The Tor Browser / annotate

security/manager/ssl/src/nsNSSIOLayer.h@b8a032363ba2 (annotated)

security/manager/ssl/src/nsNSSIOLayer.h

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
michael@0 2 *
michael@0 3 * This Source Code Form is subject to the terms of the Mozilla Public
michael@0 4 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 6
michael@0 7 #ifndef _NSNSSIOLAYER_H
michael@0 8 #define _NSNSSIOLAYER_H
michael@0 9
michael@0 10 #include "TransportSecurityInfo.h"
michael@0 11 #include "nsISSLSocketControl.h"
michael@0 12 #include "nsIClientAuthDialogs.h"
michael@0 13 #include "nsIProxyInfo.h"
michael@0 14 #include "nsNSSCertificate.h"
michael@0 15 #include "nsDataHashtable.h"
michael@0 16 #include "nsTHashtable.h"
michael@0 17 #include "mozilla/TimeStamp.h"
michael@0 18 #include "sslt.h"
michael@0 19
michael@0 20 namespace mozilla {
michael@0 21 namespace psm {
michael@0 22 class SharedSSLState;
michael@0 23 }
michael@0 24 }
michael@0 25
michael@0 26 class nsIObserver;
michael@0 27
michael@0 28 class nsNSSSocketInfo : public mozilla::psm::TransportSecurityInfo,
michael@0 29 public nsISSLSocketControl,
michael@0 30 public nsIClientAuthUserDecision
michael@0 31 {
michael@0 32 public:
michael@0 33 nsNSSSocketInfo(mozilla::psm::SharedSSLState& aState, uint32_t providerFlags);
michael@0 34
michael@0 35 NS_DECL_ISUPPORTS_INHERITED
michael@0 36 NS_DECL_NSISSLSOCKETCONTROL
michael@0 37 NS_DECL_NSICLIENTAUTHUSERDECISION
michael@0 38
michael@0 39 void SetForSTARTTLS(bool aForSTARTTLS);
michael@0 40 bool GetForSTARTTLS();
michael@0 41
michael@0 42 nsresult GetFileDescPtr(PRFileDesc** aFilePtr);
michael@0 43 nsresult SetFileDescPtr(PRFileDesc* aFilePtr);
michael@0 44
michael@0 45 bool IsHandshakePending() const { return mHandshakePending; }
michael@0 46 void SetHandshakeNotPending() { mHandshakePending = false; }
michael@0 47
michael@0 48 void GetPreviousCert(nsIX509Cert** _result);
michael@0 49
michael@0 50 void SetTLSVersionRange(SSLVersionRange range) { mTLSVersionRange = range; }
michael@0 51 SSLVersionRange GetTLSVersionRange() const { return mTLSVersionRange; };
michael@0 52
michael@0 53 PRStatus CloseSocketAndDestroy(
michael@0 54 const nsNSSShutDownPreventionLock& proofOfLock);
michael@0 55
michael@0 56 void SetNegotiatedNPN(const char* value, uint32_t length);
michael@0 57
michael@0 58 void SetHandshakeCompleted();
michael@0 59 void NoteTimeUntilReady();
michael@0 60
michael@0 61
michael@0 62 void SetFalseStartCallbackCalled() { mFalseStartCallbackCalled = true; }
michael@0 63 void SetFalseStarted() { mFalseStarted = true; }
michael@0 64
michael@0 65 // Note that this is only valid *during* a handshake; at the end of the handshake,
michael@0 66 // it gets reset back to false.
