxy_params_(socks_proxy_params),
41 http_proxy_params_(http_proxy_params),
42 host_and_port_(host_and_port),
43 ssl_config_(ssl_config),
44 privacy_mode_(privacy_mode),
45 load_flags_(load_flags),
46 force_spdy_over_ssl_(force_spdy_over_ssl),
47 want_spdy_over_npn_(want_spdy_over_npn),
48 ignore_limits_(false) {
49 if (direct_params_.get()) {
50 DCHECK(!socks_proxy_params_.get());
51 DCHECK(!http_proxy_params_.get());
52 ignore_limits_ = direct_params_->ignore_limits();
53 } else if (socks_proxy_params_.get()) {
54 DCHECK(!http_proxy_params_.get());
55 ignore_limits_ = socks_proxy_params_->ignore_limits();
56 } else {
57 DCHECK(http_proxy_params_.get());
58 ignore_limits_ = http_proxy_params_->ignore_limits();
59 }
60 }
61
~SSLSocketParams()62 SSLSocketParams::~SSLSocketParams() {}
63
GetConnectionType() const64 SSLSocketParams::ConnectionType SSLSocketParams::GetConnectionType() const {
65 if (direct_params_.get()) {
66 DCHECK(!socks_proxy_params_.get());
67 DCHECK(!http_proxy_params_.get());
68 return DIRECT;
69 }
70
71 if (socks_proxy_params_.get()) {
72 DCHECK(!http_proxy_params_.get());
73 return SOCKS_PROXY;
74 }
75
76 DCHECK(http_proxy_params_.get());
77 return HTTP_PROXY;
78 }
79
80 const scoped_refptr<TransportSocketParams>&
GetDirectConnectionParams() const81 SSLSocketParams::GetDirectConnectionParams() const {
82 DCHECK_EQ(GetConnectionType(), DIRECT);
83 return direct_params_;
84 }
85
86 const scoped_refptr<SOCKSSocketParams>&
GetSocksProxyConnectionParams() const87 SSLSocketParams::GetSocksProxyConnectionParams() const {
88 DCHECK_EQ(GetConnectionType(), SOCKS_PROXY);
89 return socks_proxy_params_;
90 }
91
92 const scoped_refptr<HttpProxySocketParams>&
GetHttpProxyConnectionParams() const93 SSLSocketParams::GetHttpProxyConnectionParams() const {
94 DCHECK_EQ(GetConnectionType(), HTTP_PROXY);
95 return http_proxy_params_;
96 }
97
SocketAndCallback(SSLClientSocket * ssl_socket,const base::Closure & job_resumption_callback)98 SSLConnectJobMessenger::SocketAndCallback::SocketAndCallback(
99 SSLClientSocket* ssl_socket,
100 const base::Closure& job_resumption_callback)
101 : socket(ssl_socket), callback(job_resumption_callback) {
102 }
103
~SocketAndCallback()104 SSLConnectJobMessenger::SocketAndCallback::~SocketAndCallback() {
105 }
106
SSLConnectJobMessenger(const base::Closure & messenger_finished_callback)107 SSLConnectJobMessenger::SSLConnectJobMessenger(
108 const base::Closure& messenger_finished_callback)
109 : messenger_finished_callback_(messenger_finished_callback),
110 weak_factory_(this) {
111 }
112
~SSLConnectJobMessenger()113 SSLConnectJobMessenger::~SSLConnectJobMessenger() {
114 }
115
RemovePendingSocket(SSLClientSocket * ssl_socket)116 void SSLConnectJobMessenger::RemovePendingSocket(SSLClientSocket* ssl_socket) {
117 // Sockets do not need to be removed from connecting_sockets_ because
118 // OnSSLHandshakeCompleted will do this.
119 for (SSLPendingSocketsAndCallbacks::iterator it =
120 pending_sockets_and_callbacks_.begin();
121 it != pending_sockets_and_callbacks_.end();
122 ++it) {
123 if (it->socket == ssl_socket) {
124 pending_sockets_and_callbacks_.erase(it);
125 return;
126 }
127 }
128 }
129
CanProceed(SSLClientSocket * ssl_socket)130 bool SSLConnectJobMessenger::CanProceed(SSLClientSocket* ssl_socket) {
131 // If there are no connecting sockets, allow the connection to proceed.
