15f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Copyright 2014 The Chromium Authors. All rights reserved. 25f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// found in the LICENSE file. 45f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 55f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "extensions/browser/api/socket/tls_socket.h" 65f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 75f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "base/callback_helpers.h" 85f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "base/logging.h" 95f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "extensions/browser/api/api_resource.h" 105f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/base/address_list.h" 115f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/base/ip_endpoint.h" 125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/base/net_errors.h" 135f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/base/rand_callback.h" 145f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/socket/client_socket_factory.h" 155f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/socket/client_socket_handle.h" 165f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/socket/ssl_client_socket.h" 175f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "net/socket/tcp_client_socket.h" 185f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "url/url_canon.h" 195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)namespace { 215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Returns the SSL protocol version (as a uint16) represented by a string. 235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Returns 0 if the string is invalid. 245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)uint16 SSLProtocolVersionFromString(const std::string& version_str) { 255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) uint16 version = 0; // Invalid. 265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (version_str == "ssl3") { 275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version = net::SSL_PROTOCOL_VERSION_SSL3; 285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } else if (version_str == "tls1") { 295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version = net::SSL_PROTOCOL_VERSION_TLS1; 305f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } else if (version_str == "tls1.1") { 315f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version = net::SSL_PROTOCOL_VERSION_TLS1_1; 325f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } else if (version_str == "tls1.2") { 335f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version = net::SSL_PROTOCOL_VERSION_TLS1_2; 345f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 355f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return version; 365f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 375f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 385f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TlsConnectDone(scoped_ptr<net::SSLClientSocket> ssl_socket, 395f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& extension_id, 405f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const extensions::TLSSocket::SecureCallback& callback, 415f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int result) { 425f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Got back result " << result << " " << net::ErrorToString(result); 435f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 445f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // No matter how the TLS connection attempt went, the underlying socket's 455f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // no longer bound to the original TCPSocket. It belongs to |ssl_socket|, 465f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // which is promoted here to a new API-accessible socket (via a TLSSocket 475f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // wrapper), or deleted. 485f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (result != net::OK) { 495f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(scoped_ptr<extensions::TLSSocket>(), result); 505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 515f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) }; 525f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 535f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Wrap the StreamSocket in a TLSSocket, which matches the extension socket 545f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // API. Set the handle of the socket to the new value, so that it can be 555f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // used for read/write/close/etc. 565f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<extensions::TLSSocket> wrapper(new extensions::TLSSocket( 575f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ssl_socket.PassAs<net::StreamSocket>(), extension_id)); 585f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 595f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Caller will end up deleting the prior TCPSocket, once it calls 605f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // SetSocket(..,wrapper). 615f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(wrapper.Pass(), result); 625f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 635f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 645f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} // namespace 655f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 665f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)namespace extensions { 675f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 685f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)const char kTLSSocketTypeInvalidError[] = 695f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) "Cannot listen on a socket that is already connected."; 705f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 715f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)TLSSocket::TLSSocket(scoped_ptr<net::StreamSocket> tls_socket, 725f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& owner_extension_id) 735f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) : ResumableTCPSocket(owner_extension_id), tls_socket_(tls_socket.Pass()) { 745f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 755f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 765f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)TLSSocket::~TLSSocket() { 775f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) Disconnect(); 785f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 795f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::Connect(const std::string& address, 815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int port, 825f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const CompletionCallback& callback) { 835f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(net::ERR_CONNECTION_FAILED); 845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 865f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::Disconnect() { 875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (tls_socket_) { 885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tls_socket_->Disconnect(); 895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tls_socket_.reset(); 905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 915f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 925f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 935f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::Read(int count, const ReadCompletionCallback& callback) { 945f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(!callback.is_null()); 955f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 965f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!read_callback_.is_null()) { 975f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(net::ERR_IO_PENDING, NULL); 985f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 995f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 1005f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1015f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (count <= 0) { 1025f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(net::ERR_INVALID_ARGUMENT, NULL); 1035f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 1045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 1055f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!tls_socket_.get() || !IsConnected()) { 1075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(net::ERR_SOCKET_NOT_CONNECTED, NULL); 1085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 