Add a new GetTlsUniqueChannelBinding method to SSLSocket, and implement nss version.

Add a new GetTlsUniqueChannelBinding method to SSLSocket, and implement nss version.

BUG=139700
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=149231

[Ryan Hamilton, 2012-07-30 18:45:53]

Hi wtc,

Can you take a look at this CL?  I need to access TLS unique from SPDY land, so
I've added a new GetTlsUniqueChannelBinding method to SSLSocket.

[wtc, 2012-07-30 20:05:08]

Patch set 1 LGTM.

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.cc
File net/socket/socket_test_util.cc (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.cc...
net/socket/socket_test_util.cc:724: *outlen = outlen_max;

I wonder if we should memset 12 bytes and store 12 in *outlen?

If we do so, we need to make sure outlen_max >= 12.
(We don't seem to have an error code for "buffer too small".
I guess we can use ERR_INVALID_ARGUMENT as a substitute.)

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.h
File net/socket/socket_test_util.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.h#...
net/socket/socket_test_util.h:1: // Copyright (c) 2012 The Chromium Authors. All
rights reserved.

If you have a bug report for this work, please add a
BUG= field to the CL's description.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_server_socket_n...
File net/socket/ssl_server_socket_nss.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_server_socket_n...
net/socket/ssl_server_socket_nss.h:44: virtual int Handshake(const
CompletionCallback& callback) OVERRIDE;

Nit: to conform to the style guide's requirement that method
declaration and definition orders match each other, I
suggest you list
  // SSLServerSocket interface.
  virtual int Handshake(const ...
first, and then
  // SSLSocket interface.
  virtual int ExportKeyingMaterial(...
  ...
  virtual int ExportKeyingMaterial(...
  ...

Please make the same change to the other headers.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h
File net/socket/ssl_socket.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode33
net/socket/ssl_socket.h:33: // actual number of bytes written will be set in
|outlen|.

Nit: remove the comma after "At most".  Add '*' before outlen.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode34
net/socket/ssl_socket.h:34: virtual int GetTlsUniqueChannelBinding(unsigned
char* out,

Please spell "TLS" in all caps.

History: our Style Guide does not mandate how abbreviations
should be spelled in function or class names.  The base and
net components followed the WebKit/Apple style of spelling
abbreviations in all caps.  This style isn't consistently
followed in net (for example, HTTP is often spelled "Http").

It may be better to define this method as
GetChannelBinding, which takes the channel binding type
(specified an enum or a string) as an input argument.
We can do this later when we need to use another channel
binding type.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode36
net/socket/ssl_socket.h:36: unsigned int outlen_max) = 0;

We probably should just use a
  std::string* out
output argument.  At least, use size_t instead of
unsigned int as the type of length.  But I noticed that
the existing ExportKeyingMaterial method above is already
using 'unsigned int' as the type of length.  (The use
of unsigned int for lengths is an NSS-ism.)

[Ryan Hamilton, 2012-07-30 21:37:57]

Thanks!  I have address all comments.

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.cc
File net/socket/socket_test_util.cc (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.cc...
net/socket/socket_test_util.cc:724: *outlen = outlen_max;
On 2012/07/30 20:05:08, wtc wrote:
> 
> I wonder if we should memset 12 bytes and store 12 in *outlen?
> 
> If we do so, we need to make sure outlen_max >= 12.
> (We don't seem to have an error code for "buffer too small".
> I guess we can use ERR_INVALID_ARGUMENT as a substitute.)

Done.

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.h
File net/socket/socket_test_util.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/socket_test_util.h#...
net/socket/socket_test_util.h:1: // Copyright (c) 2012 The Chromium Authors. All
rights reserved.
On 2012/07/30 20:05:08, wtc wrote:
> 
> If you have a bug report for this work, please add a
> BUG= field to the CL's description.

Done.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_server_socket_n...
File net/socket/ssl_server_socket_nss.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_server_socket_n...
net/socket/ssl_server_socket_nss.h:44: virtual int Handshake(const
CompletionCallback& callback) OVERRIDE;
On 2012/07/30 20:05:08, wtc wrote:
> 
> Nit: to conform to the style guide's requirement that method
> declaration and definition orders match each other, I
> suggest you list
>   // SSLServerSocket interface.
>   virtual int Handshake(const ...
> first, and then
>   // SSLSocket interface.
>   virtual int ExportKeyingMaterial(...
>   ...
>   virtual int ExportKeyingMaterial(...
>   ...
> 
> Please make the same change to the other headers.