132 return connecting_sockets_.empty();
133 }
134
MonitorConnectionResult(SSLClientSocket * ssl_socket)135 void SSLConnectJobMessenger::MonitorConnectionResult(
136 SSLClientSocket* ssl_socket) {
137 connecting_sockets_.push_back(ssl_socket);
138 ssl_socket->SetHandshakeCompletionCallback(
139 base::Bind(&SSLConnectJobMessenger::OnSSLHandshakeCompleted,
140 weak_factory_.GetWeakPtr()));
141 }
142
AddPendingSocket(SSLClientSocket * ssl_socket,const base::Closure & callback)143 void SSLConnectJobMessenger::AddPendingSocket(SSLClientSocket* ssl_socket,
144 const base::Closure& callback) {
145 DCHECK(!connecting_sockets_.empty());
146 pending_sockets_and_callbacks_.push_back(
147 SocketAndCallback(ssl_socket, callback));
148 }
149
OnSSLHandshakeCompleted()150 void SSLConnectJobMessenger::OnSSLHandshakeCompleted() {
151 connecting_sockets_.clear();
152 SSLPendingSocketsAndCallbacks temp_list;
153 temp_list.swap(pending_sockets_and_callbacks_);
154 base::Closure messenger_finished_callback = messenger_finished_callback_;
155 messenger_finished_callback.Run();
156 RunAllCallbacks(temp_list);
157 }
158
RunAllCallbacks(const SSLPendingSocketsAndCallbacks & pending_sockets_and_callbacks)159 void SSLConnectJobMessenger::RunAllCallbacks(
160 const SSLPendingSocketsAndCallbacks& pending_sockets_and_callbacks) {
161 for (std::vector<SocketAndCallback>::const_iterator it =
162 pending_sockets_and_callbacks.begin();
163 it != pending_sockets_and_callbacks.end();
164 ++it) {
165 it->callback.Run();
166 }
167 }
168
169 // Timeout for the SSL handshake portion of the connect.
170 static const int kSSLHandshakeTimeoutInSeconds = 30;
171
SSLConnectJob(const std::string & group_name,RequestPriority priority,const scoped_refptr<SSLSocketParams> & params,const base::TimeDelta & timeout_duration,TransportClientSocketPool * transport_pool,SOCKSClientSocketPool * socks_pool,HttpProxyClientSocketPool * http_proxy_pool,ClientSocketFactory * client_socket_factory,HostResolver * host_resolver,const SSLClientSocketContext & context,const GetMessengerCallback & get_messenger_callback,Delegate * delegate,NetLog * net_log)172 SSLConnectJob::SSLConnectJob(const std::string& group_name,
173 RequestPriority priority,
174 const scoped_refptr<SSLSocketParams>& params,
175 const base::TimeDelta& timeout_duration,
176 TransportClientSocketPool* transport_pool,
177 SOCKSClientSocketPool* socks_pool,
178 HttpProxyClientSocketPool* http_proxy_pool,
179 ClientSocketFactory* client_socket_factory,
180 HostResolver* host_resolver,
181 const SSLClientSocketContext& context,
182 const GetMessengerCallback& get_messenger_callback,
183 Delegate* delegate,
184 NetLog* net_log)
185 : ConnectJob(group_name,
186 timeout_duration,
187 priority,
188 delegate,
189 BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
190 params_(params),
191 transport_pool_(transport_pool),
192 socks_pool_(socks_pool),
193 http_proxy_pool_(http_proxy_pool),
194 client_socket_factory_(client_socket_factory),
195 host_resolver_(host_resolver),
196 context_(context.cert_verifier,
197 context.channel_id_service,
198 context.transport_security_state,
199 context.cert_transparency_verifier,
200 (params->privacy_mode() == PRIVACY_MODE_ENABLED
201 ? "pm/" + context.ssl_session_cache_shard
202 : context.ssl_session_cache_shard)),
203 io_callback_(
204 base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
205 messenger_(NULL),
206 get_messenger_callback_(get_messenger_callback),
207 weak_factory_(this) {
208 }
209
~SSLConnectJob()210 SSLConnectJob::~SSLConnectJob() {
211 if (ssl_socket_.get() && messenger_)
212 messenger_->RemovePendingSocket(ssl_socket_.get());
213 }
214
GetLoadState() const215 LoadState SSLConnectJob::GetLoadState() const {
216 switch (next_state_) {
217 case STATE_TUNNEL_CONNECT_COMPLETE:
218 if (transport_socket_handle_->socket())
219 return LOAD_STATE_ESTABLISHING_PROXY_TUNNEL;
220 // else, fall through.
