1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/socket/nss_ssl_util.h" 6 7 #include <nss.h> 8 #include <secerr.h> 9 #include <ssl.h> 10 #include <sslerr.h> 11 #include <sslproto.h> 12 13 #include <string> 14 15 #include "base/bind.h" 16 #include "base/cpu.h" 17 #include "base/lazy_instance.h" 18 #include "base/logging.h" 19 #include "base/memory/singleton.h" 20 #include "base/threading/thread_restrictions.h" 21 #include "base/values.h" 22 #include "build/build_config.h" 23 #include "crypto/nss_util.h" 24 #include "net/base/net_errors.h" 25 #include "net/base/net_log.h" 26 #include "net/base/nss_memio.h" 27 28 #if defined(OS_WIN) 29 #include "base/win/windows_version.h" 30 #endif 31 32 namespace { 33 34 // CiphersRemove takes a zero-terminated array of cipher suite ids in 35 // |to_remove| and sets every instance of them in |ciphers| to zero. It returns 36 // true if it found and removed every element of |to_remove|. It assumes that 37 // there are no duplicates in |ciphers| nor in |to_remove|. 38 bool CiphersRemove(const uint16* to_remove, uint16* ciphers, size_t num) { 39 size_t i, found = 0; 40 41 for (i = 0; ; i++) { 42 if (to_remove[i] == 0) 43 break; 44 45 for (size_t j = 0; j < num; j++) { 46 if (to_remove[i] == ciphers[j]) { 47 ciphers[j] = 0; 48 found++; 49 break; 50 } 51 } 52 } 53 54 return found == i; 55 } 56 57 // CiphersCompact takes an array of cipher suite ids in |ciphers|, where some 58 // entries are zero, and moves the entries so that all the non-zero elements 59 // are compacted at the end of the array. 60 void CiphersCompact(uint16* ciphers, size_t num) { 61 size_t j = num - 1; 62 63 for (size_t i = num - 1; i < num; i--) { 64 if (ciphers[i] == 0) 65 continue; 66 ciphers[j--] = ciphers[i]; 67 } 68 } 69 70 // CiphersCopy copies the zero-terminated array |in| to |out|. It returns the 71 // number of cipher suite ids copied. 72 size_t CiphersCopy(const uint16* in, uint16* out) { 73 for (size_t i = 0; ; i++) { 74 if (in[i] == 0) 75 return i; 76 out[i] = in[i]; 77 } 78 } 79 80 } // anonymous namespace 81 82 namespace net { 83 84 class NSSSSLInitSingleton { 85 public: 86 NSSSSLInitSingleton() : model_fd_(NULL) { 87 crypto::EnsureNSSInit(); 88 89 NSS_SetDomesticPolicy(); 90 91 const PRUint16* const ssl_ciphers = SSL_GetImplementedCiphers(); 92 const PRUint16 num_ciphers = SSL_GetNumImplementedCiphers(); 93 94 // Disable ECDSA cipher suites on platforms that do not support ECDSA 95 // signed certificates, as servers may use the presence of such 96 // ciphersuites as a hint to send an ECDSA certificate. 97 bool disableECDSA = false; 98 #if defined(OS_WIN) 99 if (base::win::GetVersion() < base::win::VERSION_VISTA) 100 disableECDSA = true; 101 #endif 102 103 // Explicitly enable exactly those ciphers with keys of at least 80 bits 104 for (int i = 0; i < num_ciphers; i++) { 105 SSLCipherSuiteInfo info; 106 if (SSL_GetCipherSuiteInfo(ssl_ciphers[i], &info, 107 sizeof(info)) == SECSuccess) { 108 bool enabled = info.effectiveKeyBits >= 80; 109 if (info.authAlgorithm == ssl_auth_ecdsa && disableECDSA) 110 enabled = false; 111 112 // Trim the list of cipher suites in order to keep the size of the 113 // ClientHello down. DSS, ECDH, CAMELLIA, SEED, ECC+3DES, and 114 // HMAC-SHA256 cipher suites are disabled. 