1095f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 1105f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1115f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) read_callback_ = callback; 1125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_refptr<net::IOBuffer> io_buffer(new net::IOBuffer(count)); 1135f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // |tls_socket_| is owned by this class and the callback won't be run once 1145f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // |tls_socket_| is gone (as in an a call to Disconnect()). Therefore, it is 1155f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // safe to use base::Unretained() here. 1165f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int result = tls_socket_->Read( 1175f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) io_buffer.get(), 1185f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) count, 1195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::Bind( 1205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) &TLSSocket::OnReadComplete, base::Unretained(this), io_buffer)); 1215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (result != net::ERR_IO_PENDING) { 1235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) OnReadComplete(io_buffer, result); 1245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 1255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::OnReadComplete(const scoped_refptr<net::IOBuffer>& io_buffer, 1285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int result) { 1295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(!read_callback_.is_null()); 1305f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::ResetAndReturn(&read_callback_).Run(result, io_buffer); 1315f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1325f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1335f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)int TLSSocket::WriteImpl(net::IOBuffer* io_buffer, 1345f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int io_buffer_size, 1355f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const net::CompletionCallback& callback) { 1365f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!IsConnected()) { 1375f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return net::ERR_SOCKET_NOT_CONNECTED; 1385f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 1395f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return tls_socket_->Write(io_buffer, io_buffer_size, callback); 1405f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1415f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1425f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)bool TLSSocket::SetKeepAlive(bool enable, int delay) { 1435f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return false; 1445f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1455f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1465f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)bool TLSSocket::SetNoDelay(bool no_delay) { 1475f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return false; 1485f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1495f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)int TLSSocket::Listen(const std::string& address, 1515f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int port, 1525f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int backlog, 1535f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) std::string* error_msg) { 1545f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) *error_msg = kTLSSocketTypeInvalidError; 1555f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return net::ERR_NOT_IMPLEMENTED; 1565f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1575f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1585f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::Accept(const AcceptCompletionCallback& callback) { 1595f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(net::ERR_FAILED, NULL); 1605f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1615f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1625f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)bool TLSSocket::IsConnected() { 1635f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return tls_socket_.get() && tls_socket_->IsConnected(); 1645f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1655f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1665f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)bool TLSSocket::GetPeerAddress(net::IPEndPoint* address) { 1675f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return IsConnected() && tls_socket_->GetPeerAddress(address); 1685f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1695f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1705f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)bool TLSSocket::GetLocalAddress(net::IPEndPoint* address) { 1715f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return IsConnected() && tls_socket_->GetLocalAddress(address); 1725f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1735f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1745f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)Socket::SocketType TLSSocket::GetSocketType() const { 1755f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return Socket::TYPE_TLS; 1765f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 1775f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1785f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// static 1795f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void TLSSocket::UpgradeSocketToTLS( 1805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) Socket* socket, 1815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_refptr<net::SSLConfigService> ssl_config_service, 1825f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::CertVerifier* cert_verifier, 1835f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::TransportSecurityState* transport_security_state, 1845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& extension_id, 1855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) core_api::socket::SecureOptions* options, 1865f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const TLSSocket::SecureCallback& callback) { 1875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO)); 1885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) TCPSocket* tcp_socket = static_cast<TCPSocket*>(socket); 1895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<net::SSLClientSocket> null_sock; 1905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1915f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!tcp_socket || tcp_socket->GetSocketType() != Socket::TYPE_TCP || 1925f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) !tcp_socket->ClientStream() || !tcp_socket->IsConnected() || 1935f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tcp_socket->HasPendingRead()) { 1945f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Failing before trying. socket is " << tcp_socket; 1955f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (tcp_socket) { 1965f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "type: " << tcp_socket->GetSocketType() 1975f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << ", ClientStream is " << tcp_socket->ClientStream() 1985f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << ", IsConnected: " << tcp_socket->IsConnected() 1995f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << ", HasPendingRead: " << tcp_socket->HasPendingRead(); 2005f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2015f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) TlsConnectDone( 2025f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) null_sock.Pass(), extension_id, callback, net::ERR_INVALID_ARGUMENT); 2035f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 2045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2055f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::IPEndPoint dest_host_port_pair; 2075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!tcp_socket->GetPeerAddress(&dest_host_port_pair)) { 2085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Could not get peer address."; 2095f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) TlsConnectDone( 2105f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) null_sock.Pass(), extension_id, callback, net::ERR_INVALID_ARGUMENT); 2115f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 2125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2135f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2145f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Convert any U-LABELs to A-LABELs. 