221 case STATE_TRANSPORT_CONNECT:
222 case STATE_TRANSPORT_CONNECT_COMPLETE:
223 case STATE_SOCKS_CONNECT:
224 case STATE_SOCKS_CONNECT_COMPLETE:
225 case STATE_TUNNEL_CONNECT:
226 return transport_socket_handle_->GetLoadState();
227 case STATE_CREATE_SSL_SOCKET:
228 case STATE_CHECK_FOR_RESUME:
229 case STATE_SSL_CONNECT:
230 case STATE_SSL_CONNECT_COMPLETE:
231 return LOAD_STATE_SSL_HANDSHAKE;
232 default:
233 NOTREACHED();
234 return LOAD_STATE_IDLE;
235 }
236 }
237
GetAdditionalErrorState(ClientSocketHandle * handle)238 void SSLConnectJob::GetAdditionalErrorState(ClientSocketHandle* handle) {
239 // Headers in |error_response_info_| indicate a proxy tunnel setup
240 // problem. See DoTunnelConnectComplete.
241 if (error_response_info_.headers.get()) {
242 handle->set_pending_http_proxy_connection(
243 transport_socket_handle_.release());
244 }
245 handle->set_ssl_error_response_info(error_response_info_);
246 if (!connect_timing_.ssl_start.is_null())
247 handle->set_is_ssl_error(true);
248 }
249
OnIOComplete(int result)250 void SSLConnectJob::OnIOComplete(int result) {
251 int rv = DoLoop(result);
252 if (rv != ERR_IO_PENDING)
253 NotifyDelegateOfCompletion(rv); // Deletes |this|.
254 }
255
DoLoop(int result)256 int SSLConnectJob::DoLoop(int result) {
257 DCHECK_NE(next_state_, STATE_NONE);
258
259 int rv = result;
260 do {
261 State state = next_state_;
262 next_state_ = STATE_NONE;
263 switch (state) {
264 case STATE_TRANSPORT_CONNECT:
265 DCHECK_EQ(OK, rv);
266 rv = DoTransportConnect();
267 break;
268 case STATE_TRANSPORT_CONNECT_COMPLETE:
269 rv = DoTransportConnectComplete(rv);
270 break;
271 case STATE_SOCKS_CONNECT:
272 DCHECK_EQ(OK, rv);
273 rv = DoSOCKSConnect();
274 break;
275 case STATE_SOCKS_CONNECT_COMPLETE:
276 rv = DoSOCKSConnectComplete(rv);
277 break;
278 case STATE_TUNNEL_CONNECT:
279 DCHECK_EQ(OK, rv);
280 rv = DoTunnelConnect();
281 break;
282 case STATE_TUNNEL_CONNECT_COMPLETE:
283 rv = DoTunnelConnectComplete(rv);
284 break;
285 case STATE_CREATE_SSL_SOCKET:
286 rv = DoCreateSSLSocket();
287 break;
288 case STATE_CHECK_FOR_RESUME:
289 rv = DoCheckForResume();
290 break;
291 case STATE_SSL_CONNECT:
292 DCHECK_EQ(OK, rv);
293 rv = DoSSLConnect();
294 break;
295 case STATE_SSL_CONNECT_COMPLETE:
296 rv = DoSSLConnectComplete(rv);
297 break;
298 default:
299 NOTREACHED() << "bad state";
300 rv = ERR_FAILED;
301 break;
302 }
303 } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
304
305 return rv;
306 }
307
DoTransportConnect()308 int SSLConnectJob::DoTransportConnect() {
309 DCHECK(transport_pool_);
310
311 next_state_ = STATE_TRANSPORT_CONNECT_COMPLETE;
312 transport_socket_handle_.reset(new ClientSocketHandle());
313 scoped_refptr<TransportSocketParams> direct_params =
314 params_->GetDirectConnectionParams();
315 return transport_socket_handle_->Init(group_name(),
316 direct_params,
317 priority(),
318 io_callback_,
319 transport_pool_,
320 net_log());
321 }
322
DoTransportConnectComplete(int result)323 int SSLConnectJob::DoTransportConnectComplete(int result) {
324 if (result == OK)
325 next_state_ = STATE_CREATE_SSL_SOCKET;
326
327 return result;
328 }
329
DoSOCKSConnect()330 int SSLConnectJob::DoSOCKSConnect() {
331 DCHECK(socks_pool_);
332 next_state_ = STATE_SOCKS_CONNECT_COMPLETE;
333 transport_socket_handle_.reset(new ClientSocketHandle());
334 scoped_refptr<SOCKSSocketParams> socks_proxy_params =
335 params_->GetSocksProxyConnectionParams();