115 if (info.symCipher == ssl_calg_camellia || 116 info.symCipher == ssl_calg_seed || 117 (info.symCipher == ssl_calg_3des && info.keaType != ssl_kea_rsa) || 118 info.authAlgorithm == ssl_auth_dsa || 119 info.macAlgorithm == ssl_hmac_sha256 || 120 info.nonStandard || 121 strcmp(info.keaTypeName, "ECDH") == 0) { 122 enabled = false; 123 } 124 125 if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) { 126 // Enabled to allow servers with only a DSA certificate to function. 127 enabled = true; 128 } 129 SSL_CipherPrefSetDefault(ssl_ciphers[i], enabled); 130 } 131 } 132 133 // Enable SSL. 134 SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE); 135 136 // Calculate the order of ciphers that we'll use for NSS sockets. (Note 137 // that, even if a cipher is specified in the ordering, it must still be 138 // enabled in order to be included in a ClientHello.) 139 // 140 // Our top preference cipher suites are either forward-secret AES-GCM or 141 // forward-secret ChaCha20-Poly1305. If the local machine has AES-NI then 142 // we prefer AES-GCM, otherwise ChaCha20. The remainder of the cipher suite 143 // preference is inheriented from NSS. */ 144 static const uint16 chacha_ciphers[] = { 145 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, 146 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 147 0, 148 }; 149 static const uint16 aes_gcm_ciphers[] = { 150 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 151 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 152 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, 153 0, 154 }; 155 scoped_ptr<uint16[]> ciphers(new uint16[num_ciphers]); 156 memcpy(ciphers.get(), ssl_ciphers, sizeof(uint16)*num_ciphers); 157 158 if (CiphersRemove(chacha_ciphers, ciphers.get(), num_ciphers) && 159 CiphersRemove(aes_gcm_ciphers, ciphers.get(), num_ciphers)) { 160 CiphersCompact(ciphers.get(), num_ciphers); 161 162 const uint16* preference_ciphers = chacha_ciphers; 163 const uint16* other_ciphers = aes_gcm_ciphers; 164 base::CPU cpu; 165 166 if (cpu.has_aesni() && cpu.has_avx()) { 167 preference_ciphers = aes_gcm_ciphers; 168 other_ciphers = chacha_ciphers; 169 } 170 unsigned i = CiphersCopy(preference_ciphers, ciphers.get()); 171 CiphersCopy(other_ciphers, &ciphers[i]); 172 173 if ((model_fd_ = memio_CreateIOLayer(1, 1)) == NULL || 174 SSL_ImportFD(NULL, model_fd_) == NULL || 175 SECSuccess != 176 SSL_CipherOrderSet(model_fd_, ciphers.get(), num_ciphers)) { 177 NOTREACHED(); 178 if (model_fd_) { 179 PR_Close(model_fd_); 180 model_fd_ = NULL; 181 } 182 } 183 } 184 185 // All other SSL options are set per-session by SSLClientSocket and 186 // SSLServerSocket. 187 } 188 189 PRFileDesc* GetModelSocket() { 190 return model_fd_; 191 } 192 193 ~NSSSSLInitSingleton() { 194 // Have to clear the cache, or NSS_Shutdown fails with SEC_ERROR_BUSY. 195 SSL_ClearSessionCache(); 196 if (model_fd_) 197 PR_Close(model_fd_); 198 } 199 200 private: 201 PRFileDesc* model_fd_; 202 }; 203 204 static base::LazyInstance<NSSSSLInitSingleton>::Leaky g_nss_ssl_init_singleton = 205 LAZY_INSTANCE_INITIALIZER; 206 207 // Initialize the NSS SSL library if it isn't already initialized. This must 208 // be called before any other NSS SSL functions. This function is 209 // thread-safe, and the NSS SSL library will only ever be initialized once. 210 // The NSS SSL library will be properly shut down on program exit. 211 void EnsureNSSSSLInit() { 212 // Initializing SSL causes us to do blocking IO. 213 // Temporarily allow it until we fix 214 // http://code.google.com/p/chromium/issues/detail?id=59847 215 base::ThreadRestrictions::ScopedAllowIO allow_io; 216 217 g_nss_ssl_init_singleton.Get(); 218 } 219 220 PRFileDesc* GetNSSModelSocket() { 221 return g_nss_ssl_init_singleton.Get().GetModelSocket(); 222 } 223 224 // Map a Chromium net error code to an NSS error code. 225 // See _MD_unix_map_default_error in the NSS source 226 // tree for inspiration. 