2155f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) url::CanonHostInfo host_info; 2165f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) std::string canon_host = 2175f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::CanonicalizeHost(tcp_socket->hostname(), &host_info); 2185f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Canonicalization shouldn't fail: the socket is already connected with a 2205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // host, using this hostname. 2215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (host_info.family == url::CanonHostInfo::BROKEN) { 2225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Could not canonicalize hostname"; 2235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) TlsConnectDone( 2245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) null_sock.Pass(), extension_id, callback, net::ERR_INVALID_ARGUMENT); 2255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return; 2265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::HostPortPair host_and_port(canon_host, dest_host_port_pair.port()); 2295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2305f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<net::ClientSocketHandle> socket_handle( 2315f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) new net::ClientSocketHandle()); 2325f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2335f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Set the socket handle to the socket's client stream (that should be the 2345f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // only one active here). Then have the old socket release ownership on 2355f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // that client stream. 2365f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) socket_handle->SetSocket( 2375f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<net::StreamSocket>(tcp_socket->ClientStream())); 2385f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tcp_socket->Release(); 2395f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2405f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(transport_security_state); 2415f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::SSLClientSocketContext context; 2425f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) context.cert_verifier = cert_verifier; 2435f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) context.transport_security_state = transport_security_state; 2445f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2455f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Fill in the SSL socket params. 2465f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::SSLConfig ssl_config; 2475f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ssl_config_service->GetSSLConfig(&ssl_config); 2485f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (options && options->tls_version.get()) { 2495f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) uint16 version_min = 0, version_max = 0; 2505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) core_api::socket::TLSVersionConstraints* versions = 2515f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) options->tls_version.get(); 2525f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (versions->min.get()) { 2535f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version_min = SSLProtocolVersionFromString(*versions->min.get()); 2545f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2555f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (versions->max.get()) { 2565f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) version_max = SSLProtocolVersionFromString(*versions->max.get()); 2575f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2585f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (version_min) { 2595f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ssl_config.version_min = version_min; 2605f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2615f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (version_max) { 2625f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ssl_config.version_max = version_max; 2635f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2645f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 2655f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2665f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::ClientSocketFactory* socket_factory = 2675f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::ClientSocketFactory::GetDefaultFactory(); 2685f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2695f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Create the socket. 2705f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<net::SSLClientSocket> ssl_socket( 2715f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) socket_factory->CreateSSLClientSocket( 2725f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) socket_handle.Pass(), host_and_port, ssl_config, context)); 2735f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2745f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Attempting to secure a connection to " << tcp_socket->hostname() 2755f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << ":" << dest_host_port_pair.port(); 2765f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2775f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // We need the contents of |ssl_socket| in order to invoke its Connect() 2785f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // method. It belongs to |ssl_socket|, and we own that until our internal 2795f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // callback (|connect_cb|, below) is invoked. 2805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) net::SSLClientSocket* saved_ssl_socket = ssl_socket.get(); 2815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2825f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Try establish a TLS connection. Pass ownership of |ssl_socket| to 2835f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // TlsConnectDone, which will pass it on to |callback|. |connect_cb| below 2845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // is only for UpgradeSocketToTLS use, and not be confused with the 2855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // argument |callback|, which gets invoked by TlsConnectDone() after 2865f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Connect() below returns. 2875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::Callback<void(int)> connect_cb(base::Bind( 2885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) &TlsConnectDone, base::Passed(&ssl_socket), extension_id, callback)); 2895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) int status = saved_ssl_socket->Connect(connect_cb); 2905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) saved_ssl_socket = NULL; 2915f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 2925f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Connect completed synchronously, or failed. 2935f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (status != net::ERR_IO_PENDING) { 2945f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Note: this can't recurse -- if |socket| is already a connected 2955f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // TLSSocket, it will return TYPE_TLS instead of TYPE_TCP, causing 2965f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // UpgradeSocketToTLS() to fail with an error above. If 2975f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // UpgradeSocketToTLS() is called on |socket| twice, the call to 2985f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Release() on |socket| above causes the additional call to 2995f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // fail with an error above. 3005f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (status != net::OK) { 3015f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DVLOG(1) << "Status is not OK or IO-pending: " 3025f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << net::ErrorToString(status); 3035f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 3045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) connect_cb.Run(status); 3055f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 3065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 3075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 3085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} // namespace extensions 3095f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 310