336 return transport_socket_handle_->Init(group_name(),
337 socks_proxy_params,
338 priority(),
339 io_callback_,
340 socks_pool_,
341 net_log());
342 }
343
DoSOCKSConnectComplete(int result)344 int SSLConnectJob::DoSOCKSConnectComplete(int result) {
345 if (result == OK)
346 next_state_ = STATE_CREATE_SSL_SOCKET;
347
348 return result;
349 }
350
DoTunnelConnect()351 int SSLConnectJob::DoTunnelConnect() {
352 DCHECK(http_proxy_pool_);
353 next_state_ = STATE_TUNNEL_CONNECT_COMPLETE;
354
355 transport_socket_handle_.reset(new ClientSocketHandle());
356 scoped_refptr<HttpProxySocketParams> http_proxy_params =
357 params_->GetHttpProxyConnectionParams();
358 return transport_socket_handle_->Init(group_name(),
359 http_proxy_params,
360 priority(),
361 io_callback_,
362 http_proxy_pool_,
363 net_log());
364 }
365
DoTunnelConnectComplete(int result)366 int SSLConnectJob::DoTunnelConnectComplete(int result) {
367 // Extract the information needed to prompt for appropriate proxy
368 // authentication so that when ClientSocketPoolBaseHelper calls
369 // |GetAdditionalErrorState|, we can easily set the state.
370 if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
371 error_response_info_ = transport_socket_handle_->ssl_error_response_info();
372 } else if (result == ERR_PROXY_AUTH_REQUESTED ||
373 result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
374 StreamSocket* socket = transport_socket_handle_->socket();
375 HttpProxyClientSocket* tunnel_socket =
376 static_cast<HttpProxyClientSocket*>(socket);
377 error_response_info_ = *tunnel_socket->GetConnectResponseInfo();
378 }
379 if (result < 0)
380 return result;
381 next_state_ = STATE_CREATE_SSL_SOCKET;
382 return result;
383 }
384
DoCreateSSLSocket()385 int SSLConnectJob::DoCreateSSLSocket() {
386 next_state_ = STATE_CHECK_FOR_RESUME;
387
388 // Reset the timeout to just the time allowed for the SSL handshake.
389 ResetTimer(base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds));
390
391 // If the handle has a fresh socket, get its connect start and DNS times.
392 // This should always be the case.
393 const LoadTimingInfo::ConnectTiming& socket_connect_timing =
394 transport_socket_handle_->connect_timing();
395 if (!transport_socket_handle_->is_reused() &&
396 !socket_connect_timing.connect_start.is_null()) {
397 // Overwriting |connect_start| serves two purposes - it adjusts timing so
398 // |connect_start| doesn't include dns times, and it adjusts the time so
399 // as not to include time spent waiting for an idle socket.
400 connect_timing_.connect_start = socket_connect_timing.connect_start;
401 connect_timing_.dns_start = socket_connect_timing.dns_start;
402 connect_timing_.dns_end = socket_connect_timing.dns_end;
403 }
404
405 ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
406 transport_socket_handle_.Pass(),
407 params_->host_and_port(),
408 params_->ssl_config(),
409 context_);
410
411 if (!ssl_socket_->InSessionCache())
412 messenger_ = get_messenger_callback_.Run(ssl_socket_->GetSessionCacheKey());
413
414 return OK;
415 }
416
DoCheckForResume()417 int SSLConnectJob::DoCheckForResume() {
418 next_state_ = STATE_SSL_CONNECT;
419
420 if (!messenger_)
421 return OK;
422
423 if (messenger_->CanProceed(ssl_socket_.get())) {
424 messenger_->MonitorConnectionResult(ssl_socket_.get());
425 // The SSLConnectJob no longer needs access to the messenger after this
426 // point.