227 PRErrorCode MapErrorToNSS(int result) { 228 if (result >=0) 229 return result; 230 231 switch (result) { 232 case ERR_IO_PENDING: 233 return PR_WOULD_BLOCK_ERROR; 234 case ERR_ACCESS_DENIED: 235 case ERR_NETWORK_ACCESS_DENIED: 236 // For connect, this could be mapped to PR_ADDRESS_NOT_SUPPORTED_ERROR. 237 return PR_NO_ACCESS_RIGHTS_ERROR; 238 case ERR_NOT_IMPLEMENTED: 239 return PR_NOT_IMPLEMENTED_ERROR; 240 case ERR_SOCKET_NOT_CONNECTED: 241 return PR_NOT_CONNECTED_ERROR; 242 case ERR_INTERNET_DISCONNECTED: // Equivalent to ENETDOWN. 243 return PR_NETWORK_UNREACHABLE_ERROR; // Best approximation. 244 case ERR_CONNECTION_TIMED_OUT: 245 case ERR_TIMED_OUT: 246 return PR_IO_TIMEOUT_ERROR; 247 case ERR_CONNECTION_RESET: 248 return PR_CONNECT_RESET_ERROR; 249 case ERR_CONNECTION_ABORTED: 250 return PR_CONNECT_ABORTED_ERROR; 251 case ERR_CONNECTION_REFUSED: 252 return PR_CONNECT_REFUSED_ERROR; 253 case ERR_ADDRESS_UNREACHABLE: 254 return PR_HOST_UNREACHABLE_ERROR; // Also PR_NETWORK_UNREACHABLE_ERROR. 255 case ERR_ADDRESS_INVALID: 256 return PR_ADDRESS_NOT_AVAILABLE_ERROR; 257 case ERR_NAME_NOT_RESOLVED: 258 return PR_DIRECTORY_LOOKUP_ERROR; 259 default: 260 LOG(WARNING) << "MapErrorToNSS " << result 261 << " mapped to PR_UNKNOWN_ERROR"; 262 return PR_UNKNOWN_ERROR; 263 } 264 } 265 266 // The default error mapping function. 267 // Maps an NSS error code to a network error code. 268 int MapNSSError(PRErrorCode err) { 269 // TODO(port): fill this out as we learn what's important 270 switch (err) { 271 case PR_WOULD_BLOCK_ERROR: 272 return ERR_IO_PENDING; 273 case PR_ADDRESS_NOT_SUPPORTED_ERROR: // For connect. 274 case PR_NO_ACCESS_RIGHTS_ERROR: 275 return ERR_ACCESS_DENIED; 276 case PR_IO_TIMEOUT_ERROR: 277 return ERR_TIMED_OUT; 278 case PR_CONNECT_RESET_ERROR: 279 return ERR_CONNECTION_RESET; 280 case PR_CONNECT_ABORTED_ERROR: 281 return ERR_CONNECTION_ABORTED; 282 case PR_CONNECT_REFUSED_ERROR: 283 return ERR_CONNECTION_REFUSED; 284 case PR_NOT_CONNECTED_ERROR: 285 return ERR_SOCKET_NOT_CONNECTED; 286 case PR_HOST_UNREACHABLE_ERROR: 287 case PR_NETWORK_UNREACHABLE_ERROR: 288 return ERR_ADDRESS_UNREACHABLE; 289 case PR_ADDRESS_NOT_AVAILABLE_ERROR: 290 return ERR_ADDRESS_INVALID; 291 case PR_INVALID_ARGUMENT_ERROR: 292 return ERR_INVALID_ARGUMENT; 293 case PR_END_OF_FILE_ERROR: 294 return ERR_CONNECTION_CLOSED; 295 case PR_NOT_IMPLEMENTED_ERROR: 296 return ERR_NOT_IMPLEMENTED; 297 298 case SEC_ERROR_LIBRARY_FAILURE: 299 return ERR_UNEXPECTED; 300 case SEC_ERROR_INVALID_ARGS: 301 return ERR_INVALID_ARGUMENT; 302 case SEC_ERROR_NO_MEMORY: 303 return ERR_OUT_OF_MEMORY; 304 case SEC_ERROR_NO_KEY: 305 return ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY; 306 case SEC_ERROR_INVALID_KEY: 307 case SSL_ERROR_SIGN_HASHES_FAILURE: 308 LOG(ERROR) << "ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: NSS error " << err 309 << ", OS error " << PR_GetOSError(); 310 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED; 311 // A handshake (initial or renegotiation) may fail because some signature 312 // (for example, the signature in the ServerKeyExchange message for an 313 // ephemeral Diffie-Hellman cipher suite) is invalid. 