Done.  FWIW, the order of declaration vs definition is not in agreement for
other methods in these classes, but that can wait for another day.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h
File net/socket/ssl_socket.h (right):

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode33
net/socket/ssl_socket.h:33: // actual number of bytes written will be set in
|outlen|.
On 2012/07/30 20:05:08, wtc wrote:
> 
> Nit: remove the comma after "At most".  Add '*' before outlen.

Done.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode34
net/socket/ssl_socket.h:34: virtual int GetTlsUniqueChannelBinding(unsigned
char* out,
On 2012/07/30 20:05:08, wtc wrote:
> 
> Please spell "TLS" in all caps.
> 
> History: our Style Guide does not mandate how abbreviations
> should be spelled in function or class names.  The base and
> net components followed the WebKit/Apple style of spelling
> abbreviations in all caps.  This style isn't consistently
> followed in net (for example, HTTP is often spelled "Http").
> 
> It may be better to define this method as
> GetChannelBinding, which takes the channel binding type
> (specified an enum or a string) as an input argument.
> We can do this later when we need to use another channel
> binding type.

Done.

http://codereview.chromium.org/10823084/diff/1/net/socket/ssl_socket.h#newcode36
net/socket/ssl_socket.h:36: unsigned int outlen_max) = 0;
On 2012/07/30 20:05:08, wtc wrote:
> 
> We probably should just use a
>   std::string* out
> output argument.  At least, use size_t instead of
> unsigned int as the type of length.  But I noticed that
> the existing ExportKeyingMaterial method above is already
> using 'unsigned int' as the type of length.  (The use
> of unsigned int for lengths is an NSS-ism.)

Done.

[wtc, 2012-07-30 22:42:26]

Patch set 2 LGTM.

http://codereview.chromium.org/10823084/diff/8001/net/socket/socket_test_util.cc
File net/socket/socket_test_util.cc (right):

http://codereview.chromium.org/10823084/diff/8001/net/socket/socket_test_util...
net/socket/socket_test_util.cc:721: out->append("MOCK_TLS_UNIQUE");

We should use out->assign() instead of out->append().

To be realistic, the mock tls-unique string should be
12-character long.

http://codereview.chromium.org/10823084/diff/8001/net/socket/ssl_socket.h
File net/socket/ssl_socket.h (right):

http://codereview.chromium.org/10823084/diff/8001/net/socket/ssl_socket.h#new...
net/socket/ssl_socket.h:31: // Stores the the tls-unique channel binding (see
RFC 5929) in |out|.

Nit: |out| => |*out| ?

[Ryan Hamilton, 2012-07-31 16:12:21]

Thanks!

http://codereview.chromium.org/10823084/diff/8001/net/socket/socket_test_util.cc
File net/socket/socket_test_util.cc (right):

http://codereview.chromium.org/10823084/diff/8001/net/socket/socket_test_util...
net/socket/socket_test_util.cc:721: out->append("MOCK_TLS_UNIQUE");
On 2012/07/30 22:42:26, wtc wrote:
> 
> We should use out->assign() instead of out->append().
> 
> To be realistic, the mock tls-unique string should be
> 12-character long.
> 

Done.

http://codereview.chromium.org/10823084/diff/8001/net/socket/ssl_socket.h
File net/socket/ssl_socket.h (right):

http://codereview.chromium.org/10823084/diff/8001/net/socket/ssl_socket.h#new...
net/socket/ssl_socket.h:31: // Stores the the tls-unique channel binding (see
RFC 5929) in |out|.
On 2012/07/30 22:42:26, wtc wrote:
> 
> Nit: |out| => |*out| ?

Done.

[commit-bot: I haz the power, 2012-07-31 16:12:32]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/[email protected]/10823084/7003

[commit-bot: I haz the power, 2012-07-31 16:25:26]

Try job failure for 10823084-7003 (retry) on mac_rel for step "compile" (clobber
build).
It's a second try, previously, step "compile" failed.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=mac_rel&nu...

[commit-bot: I haz the power, 2012-07-31 16:39:32]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/[email protected]/10823084/35

[commit-bot: I haz the power, 2012-07-31 18:32:20]

Change committed as 149231