OLD | NEW |
1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ | 5 #ifndef CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ |
6 #define CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ | 6 #define CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ |
7 | 7 |
8 #include <Security/Security.h> | 8 #include <Security/Security.h> |
9 | 9 |
10 #include <string> | 10 #include <string> |
11 #include <vector> | 11 #include <vector> |
12 | 12 |
13 #include "base/time.h" | 13 #include "base/time.h" |
14 #include "chrome/browser/keychain_mac.h" | 14 #include "chrome/browser/keychain_mac.h" |
15 | 15 |
| 16 // Adapter that wraps a MacKeychain and provides interaction in terms of |
| 17 // PasswordForms instead of keychain items. |
| 18 class MacKeychainPasswordFormAdapter { |
| 19 public: |
| 20 // Creates an adapter for |keychain|. This class does not take ownership of |
| 21 // |keychain|, so the caller must make sure that the keychain outlives the |
| 22 // created object. |
| 23 explicit MacKeychainPasswordFormAdapter(MacKeychain* keychain); |
| 24 |
| 25 // Returns PasswordForms for each keychain entry matching |form|. |
| 26 // Caller is responsible for deleting the returned forms. |
| 27 std::vector<webkit_glue::PasswordForm*> PasswordsMatchingForm( |
| 28 const webkit_glue::PasswordForm& query_form); |
| 29 |
| 30 // Creates a new keychain entry from |form|, or updates the password of an |
| 31 // existing keychain entry if there is a collision. Returns true if a keychain |
| 32 // entry was successfully added/updated. |
| 33 bool AddLogin(const webkit_glue::PasswordForm& form); |
| 34 |
| 35 private: |
| 36 // Returns PasswordForms constructed from the given Keychain items. |
| 37 // Caller is responsible for deleting the returned forms. |
| 38 std::vector<webkit_glue::PasswordForm*> CreateFormsFromKeychainItems( |
| 39 const std::vector<SecKeychainItemRef>& items); |
| 40 |
| 41 // Searches |keychain| for all items usable for the given signon_realm, and |
| 42 // puts them in |items|. The caller is responsible for calling keychain->Free |
| 43 // on each of them when it is finished with them. |
| 44 std::vector<SecKeychainItemRef> MatchingKeychainItems( |
| 45 const std::string& signon_realm, webkit_glue::PasswordForm::Scheme scheme); |
| 46 |
| 47 // Changes the password for keychain_item to |password|; returns true if the |
| 48 // password was successfully changed. |
| 49 bool SetKeychainItemPassword(const SecKeychainItemRef& keychain_item, |
| 50 const std::string& password); |
| 51 |
| 52 MacKeychain* keychain_; |
| 53 |
| 54 DISALLOW_COPY_AND_ASSIGN(MacKeychainPasswordFormAdapter); |
| 55 }; |
| 56 |
16 namespace internal_keychain_helpers { | 57 namespace internal_keychain_helpers { |
17 | 58 |
18 // Takes a PasswordForm's signon_realm and parses it into its component parts, | |
19 // which are returned though the appropriate out parameters. | |
20 // Returns true if it can be successfully parsed, in which case all out params | |
21 // that are non-NULL will be set. If there is no port, port will be 0. | |
22 // If the return value is false, the state of the our params is undefined. | |
23 bool ExtractSignonRealmComponents(const std::string& signon_realm, | |
24 std::string* server, int* port, | |
25 bool* is_secure, | |
26 std::string* security_domain); | |
27 | |
28 // Returns a URL built from the given components. To create a URL without a | |
29 // port, pass kAnyPort for the |port| parameter. | |
30 GURL URLFromComponents(bool is_secure, const std::string& host, int port, | |
31 const std::string& path); | |
32 | |
33 // Converts a Keychain time string to a Time object, returning true if | |
34 // time_string_bytes was parsable. If the return value is false, the value of | |
35 // |time| is unchanged. | |
36 bool TimeFromKeychainTimeString(const char* time_string_bytes, | |
37 unsigned int byte_length, | |
38 base::Time* time); | |
39 | |
40 // Returns the Keychain SecAuthenticationType type corresponding to |scheme|. | |
41 SecAuthenticationType AuthTypeForScheme( | |
42 webkit_glue::PasswordForm::Scheme scheme); | |
43 | |
44 // Returns the PasswordForm Scheme corresponding to |auth_type|. | |
45 webkit_glue::PasswordForm::Scheme SchemeForAuthType( | |
46 SecAuthenticationType auth_type); | |
47 | |
48 // Searches |keychain| for all items usable for the given signon_realm, and | |
49 // puts them in |items|. The caller is responsible for calling keychain->Free | |
50 // on each of them when it is finished with them. | |
51 void FindMatchingKeychainItems(const MacKeychain& keychain, | |
52 const std::string& signon_realm, | |
53 webkit_glue::PasswordForm::Scheme scheme, | |
54 std::vector<SecKeychainItemRef>* items); | |
55 | |
56 // Searches |keychain| for the specific keychain entry matching the given form, | 59 // Searches |keychain| for the specific keychain entry matching the given form, |
57 // and returns it (or NULL if no match is found). | 60 // and returns it (or NULL if no match is found). |
58 // The caller is responsible for calling keychain->Free on the returned item. | 61 // The caller is responsible for calling keychain->Free on the returned item. |
59 SecKeychainItemRef FindMatchingKeychainItem( | 62 SecKeychainItemRef MatchingKeychainItem(const MacKeychain& keychain, |