427 messenger_ = NULL;
428 return OK;
429 }
430
431 messenger_->AddPendingSocket(ssl_socket_.get(),
432 base::Bind(&SSLConnectJob::ResumeSSLConnection,
433 weak_factory_.GetWeakPtr()));
434
435 return ERR_IO_PENDING;
436 }
437
DoSSLConnect()438 int SSLConnectJob::DoSSLConnect() {
439 next_state_ = STATE_SSL_CONNECT_COMPLETE;
440
441 connect_timing_.ssl_start = base::TimeTicks::Now();
442
443 return ssl_socket_->Connect(io_callback_);
444 }
445
DoSSLConnectComplete(int result)446 int SSLConnectJob::DoSSLConnectComplete(int result) {
447 connect_timing_.ssl_end = base::TimeTicks::Now();
448
449 SSLClientSocket::NextProtoStatus status =
450 SSLClientSocket::kNextProtoUnsupported;
451 std::string proto;
452 // GetNextProto will fail and and trigger a NOTREACHED if we pass in a socket
453 // that hasn't had SSL_ImportFD called on it. If we get a certificate error
454 // here, then we know that we called SSL_ImportFD.
455 if (result == OK || IsCertificateError(result))
456 status = ssl_socket_->GetNextProto(&proto);
457
458 // If we want spdy over npn, make sure it succeeded.
459 if (status == SSLClientSocket::kNextProtoNegotiated) {
460 ssl_socket_->set_was_npn_negotiated(true);
461 NextProto protocol_negotiated =
462 SSLClientSocket::NextProtoFromString(proto);
463 ssl_socket_->set_protocol_negotiated(protocol_negotiated);
464 // If we negotiated a SPDY version, it must have been present in
465 // SSLConfig::next_protos.
466 // TODO(mbelshe): Verify this.
467 if (protocol_negotiated >= kProtoSPDYMinimumVersion &&
468 protocol_negotiated <= kProtoSPDYMaximumVersion) {
469 ssl_socket_->set_was_spdy_negotiated(true);
470 }
471 }
472 if (params_->want_spdy_over_npn() && !ssl_socket_->was_spdy_negotiated())
473 return ERR_NPN_NEGOTIATION_FAILED;
474
475 // Spdy might be turned on by default, or it might be over npn.
476 bool using_spdy = params_->force_spdy_over_ssl() ||
477 params_->want_spdy_over_npn();
478
479 if (result == OK ||
480 ssl_socket_->IgnoreCertError(result, params_->load_flags())) {
481 DCHECK(!connect_timing_.ssl_start.is_null());
482 base::TimeDelta connect_duration =
483 connect_timing_.ssl_end - connect_timing_.ssl_start;
484 if (using_spdy) {
485 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SpdyConnectionLatency_2",
486 connect_duration,
487 base::TimeDelta::FromMilliseconds(1),
488 base::TimeDelta::FromMinutes(1),
489 100);
490 }
491
492 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_2",
493 connect_duration,
494 base::TimeDelta::FromMilliseconds(1),
495 base::TimeDelta::FromMinutes(1),
496 100);
497
498 SSLInfo ssl_info;
499 ssl_socket_->GetSSLInfo(&ssl_info);
500
501 UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite",
502 SSLConnectionStatusToCipherSuite(
503 ssl_info.connection_status));
504
505 UMA_HISTOGRAM_BOOLEAN(
506 "Net.RenegotiationExtensionSupported",
507 (ssl_info.connection_status &
508 SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) == 0);
509
510 if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
511 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Resume_Handshake",
512 connect_duration,
513 base::TimeDelta::FromMilliseconds(1),
514 base::TimeDelta::FromMinutes(1),
515 100);
516 } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
517 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Full_Handshake",
518 connect_duration,
519 base::TimeDelta::FromMilliseconds(1),
520 base::TimeDelta::FromMinutes(1),
521 100);
522 }
523
524 const std::string& host = params_->host_and_port().host();
525 bool is_google =
526 host == "google.com" ||
527 (host.size() > 11 && host.rfind(".google.com") == host.size() - 11);
528 if (is_google) {
529 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google2",
530 connect_duration,
531 base::TimeDelta::FromMilliseconds(1),
532 base::TimeDelta::FromMinutes(1),
533 100);
534 if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
535 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
536 "Resume_Handshake",
537 connect_duration,
538 base::TimeDelta::FromMilliseconds(1),
539 base::TimeDelta::FromMinutes(1),