michael@0 67 void SetFullHandshake() { mIsFullHandshake = true; }
michael@0 68 bool IsFullHandshake() const { return mIsFullHandshake; }
michael@0 69
michael@0 70 bool GetJoined() { return mJoined; }
michael@0 71 void SetSentClientCert() { mSentClientCert = true; }
michael@0 72
michael@0 73 uint32_t GetProviderFlags() const { return mProviderFlags; }
michael@0 74
michael@0 75 mozilla::psm::SharedSSLState& SharedState();
michael@0 76
michael@0 77 // XXX: These are only used on for diagnostic purposes
michael@0 78 enum CertVerificationState {
michael@0 79 before_cert_verification,
michael@0 80 waiting_for_cert_verification,
michael@0 81 after_cert_verification
michael@0 82 };
michael@0 83 void SetCertVerificationWaiting();
michael@0 84 // Use errorCode == 0 to indicate success; in that case, errorMessageType is
michael@0 85 // ignored.
michael@0 86 void SetCertVerificationResult(PRErrorCode errorCode,
michael@0 87 ::mozilla::psm::SSLErrorMessageType errorMessageType);
michael@0 88
michael@0 89 // for logging only
michael@0 90 PRBool IsWaitingForCertVerification() const
michael@0 91 {
michael@0 92 return mCertVerificationState == waiting_for_cert_verification;
michael@0 93 }
michael@0 94 void AddPlaintextBytesRead(uint64_t val) { mPlaintextBytesRead += val; }
michael@0 95
michael@0 96 bool IsPreliminaryHandshakeDone() const { return mPreliminaryHandshakeDone; }
michael@0 97 void SetPreliminaryHandshakeDone() { mPreliminaryHandshakeDone = true; }
michael@0 98
michael@0 99 void SetKEAUsed(uint16_t kea) { mKEAUsed = kea; }
michael@0 100 inline int16_t GetKEAExpected() // infallible in nsISSLSocketControl
michael@0 101 {
michael@0 102 int16_t result;
michael@0 103 mozilla::DebugOnly<nsresult> rv = GetKEAExpected(&result);
michael@0 104 MOZ_ASSERT(NS_SUCCEEDED(rv));
michael@0 105 return result;
michael@0 106 }
michael@0 107
michael@0 108 void SetSSLVersionUsed(int16_t version)
michael@0 109 {
michael@0 110 mSSLVersionUsed = version;
michael@0 111 }
michael@0 112
michael@0 113 private:
michael@0 114 PRFileDesc* mFd;
michael@0 115
michael@0 116 CertVerificationState mCertVerificationState;
michael@0 117
michael@0 118 mozilla::psm::SharedSSLState& mSharedState;
michael@0 119 bool mForSTARTTLS;
michael@0 120 SSLVersionRange mTLSVersionRange;
michael@0 121 bool mHandshakePending;
michael@0 122 bool mRememberClientAuthCertificate;
michael@0 123 bool mPreliminaryHandshakeDone; // after false start items are complete
michael@0 124
michael@0 125 nsresult ActivateSSL();
michael@0 126
michael@0 127 nsCString mNegotiatedNPN;
michael@0 128 bool mNPNCompleted;
michael@0 129 bool mFalseStartCallbackCalled;
michael@0 130 bool mFalseStarted;
michael@0 131 bool mIsFullHandshake;
michael@0 132 bool mHandshakeCompleted;
michael@0 133 bool mJoined;
michael@0 134 bool mSentClientCert;
michael@0 135 bool mNotedTimeUntilReady;
michael@0 136
michael@0 137 // mKEA* are used in false start detetermination
michael@0 138 // Values are from nsISSLSocketControl
michael@0 139 int16_t mKEAUsed;
michael@0 140 int16_t mKEAExpected;
michael@0 141 int16_t mSSLVersionUsed;
michael@0 142
michael@0 143 uint32_t mProviderFlags;
michael@0 144 mozilla::TimeStamp mSocketCreationTimestamp;
