OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ |
6 #define CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ | 6 #define CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ |
7 #pragma once | 7 #pragma once |
8 | 8 |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
12 #include "base/crypto/rsa_private_key.h" | 12 #include "base/crypto/rsa_private_key.h" |
13 #include "base/ref_counted.h" | 13 #include "base/ref_counted.h" |
14 #include "base/scoped_ptr.h" | 14 #include "chrome/browser/chromeos/cros/login_library.h" |
15 #include "chrome/browser/chromeos/login/owner_key_utils.h" | 15 #include "chrome/browser/chromeos/login/owner_key_utils.h" |
16 #include "chrome/browser/chrome_thread.h" | 16 #include "chrome/browser/chrome_thread.h" |
17 | 17 |
18 class FilePath; | 18 class FilePath; |
19 class NotificationDetails; | 19 class NotificationDetails; |
20 class NotificationType; | 20 class NotificationType; |
21 | 21 |
22 namespace chromeos { | 22 namespace chromeos { |
23 | 23 |
24 // This class allows the registration of an Owner of a Chromium OS device. | 24 // This class allows the registration of an Owner of a Chromium OS device. |
25 // It handles generating the appropriate keys and storing them in the | 25 // It handles generating the appropriate keys and storing them in the |
26 // appropriate locations. | 26 // appropriate locations. |
27 class OwnerManager : public base::RefCountedThreadSafe<OwnerManager> { | 27 class OwnerManager : public base::RefCountedThreadSafe<OwnerManager>, |
| 28 public LoginLibrary::Delegate<bool> { |
28 public: | 29 public: |
29 // Return codes for public/private key operations. | 30 // Return codes for public/private key operations. |
30 enum KeyOpCode { | 31 enum KeyOpCode { |
31 SUCCESS, | 32 SUCCESS, |
32 KEY_UNAVAILABLE, // The necessary key isn't available yet. | 33 KEY_UNAVAILABLE, // The necessary key isn't available yet. |
33 OPERATION_FAILED // The crypto operation failed. | 34 OPERATION_FAILED // The crypto operation failed. |
34 }; | 35 }; |
35 | 36 |
36 class Delegate { | 37 class Delegate { |
37 public: | 38 public: |
38 // Upon completion of a key operation, this method will be called. | 39 // Upon completion of a key operation, this method will be called. |
39 // |return_code| indicates what happened, |payload| will be used to pass | 40 // |return_code| indicates what happened, |payload| will be used to pass |
40 // back any artifacts of the operation. For example, if the operation | 41 // back any artifacts of the operation. For example, if the operation |
41 // was a signature attempt, the signature blob would come back in |payload|. | 42 // was a signature attempt, the signature blob would come back in |payload|. |
42 virtual void OnKeyOpComplete(const KeyOpCode return_code, | 43 virtual void OnKeyOpComplete(const KeyOpCode return_code, |
43 const std::string& payload) = 0; | 44 const std::string& payload) = 0; |
44 }; | 45 }; |
45 | 46 |
46 OwnerManager(); | 47 OwnerManager(); |
47 virtual ~OwnerManager(); | 48 virtual ~OwnerManager(); |
48 | 49 |
49 bool IsAlreadyOwned(); | |
50 | |
51 // If the device has been owned already, posts a task to the FILE thread to | |
52 // fetch the public key off disk. | |
53 // Returns true if the attempt was initiated, false otherwise. | |
54 // | |
55 // Sends out a OWNER_KEY_FETCH_ATTEMPT_COMPLETE notification on completion. | |
56 // Notification comes with a Details<SECKEYPublicKey*> that contains a pointer | |
57 // to the public key, or NULL if the fetch attempt failed. | |
58 bool StartLoadOwnerKeyAttempt(); | |
59 | |
60 // If the device has not yet been owned, posts a task to the FILE | |
61 // thread to generate the owner's keys and put them in the right | |
62 // places. Keeps them in memory as well, for later use. | |
63 // Returns true if the attempt was initiated, false otherwise. | |
64 // | |
65 // Sends out a OWNER_KEY_FETCH_ATTEMPT_COMPLETE notification on completion. | |
66 // Notification comes with a Details<SECKEYPublicKey*> that contains a pointer | |
67 // to the public key, or NULL if the fetch attempt failed. | |
68 bool StartTakeOwnershipAttempt(); | |
69 | |
70 // Initiate an attempt to sign |data| with |private_key_|. Will call | |
71 // d->OnKeyOpComplete() when done. Upon success, the signature will be passed | |
72 // as the |payload| argument to d->OnKeyOpComplete(). | |
73 // Returns true if the attempt was initiated, false otherwise. | |
74 // | |
75 // If you call this on a well-known thread, you'll be called back on that | |
76 // thread. Otherwise, you'll get called back on the UI thread. | |
77 bool StartSigningAttempt(const std::string& data, Delegate* d); | |
78 | |
79 // Initiate an attempt to verify that |signature| is valid over |data| with | |
80 // |public_key_|. When the attempt is completed, an appropriate KeyOpCode | |
81 // will be passed to d->OnKeyOpComplete(). | |
82 // Returns true if the attempt was initiated, false otherwise. | |
83 // | |
84 // If you call this on a well-known thread, you'll be called back on that | |
85 // thread. Otherwise, you'll get called back on the UI thread. | |
86 bool StartVerifyAttempt(const std::string& data, | |
87 const std::string& signature, | |