540 100);
541 } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
542 UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
543 "Full_Handshake",
544 connect_duration,
545 base::TimeDelta::FromMilliseconds(1),
546 base::TimeDelta::FromMinutes(1),
547 100);
548 }
549 }
550 }
551
552 if (result == OK || IsCertificateError(result)) {
553 SetSocket(ssl_socket_.PassAs<StreamSocket>());
554 } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
555 error_response_info_.cert_request_info = new SSLCertRequestInfo;
556 ssl_socket_->GetSSLCertRequestInfo(
557 error_response_info_.cert_request_info.get());
558 }
559
560 return result;
561 }
562
ResumeSSLConnection()563 void SSLConnectJob::ResumeSSLConnection() {
564 DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
565 messenger_ = NULL;
566 OnIOComplete(OK);
567 }
568
GetInitialState(SSLSocketParams::ConnectionType connection_type)569 SSLConnectJob::State SSLConnectJob::GetInitialState(
570 SSLSocketParams::ConnectionType connection_type) {
571 switch (connection_type) {
572 case SSLSocketParams::DIRECT:
573 return STATE_TRANSPORT_CONNECT;
574 case SSLSocketParams::HTTP_PROXY:
575 return STATE_TUNNEL_CONNECT;
576 case SSLSocketParams::SOCKS_PROXY:
577 return STATE_SOCKS_CONNECT;
578 }
579 NOTREACHED();
580 return STATE_NONE;
581 }
582
ConnectInternal()583 int SSLConnectJob::ConnectInternal() {
584 next_state_ = GetInitialState(params_->GetConnectionType());
585 return DoLoop(OK);
586 }
587
SSLConnectJobFactory(TransportClientSocketPool * transport_pool,SOCKSClientSocketPool * socks_pool,HttpProxyClientSocketPool * http_proxy_pool,ClientSocketFactory * client_socket_factory,HostResolver * host_resolver,const SSLClientSocketContext & context,const SSLConnectJob::GetMessengerCallback & get_messenger_callback,NetLog * net_log)588 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
589 TransportClientSocketPool* transport_pool,
590 SOCKSClientSocketPool* socks_pool,
591 HttpProxyClientSocketPool* http_proxy_pool,
592 ClientSocketFactory* client_socket_factory,
593 HostResolver* host_resolver,
594 const SSLClientSocketContext& context,
595 const SSLConnectJob::GetMessengerCallback& get_messenger_callback,
596 NetLog* net_log)
597 : transport_pool_(transport_pool),
598 socks_pool_(socks_pool),
599 http_proxy_pool_(http_proxy_pool),
600 client_socket_factory_(client_socket_factory),
601 host_resolver_(host_resolver),
602 context_(context),
603 get_messenger_callback_(get_messenger_callback),
604 net_log_(net_log) {
605 base::TimeDelta max_transport_timeout = base::TimeDelta();
606 base::TimeDelta pool_timeout;
607 if (transport_pool_)
608 max_transport_timeout = transport_pool_->ConnectionTimeout();
609 if (socks_pool_) {
610 pool_timeout = socks_pool_->ConnectionTimeout();
611 if (pool_timeout > max_transport_timeout)
612 max_transport_timeout = pool_timeout;
613 }
614 if (http_proxy_pool_) {
615 pool_timeout = http_proxy_pool_->ConnectionTimeout();
616 if (pool_timeout > max_transport_timeout)
617 max_transport_timeout = pool_timeout;
618 }
619 timeout_ = max_transport_timeout +
620 base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds);
621 }
622
~SSLConnectJobFactory()623 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
624 }
625
SSLClientSocketPool(int max_sockets,int max_sockets_per_group,ClientSocketPoolHistograms * histograms,HostResolver * host_resolver,CertVerifier * cert_verifier,ChannelIDService * channel_id_service,TransportSecurityState * transport_security_state,CTVerifier * cert_transparency_verifier,const std::string & ssl_session_cache_shard,ClientSocketFactory * client_socket_factory,TransportClientSocketPool * transport_pool,SOCKSClientSocketPool * socks_pool,HttpProxyClientSocketPool * http_proxy_pool,SSLConfigService * ssl_config_service,bool enable_ssl_connect_job_waiting,NetLog * net_log)626 SSLClientSocketPool::SSLClientSocketPool(
627 int max_sockets,
628 int max_sockets_per_group,
629 ClientSocketPoolHistograms* histograms,
630 HostResolver* host_resolver,
631 CertVerifier* cert_verifier,
632 ChannelIDService* channel_id_service,