60 const MacKeychain& keychain, const webkit_glue::PasswordForm& form); | 63 const webkit_glue::PasswordForm& form); |
61 | 64 |
62 // Sets the fields of |form| based on the keychain data from |keychain_item|. | 65 // Sets the fields of |form| based on the keychain data from |keychain_item|. |
63 // Fields that can't be determined from |keychain_item| will be unchanged. | 66 // Fields that can't be determined from |keychain_item| will be unchanged. |
64 // | 67 // |
65 // IMPORTANT: This function can cause the OS to trigger UI (to allow access to | 68 // IMPORTANT: This function can cause the OS to trigger UI (to allow access to |
66 // the keychain item if we aren't trusted for the item), and block until the UI | 69 // the keychain item if we aren't trusted for the item), and block until the UI |
67 // is dismissed. | 70 // is dismissed. |
68 // | 71 // |
69 // If excessive prompting for access to other applications' keychain items | 72 // If excessive prompting for access to other applications' keychain items |
70 // becomes an issue, the password storage API will need to be refactored to | 73 // becomes an issue, the password storage API will need to be refactored to |
71 // allow the password to be retrieved later (accessing other fields doesn't | 74 // allow the password to be retrieved later (accessing other fields doesn't |
72 // require authorization). | 75 // require authorization). |
73 bool FillPasswordFormFromKeychainItem(const MacKeychain& keychain, | 76 bool FillPasswordFormFromKeychainItem(const MacKeychain& keychain, |
74 const SecKeychainItemRef& keychain_item, | 77 const SecKeychainItemRef& keychain_item, |
75 webkit_glue::PasswordForm* form); | 78 webkit_glue::PasswordForm* form); |
76 | 79 |
77 // Creates a new keychain entry from |form|, or updates the password of an | |
78 // existing keychain entry if there is a collision. Returns true if a keychain | |
79 // entry was successfully added/updated. | |
80 bool AddKeychainEntryForForm(const MacKeychain& keychain, | |
81 const webkit_glue::PasswordForm& form); | |
82 | |
83 // Changes the password for keychain_item to |password|; returns true if the | |
84 // password was successfully changed. | |
85 bool SetKeychainItemPassword(const MacKeychain& keychain, | |
86 const SecKeychainItemRef& keychain_item, | |
87 const std::string& password); | |
88 | |
89 // Returns true if the two given forms match based on signon_reaml, scheme, and | 80 // Returns true if the two given forms match based on signon_reaml, scheme, and |
90 // username_value, and are thus suitable for merging (see MergePasswordForms). | 81 // username_value, and are thus suitable for merging (see MergePasswordForms). |
91 // If this returns true, and path_matches is non-NULL, *path_matches will be set | 82 // If this returns true, and path_matches is non-NULL, *path_matches will be set |
92 // based on whether the full origin matches as well. | 83 // based on whether the full origin matches as well. |
93 bool FormsMatchForMerge(const webkit_glue::PasswordForm& form_a, | 84 bool FormsMatchForMerge(const webkit_glue::PasswordForm& form_a, |
94 const webkit_glue::PasswordForm& form_b, | 85 const webkit_glue::PasswordForm& form_b, |
95 bool* path_matches); | 86 bool* path_matches); |
96 | 87 |
97 // Populates merged_forms by combining the password data from keychain_forms and | 88 // Populates merged_forms by combining the password data from keychain_forms and |
98 // the metadata from database_forms, removing used entries from the two source | 89 // the metadata from database_forms, removing used entries from the two source |
99 // lists. | 90 // lists. |
100 // | 91 // |
101 // On return, database_forms and keychain_forms will have only unused | 92 // On return, database_forms and keychain_forms will have only unused |
102 // entries; for database_forms that means entries for which no corresponding | 93 // entries; for database_forms that means entries for which no corresponding |
103 // password can be found (and which aren't blacklist entries), but for | 94 // password can be found (and which aren't blacklist entries), but for |
104 // keychain_forms it's only entries we explicitly choose not to use (e.g., | 95 // keychain_forms it's only entries we explicitly choose not to use (e.g., |
105 // blacklist entries from other browsers). Keychain entries that we have no | 96 // blacklist entries from other browsers). Keychain entries that we have no |
106 // database matches for will still end up in merged_forms, since they have | 97 // database matches for will still end up in merged_forms, since they have |
107 // enough information to be used as imported passwords. | 98 // enough information to be used as imported passwords. |
108 void MergePasswordForms(std::vector<webkit_glue::PasswordForm*>* keychain_forms, | 99 void MergePasswordForms(std::vector<webkit_glue::PasswordForm*>* keychain_forms, |
109 std::vector<webkit_glue::PasswordForm*>* database_forms, | 100 std::vector<webkit_glue::PasswordForm*>* database_forms, |
110 std::vector<webkit_glue::PasswordForm*>* merged_forms); | 101 std::vector<webkit_glue::PasswordForm*>* merged_forms); |
111 | 102 |
112 } // internal_keychain_helpers | 103 } // internal_keychain_helpers |
113 | 104 |
114 #endif // CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ | 105 #endif // CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_ |
OLD | NEW |