88 Delegate* d); | |
89 | |
90 private: | |
91 // Pulls the owner's public key off disk and into memory. | 50 // Pulls the owner's public key off disk and into memory. |
92 // | 51 // |
93 // Call this on the FILE thread. | 52 // Call this on the FILE thread. |
94 void LoadOwnerKey(); | 53 void LoadOwnerKey(); |
95 | 54 |
96 // Generates the owner's keys in the default NSS token. Also stores | 55 // Generates the owner's keys in the default NSS token. Also stores |
97 // them in |public_key_| and |private_key_|. When done, causes the | 56 // them in |public_key_| and |private_key_|. When done, causes the |
98 // public key to get exported via DBus. | 57 // public key to get exported via DBus. |
99 // | 58 // |
100 // Call this on the FILE thread. | 59 // Call this on the FILE thread. |
101 void GenerateKeysAndExportPublic(); | 60 void GenerateKeysAndExportPublic(); |
102 | 61 |
103 // Exports |public_key_| via DBus. | 62 // Exports |public_key_| via DBus. |
104 // | 63 // |
105 // Call this on the UI thread (because of DBus usage). | 64 // Call this on the UI thread (because of DBus usage). |
106 void ExportKey(); | 65 void ExportKey(); |
107 | 66 |
| 67 // Overridden from LoginLibrary::Delegate |
| 68 void Run(bool value); |
| 69 |
108 bool EnsurePublicKey(); | 70 bool EnsurePublicKey(); |
109 bool EnsurePrivateKey(); | 71 bool EnsurePrivateKey(); |
110 | 72 |
111 // Do the actual work of signing |data| with |private_key_|. First, | 73 // Do the actual work of signing |data| with |private_key_|. First, |
112 // ensures that we have the keys we need. Then, computes the signature. | 74 // ensures that we have the keys we need. Then, computes the signature. |
113 // | 75 // |
114 // On success, calls d->OnKeyOpComplete() on |thread_id| with a | 76 // On success, calls d->OnKeyOpComplete() on |thread_id| with a |
115 // successful return code, passing the signaure blob in |payload|. | 77 // successful return code, passing the signaure blob in |payload|. |
116 // On failure, calls d->OnKeyOpComplete() on |thread_id| with an appropriate | 78 // On failure, calls d->OnKeyOpComplete() on |thread_id| with an appropriate |
117 // error and passes an empty string for |payload|. | 79 // error and passes an empty string for |payload|. |
118 void Sign(const ChromeThread::ID thread_id, | 80 void Sign(const ChromeThread::ID thread_id, |
119 const std::string& data, | 81 const std::string& data, |
120 Delegate* d); | 82 Delegate* d); |
121 | 83 |
122 // Do the actual work of verifying that |signature| is valid over | 84 // Do the actual work of verifying that |signature| is valid over |
123 // |data| with |public_key_|. First, ensures we have the key we | 85 // |data| with |public_key_|. First, ensures we have the key we |
124 // need, then does the verify. | 86 // need, then does the verify. |
125 // | 87 // |
126 // On success, calls d->OnKeyOpComplete() on |thread_id| with a | 88 // On success, calls d->OnKeyOpComplete() on |thread_id| with a |
127 // successful return code, passing an empty string for |payload|. | 89 // successful return code, passing an empty string for |payload|. |
128 // On failure, calls d->OnKeyOpComplete() on |thread_id| with an appropriate | 90 // On failure, calls d->OnKeyOpComplete() on |thread_id| with an appropriate |
129 // error code, passing an empty string for |payload|. | 91 // error code, passing an empty string for |payload|. |
130 void Verify(const ChromeThread::ID thread_id, | 92 void Verify(const ChromeThread::ID thread_id, |
131 const std::string& data, | 93 const std::string& data, |
132 const std::string& signature, | 94 const std::string& signature, |
133 Delegate* d); | 95 Delegate* d); |
134 | 96 |
| 97 private: |
135 // A helper method to send a notification on another thread. | 98 // A helper method to send a notification on another thread. |
136 void SendNotification(NotificationType type, | 99 void SendNotification(NotificationType type, |
137 const NotificationDetails& details); | 100 const NotificationDetails& details); |
138 | 101 |
139 // A helper method to call back a delegte on another thread. | 102 // A helper method to call back a delegte on another thread. |
140 void CallDelegate(Delegate* d, | 103 void CallDelegate(Delegate* d, |
141 const KeyOpCode return_code, | 104 const KeyOpCode return_code, |
142 const std::string& payload) { | 105 const std::string& payload) { |
143 d->OnKeyOpComplete(return_code, payload); | 106 d->OnKeyOpComplete(return_code, payload); |
144 } | 107 } |
145 | 108 |
146 scoped_ptr<base::RSAPrivateKey> private_key_; | 109 scoped_ptr<base::RSAPrivateKey> private_key_; |
147 std::vector<uint8> public_key_; | 110 std::vector<uint8> public_key_; |
148 | 111 |
149 scoped_ptr<OwnerKeyUtils> utils_; | 112 scoped_refptr<OwnerKeyUtils> utils_; |
150 | 113 |
151 friend class OwnerManagerTest; | 114 friend class OwnerManagerTest; |
152 | 115 |
153 DISALLOW_COPY_AND_ASSIGN(OwnerManager); | 116 DISALLOW_COPY_AND_ASSIGN(OwnerManager); |
154 }; | 117 }; |
155 | 118 |
156 } // namespace chromeos | 119 } // namespace chromeos |
157 | 120 |
158 #endif // CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ | 121 #endif // CHROME_BROWSER_CHROMEOS_LOGIN_OWNER_MANAGER_H_ |
OLD | NEW |