633 TransportSecurityState* transport_security_state,
634 CTVerifier* cert_transparency_verifier,
635 const std::string& ssl_session_cache_shard,
636 ClientSocketFactory* client_socket_factory,
637 TransportClientSocketPool* transport_pool,
638 SOCKSClientSocketPool* socks_pool,
639 HttpProxyClientSocketPool* http_proxy_pool,
640 SSLConfigService* ssl_config_service,
641 bool enable_ssl_connect_job_waiting,
642 NetLog* net_log)
643 : transport_pool_(transport_pool),
644 socks_pool_(socks_pool),
645 http_proxy_pool_(http_proxy_pool),
646 base_(this,
647 max_sockets,
648 max_sockets_per_group,
649 histograms,
650 ClientSocketPool::unused_idle_socket_timeout(),
651 ClientSocketPool::used_idle_socket_timeout(),
652 new SSLConnectJobFactory(
653 transport_pool,
654 socks_pool,
655 http_proxy_pool,
656 client_socket_factory,
657 host_resolver,
658 SSLClientSocketContext(cert_verifier,
659 channel_id_service,
660 transport_security_state,
661 cert_transparency_verifier,
662 ssl_session_cache_shard),
663 base::Bind(
664 &SSLClientSocketPool::GetOrCreateSSLConnectJobMessenger,
665 base::Unretained(this)),
666 net_log)),
667 ssl_config_service_(ssl_config_service),
668 enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting) {
669 if (ssl_config_service_.get())
670 ssl_config_service_->AddObserver(this);
671 if (transport_pool_)
672 base_.AddLowerLayeredPool(transport_pool_);
673 if (socks_pool_)
674 base_.AddLowerLayeredPool(socks_pool_);
675 if (http_proxy_pool_)
676 base_.AddLowerLayeredPool(http_proxy_pool_);
677 }
678
~SSLClientSocketPool()679 SSLClientSocketPool::~SSLClientSocketPool() {
680 STLDeleteContainerPairSecondPointers(messenger_map_.begin(),
681 messenger_map_.end());
682 if (ssl_config_service_.get())
683 ssl_config_service_->RemoveObserver(this);
684 }
685
NewConnectJob(const std::string & group_name,const PoolBase::Request & request,ConnectJob::Delegate * delegate) const686 scoped_ptr<ConnectJob> SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
687 const std::string& group_name,
688 const PoolBase::Request& request,
689 ConnectJob::Delegate* delegate) const {
690 return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
691 request.priority(),
692 request.params(),
693 ConnectionTimeout(),
694 transport_pool_,
695 socks_pool_,
696 http_proxy_pool_,
697 client_socket_factory_,
698 host_resolver_,
699 context_,
700 get_messenger_callback_,
701 delegate,
702 net_log_));
703 }
704
ConnectionTimeout() const705 base::TimeDelta SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout()
706 const {
707 return timeout_;
708 }
709
RequestSocket(const std::string & group_name,const void * socket_params,RequestPriority priority,ClientSocketHandle * handle,const CompletionCallback & callback,const BoundNetLog & net_log)710 int SSLClientSocketPool::RequestSocket(const std::string& group_name,
711 const void* socket_params,
712 RequestPriority priority,
713 ClientSocketHandle* handle,
714 const CompletionCallback& callback,
715 const BoundNetLog& net_log) {
716 const scoped_refptr<SSLSocketParams>* casted_socket_params =
717 static_cast<const scoped_refptr<SSLSocketParams>*>(socket_params);
718
719 return base_.RequestSocket(group_name, *casted_socket_params, priority,
720 handle, callback, net_log);
721 }
722
RequestSockets(const std::string & group_name,const void * params,int num_sockets,const BoundNetLog & net_log)723 void SSLClientSocketPool::RequestSockets(
724 const std::string& group_name,
725 const void* params,
726 int num_sockets,
727 const BoundNetLog& net_log) {
728 const scoped_refptr<SSLSocketParams>* casted_params =
729 static_cast<const scoped_refptr<SSLSocketParams>*>(params);
730
731 base_.RequestSockets(group_name, *casted_params, num_sockets, net_log);
732 }
733
CancelRequest(const std::string & group_name,ClientSocketHandle * handle)734 void SSLClientSocketPool::CancelRequest(const std::string& group_name,
735 ClientSocketHandle* handle) {
736 base_.CancelRequest(group_name, handle);
737 }
738