314 case SEC_ERROR_BAD_SIGNATURE: 315 return ERR_SSL_PROTOCOL_ERROR; 316 317 case SSL_ERROR_SSL_DISABLED: 318 return ERR_NO_SSL_VERSIONS_ENABLED; 319 case SSL_ERROR_NO_CYPHER_OVERLAP: 320 case SSL_ERROR_PROTOCOL_VERSION_ALERT: 321 case SSL_ERROR_UNSUPPORTED_VERSION: 322 return ERR_SSL_VERSION_OR_CIPHER_MISMATCH; 323 case SSL_ERROR_HANDSHAKE_FAILURE_ALERT: 324 case SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT: 325 case SSL_ERROR_ILLEGAL_PARAMETER_ALERT: 326 return ERR_SSL_PROTOCOL_ERROR; 327 case SSL_ERROR_DECOMPRESSION_FAILURE_ALERT: 328 return ERR_SSL_DECOMPRESSION_FAILURE_ALERT; 329 case SSL_ERROR_BAD_MAC_ALERT: 330 return ERR_SSL_BAD_RECORD_MAC_ALERT; 331 case SSL_ERROR_DECRYPT_ERROR_ALERT: 332 return ERR_SSL_DECRYPT_ERROR_ALERT; 333 case SSL_ERROR_UNRECOGNIZED_NAME_ALERT: 334 return ERR_SSL_UNRECOGNIZED_NAME_ALERT; 335 case SSL_ERROR_UNSAFE_NEGOTIATION: 336 return ERR_SSL_UNSAFE_NEGOTIATION; 337 case SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY: 338 return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY; 339 case SSL_ERROR_HANDSHAKE_NOT_COMPLETED: 340 return ERR_SSL_HANDSHAKE_NOT_COMPLETED; 341 case SEC_ERROR_BAD_KEY: 342 case SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE: 343 // TODO(wtc): the following errors may also occur in contexts unrelated 344 // to the peer's public key. We should add new error codes for them, or 345 // map them to ERR_SSL_BAD_PEER_PUBLIC_KEY only in the right context. 346 // General unsupported/unknown key algorithm error. 347 case SEC_ERROR_UNSUPPORTED_KEYALG: 348 // General DER decoding errors. 349 case SEC_ERROR_BAD_DER: 350 case SEC_ERROR_EXTRA_INPUT: 351 return ERR_SSL_BAD_PEER_PUBLIC_KEY; 352 // During renegotiation, the server presented a different certificate than 353 // was used earlier. 354 case SSL_ERROR_WRONG_CERTIFICATE: 355 return ERR_SSL_SERVER_CERT_CHANGED; 356 case SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT: 357 return ERR_SSL_INAPPROPRIATE_FALLBACK; 358 359 default: { 360 const char* err_name = PR_ErrorToName(err); 361 if (err_name == NULL) 362 err_name = ""; 363 if (IS_SSL_ERROR(err)) { 364 LOG(WARNING) << "Unknown SSL error " << err << " (" << err_name << ")" 365 << " mapped to net::ERR_SSL_PROTOCOL_ERROR"; 366 return ERR_SSL_PROTOCOL_ERROR; 367 } 368 LOG(WARNING) << "Unknown error " << err << " (" << err_name << ")" 369 << " mapped to net::ERR_FAILED"; 370 return ERR_FAILED; 371 } 372 } 373 } 374 375 // Returns parameters to attach to the NetLog when we receive an error in 376 // response to a call to an NSS function. Used instead of 377 // NetLogSSLErrorCallback with events of type TYPE_SSL_NSS_ERROR. 378 base::Value* NetLogSSLFailedNSSFunctionCallback( 379 const char* function, 380 const char* param, 381 int ssl_lib_error, 382 NetLog::LogLevel /* log_level */) { 383 base::DictionaryValue* dict = new base::DictionaryValue(); 384 dict->SetString("function", function); 385 if (param[0] != '\0') 386 dict->SetString("param", param); 387 dict->SetInteger("ssl_lib_error", ssl_lib_error); 388 return dict; 389 } 390 391 void LogFailedNSSFunction(const BoundNetLog& net_log, 392 const char* function, 393 const char* param) { 394 DCHECK(function); 395 DCHECK(param); 396 net_log.AddEvent( 397 NetLog::TYPE_SSL_NSS_ERROR, 398 base::Bind(&NetLogSSLFailedNSSFunctionCallback, 399 function, param, PR_GetError())); 400 } 401 402 } // namespace net 403
