1 // Copyright (c) 2019 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "quiche/quic/core/crypto/tls_client_connection.h"
6
7 namespace quic {
8
TlsClientConnection(SSL_CTX * ssl_ctx,Delegate * delegate,QuicSSLConfig ssl_config)9 TlsClientConnection::TlsClientConnection(SSL_CTX* ssl_ctx, Delegate* delegate,
10 QuicSSLConfig ssl_config)
11 : TlsConnection(ssl_ctx, delegate->ConnectionDelegate(),
12 std::move(ssl_config)),
13 delegate_(delegate) {}
14
15 // static
CreateSslCtx(bool enable_early_data)16 bssl::UniquePtr<SSL_CTX> TlsClientConnection::CreateSslCtx(
17 bool enable_early_data) {
18 bssl::UniquePtr<SSL_CTX> ssl_ctx = TlsConnection::CreateSslCtx();
19 // Configure certificate verification.
20 SSL_CTX_set_custom_verify(ssl_ctx.get(), SSL_VERIFY_PEER, &VerifyCallback);
21 int reverify_on_resume_enabled = 1;
22 SSL_CTX_set_reverify_on_resume(ssl_ctx.get(), reverify_on_resume_enabled);
23
24 // Configure session caching.
25 SSL_CTX_set_session_cache_mode(
26 ssl_ctx.get(), SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
27 SSL_CTX_sess_set_new_cb(ssl_ctx.get(), NewSessionCallback);
28
29 // TODO(wub): Always enable early data on the SSL_CTX, but allow it to be
30 // overridden on the SSL object, via QuicSSLConfig.
31 SSL_CTX_set_early_data_enabled(ssl_ctx.get(), enable_early_data);
32 return ssl_ctx;
33 }
34
SetCertChain(const std::vector<CRYPTO_BUFFER * > & cert_chain,EVP_PKEY * privkey)35 void TlsClientConnection::SetCertChain(
36 const std::vector<CRYPTO_BUFFER*>& cert_chain, EVP_PKEY* privkey) {
37 SSL_set_chain_and_key(ssl(), cert_chain.data(), cert_chain.size(), privkey,
38 /*privkey_method=*/nullptr);
39 }
40
41 // static
NewSessionCallback(SSL * ssl,SSL_SESSION * session)42 int TlsClientConnection::NewSessionCallback(SSL* ssl, SSL_SESSION* session) {
43 static_cast<TlsClientConnection*>(ConnectionFromSsl(ssl))
44 ->delegate_->InsertSession(bssl::UniquePtr<SSL_SESSION>(session));
45 return 1;
46 }
47
48 } // namespace quic
49