ReleaseSocket(const std::string & group_name,scoped_ptr<StreamSocket> socket,int id)739 void SSLClientSocketPool::ReleaseSocket(const std::string& group_name,
740 scoped_ptr<StreamSocket> socket,
741 int id) {
742 base_.ReleaseSocket(group_name, socket.Pass(), id);
743 }
744
FlushWithError(int error)745 void SSLClientSocketPool::FlushWithError(int error) {
746 base_.FlushWithError(error);
747 }
748
CloseIdleSockets()749 void SSLClientSocketPool::CloseIdleSockets() {
750 base_.CloseIdleSockets();
751 }
752
IdleSocketCount() const753 int SSLClientSocketPool::IdleSocketCount() const {
754 return base_.idle_socket_count();
755 }
756
IdleSocketCountInGroup(const std::string & group_name) const757 int SSLClientSocketPool::IdleSocketCountInGroup(
758 const std::string& group_name) const {
759 return base_.IdleSocketCountInGroup(group_name);
760 }
761
GetLoadState(const std::string & group_name,const ClientSocketHandle * handle) const762 LoadState SSLClientSocketPool::GetLoadState(
763 const std::string& group_name, const ClientSocketHandle* handle) const {
764 return base_.GetLoadState(group_name, handle);
765 }
766
GetInfoAsValue(const std::string & name,const std::string & type,bool include_nested_pools) const767 base::DictionaryValue* SSLClientSocketPool::GetInfoAsValue(
768 const std::string& name,
769 const std::string& type,
770 bool include_nested_pools) const {
771 base::DictionaryValue* dict = base_.GetInfoAsValue(name, type);
772 if (include_nested_pools) {
773 base::ListValue* list = new base::ListValue();
774 if (transport_pool_) {
775 list->Append(transport_pool_->GetInfoAsValue("transport_socket_pool",
776 "transport_socket_pool",
777 false));
778 }
779 if (socks_pool_) {
780 list->Append(socks_pool_->GetInfoAsValue("socks_pool",
781 "socks_pool",
782 true));
783 }
784 if (http_proxy_pool_) {
785 list->Append(http_proxy_pool_->GetInfoAsValue("http_proxy_pool",
786 "http_proxy_pool",
787 true));
788 }
789 dict->Set("nested_pools", list);
790 }
791 return dict;
792 }
793
ConnectionTimeout() const794 base::TimeDelta SSLClientSocketPool::ConnectionTimeout() const {
795 return base_.ConnectionTimeout();
796 }
797
histograms() const798 ClientSocketPoolHistograms* SSLClientSocketPool::histograms() const {
799 return base_.histograms();
800 }
801
IsStalled() const802 bool SSLClientSocketPool::IsStalled() const {
803 return base_.IsStalled();
804 }
805
AddHigherLayeredPool(HigherLayeredPool * higher_pool)806 void SSLClientSocketPool::AddHigherLayeredPool(HigherLayeredPool* higher_pool) {
807 base_.AddHigherLayeredPool(higher_pool);
808 }
809
RemoveHigherLayeredPool(HigherLayeredPool * higher_pool)810 void SSLClientSocketPool::RemoveHigherLayeredPool(
811 HigherLayeredPool* higher_pool) {
812 base_.RemoveHigherLayeredPool(higher_pool);
813 }
814
CloseOneIdleConnection()815 bool SSLClientSocketPool::CloseOneIdleConnection() {
816 if (base_.CloseOneIdleSocket())
817 return true;
818 return base_.CloseOneIdleConnectionInHigherLayeredPool();
819 }
820
GetOrCreateSSLConnectJobMessenger(const std::string & cache_key)821 SSLConnectJobMessenger* SSLClientSocketPool::GetOrCreateSSLConnectJobMessenger(
822 const std::string& cache_key) {
823 if (!enable_ssl_connect_job_waiting_)
824 return NULL;
825 MessengerMap::const_iterator it = messenger_map_.find(cache_key);
826 if (it == messenger_map_.end()) {
827 std::pair<MessengerMap::iterator, bool> iter =
828 messenger_map_.insert(MessengerMap::value_type(
829 cache_key,
830 new SSLConnectJobMessenger(
831 base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
832 base::Unretained(this),
833 cache_key))));
834 it = iter.first;
835 }
836 return it->second;
837 }
838
DeleteSSLConnectJobMessenger(const std::string & cache_key)839 void SSLClientSocketPool::DeleteSSLConnectJobMessenger(
840 const std::string& cache_key) {
841 MessengerMap::iterator it = messenger_map_.find(cache_key);
842 CHECK(it != messenger_map_.end());
843 delete it->second;
844 messenger_map_.erase(it);
845 }
846
OnSSLConfigChanged()847 void SSLClientSocketPool::OnSSLConfigChanged() {
848 FlushWithError(ERR_NETWORK_CHANGED);
849 }
850
851 } // namespace net
852