michael@0 145 uint64_t mPlaintextBytesRead;
michael@0 146 };
michael@0 147
michael@0 148 class nsSSLIOLayerHelpers
michael@0 149 {
michael@0 150 public:
michael@0 151 nsSSLIOLayerHelpers();
michael@0 152 ~nsSSLIOLayerHelpers();
michael@0 153
michael@0 154 nsresult Init();
michael@0 155 void Cleanup();
michael@0 156
michael@0 157 static bool nsSSLIOLayerInitialized;
michael@0 158 static PRDescIdentity nsSSLIOLayerIdentity;
michael@0 159 static PRDescIdentity nsSSLPlaintextLayerIdentity;
michael@0 160 static PRIOMethods nsSSLIOLayerMethods;
michael@0 161 static PRIOMethods nsSSLPlaintextLayerMethods;
michael@0 162
michael@0 163 nsTHashtable<nsCStringHashKey>* mRenegoUnrestrictedSites;
michael@0 164 bool mTreatUnsafeNegotiationAsBroken;
michael@0 165 int32_t mWarnLevelMissingRFC5746;
michael@0 166
michael@0 167 void setTreatUnsafeNegotiationAsBroken(bool broken);
michael@0 168 bool treatUnsafeNegotiationAsBroken();
michael@0 169 void setWarnLevelMissingRFC5746(int32_t level);
michael@0 170 int32_t getWarnLevelMissingRFC5746();
michael@0 171
michael@0 172 private:
michael@0 173 struct IntoleranceEntry
michael@0 174 {
michael@0 175 uint16_t tolerant;
michael@0 176 uint16_t intolerant;
michael@0 177
michael@0 178 void AssertInvariant() const
michael@0 179 {
michael@0 180 MOZ_ASSERT(intolerant == 0 || tolerant < intolerant);
michael@0 181 }
michael@0 182 };
michael@0 183 nsDataHashtable<nsCStringHashKey, IntoleranceEntry> mTLSIntoleranceInfo;
michael@0 184 public:
michael@0 185 void rememberTolerantAtVersion(const nsACString& hostname, int16_t port,
michael@0 186 uint16_t tolerant);
michael@0 187 bool rememberIntolerantAtVersion(const nsACString& hostname, int16_t port,
michael@0 188 uint16_t intolerant, uint16_t minVersion);
michael@0 189 void adjustForTLSIntolerance(const nsACString& hostname, int16_t port,
michael@0 190 /*in/out*/ SSLVersionRange& range);
michael@0 191
michael@0 192 void setRenegoUnrestrictedSites(const nsCString& str);
michael@0 193 bool isRenegoUnrestrictedSite(const nsCString& str);
michael@0 194 void clearStoredData();
michael@0 195
michael@0 196 bool mFalseStartRequireNPN;
michael@0 197 bool mFalseStartRequireForwardSecrecy;
michael@0 198 private:
michael@0 199 mozilla::Mutex mutex;
michael@0 200 nsCOMPtr<nsIObserver> mPrefObserver;
michael@0 201 };
michael@0 202
michael@0 203 nsresult nsSSLIOLayerNewSocket(int32_t family,
michael@0 204 const char* host,
michael@0 205 int32_t port,
michael@0 206 nsIProxyInfo *proxy,
michael@0 207 PRFileDesc** fd,
michael@0 208 nsISupports** securityInfo,
michael@0 209 bool forSTARTTLS,
michael@0 210 uint32_t flags);
michael@0 211
michael@0 212 nsresult nsSSLIOLayerAddToSocket(int32_t family,
michael@0 213 const char* host,
michael@0 214 int32_t port,
michael@0 215 nsIProxyInfo *proxy,
michael@0 216 PRFileDesc* fd,
michael@0 217 nsISupports** securityInfo,
michael@0 218 bool forSTARTTLS,
michael@0 219 uint32_t flags);
michael@0 220
michael@0 221 nsresult nsSSLIOLayerFreeTLSIntolerantSites();
michael@0 222 nsresult displayUnknownCertErrorAlert(nsNSSSocketInfo* infoObject, int error);
michael@0 223
michael@0 224 #endif /* _NSNSSIOLAYER_H */

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial