Handle Origin Bound Certificate expiration.

chrome/browser/net/sqlite_origin_bound_cert_store.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/sqlite_origin_bound_cert_store.h"
 
 #include <list>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_util.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_restrictions.h"
 #include "chrome/browser/diagnostics/sqlite_diagnostics.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/base/ssl_client_cert_type.h"
+#include "net/base/x509_certificate.h"
 #include "sql/meta_table.h"
 #include "sql/statement.h"
 #include "sql/transaction.h"
 
 using content::BrowserThread;
 
 // This class is designed to be shared between any calling threads and the
 // database thread.  It batches operations and commits them on a timer.
 class SQLiteOriginBoundCertStore::Backend
     : public base::RefCountedThreadSafe<SQLiteOriginBoundCertStore::Backend> {
@@ skipping 79 matching lines @@
   PendingOperationsList::size_type num_pending_;
   // True if the persistent store should be deleted upon destruction.
   bool clear_local_state_on_exit_;
   // Guard |pending_|, |num_pending_| and |clear_local_state_on_exit_|.
   base::Lock lock_;
 
   DISALLOW_COPY_AND_ASSIGN(Backend);
 };
 
 // Version number of the database.
-static const int kCurrentVersionNumber = 2;
+static const int kCurrentVersionNumber = 3;
 static const int kCompatibleVersionNumber = 1;
 
 namespace {
 
 // Initializes the certs table, returning true on success.
 bool InitTable(sql::Connection* db) {
   if (!db->DoesTableExist("origin_bound_certs")) {
     if (!db->Execute("CREATE TABLE origin_bound_certs ("
                      "origin TEXT NOT NULL UNIQUE PRIMARY KEY,"
                      "private_key BLOB NOT NULL,"
                      "cert BLOB NOT NULL,"
-                     "cert_type INTEGER)"))
+                     "cert_type INTEGER,"
+                     "expiration_time INTEGER)"))
       return false;
   }
 
   return true;
 }
 
 }  // namespace
 
 bool SQLiteOriginBoundCertStore::Backend::Load(
     std::vector<net::DefaultOriginBoundCertStore::OriginBoundCert*>* certs) {
@@ skipping 21 matching lines @@
   if (!EnsureDatabaseVersion() || !InitTable(db_.get())) {
     NOTREACHED() << "Unable to open cert DB.";
     db_.reset();
     return false;
   }
 
   db_->Preload();
 
   // Slurp all the certs into the out-vector.
   sql::Statement smt(db_->GetUniqueStatement(
-      "SELECT origin, private_key, cert, cert_type FROM origin_bound_certs"));
+      "SELECT origin, private_key, cert, cert_type, expiration_time "
+      "FROM origin_bound_certs"));
   if (!smt) {
     NOTREACHED() << "select statement prep failed";
     db_.reset();
     return false;
   }
 
   while (smt.Step()) {
     std::string private_key_from_db, cert_from_db;
     smt.ColumnBlobAsString(1, &private_key_from_db);
     smt.ColumnBlobAsString(2, &cert_from_db);
     scoped_ptr<net::DefaultOriginBoundCertStore::OriginBoundCert> cert(
         new net::DefaultOriginBoundCertStore::OriginBoundCert(
             smt.ColumnString(0),  // origin
             static_cast<net::SSLClientCertType>(smt.ColumnInt(3)),
+            base::Time::FromInternalValue(smt.ColumnInt64(4)),
             private_key_from_db,
             cert_from_db));
     certs->push_back(cert.release());
   }
 
   return true;
 }
 
 bool SQLiteOriginBoundCertStore::Backend::EnsureDatabaseVersion() {
   // Version check.
@@ skipping 24 matching lines @@
                    << "version 2.";
       return false;
     }
     ++cur_version;
     meta_table_.SetVersionNumber(cur_version);
     meta_table_.SetCompatibleVersionNumber(
         std::min(cur_version, kCompatibleVersionNumber));
     transaction.Commit();
   }
 
+  if (cur_version == 2) {
+    sql::Transaction transaction(db_.get());
+    if (!transaction.Begin())
+      return false;
+    if (!db_->Execute("ALTER TABLE origin_bound_certs ADD COLUMN "
+                      "expiration_time INTEGER")) {
+      LOG(WARNING) << "Unable to update origin bound cert database to "
+                   << "version 3.";
+      return false;
+    }
+
+    sql::Statement smt(db_->GetUniqueStatement(
+        "SELECT origin, cert FROM origin_bound_certs"));
+    if (!smt) {
+      LOG(WARNING) << "Unable to update origin bound cert database to "
+                   << "version 3.";
+      return false;
+    }
+    sql::Statement update_expires_smt(db_->GetUniqueStatement(
+        "UPDATE origin_bound_certs SET expiration_time = ? WHERE origin = ?"));
+    if (!update_expires_smt) {
+      LOG(WARNING) << "Unable to update origin bound cert database to "
+                   << "version 3.";
+      return false;
+    }
+    while (smt.Step()) {
+      std::string origin = smt.ColumnString(0);
+      std::string cert_from_db;
+      smt.ColumnBlobAsString(1, &cert_from_db);
+      // Parse the cert and extract the real value and then update the DB.
+      scoped_refptr<net::X509Certificate> cert(
+          net::X509Certificate::CreateFromBytes(
+              cert_from_db.data(), cert_from_db.size()));
+      if (cert) {
+        update_expires_smt.Reset();
+        update_expires_smt.BindInt64(0, cert->valid_expiry().ToInternalValue());
+        update_expires_smt.BindString(1, origin);
+        if (!update_expires_smt.Run()) {
+          LOG(WARNING) << "Unable to update origin bound cert database to "
+                       << "version 3.";
+          return false;
+        }
+      } else {
+        // If there's a cert we can't parse, just leave it.  It'll get replaced
+        // with a new one if we ever try to use it.
+        LOG(WARNING) << "Error parsing cert for database upgrade for origin "
+                     << smt.ColumnString(0);
+      }
+    }
+
+    ++cur_version;
+    meta_table_.SetVersionNumber(cur_version);
+    meta_table_.SetCompatibleVersionNumber(
+        std::min(cur_version, kCompatibleVersionNumber));
+    transaction.Commit();
+  }
+
   // Put future migration cases here.
 
   // When the version is too old, we just try to continue anyway, there should
   // not be a released product that makes a database too old for us to handle.
   LOG_IF(WARNING, cur_version < kCurrentVersionNumber) <<
       "Origin bound cert database version " << cur_version <<
       " is too old to handle.";
 
   return true;
 }
@@ skipping 48 matching lines @@
     base::AutoLock locked(lock_);
     pending_.swap(ops);
     num_pending_ = 0;
   }
 
   // Maybe an old timer fired or we are already Close()'ed.
   if (!db_.get() || ops.empty())
     return;
 
   sql::Statement add_smt(db_->GetCachedStatement(SQL_FROM_HERE,
-      "INSERT INTO origin_bound_certs (origin, private_key, cert, cert_type) "
-      "VALUES (?,?,?,?)"));
+      "INSERT INTO origin_bound_certs (origin, private_key, cert, cert_type, "
+      "expiration_time) VALUES (?,?,?,?,?)"));
   if (!add_smt) {
     NOTREACHED();
     return;
   }
 
   sql::Statement del_smt(db_->GetCachedStatement(SQL_FROM_HERE,
                              "DELETE FROM origin_bound_certs WHERE origin=?"));
   if (!del_smt) {
     NOTREACHED();
     return;
@@ skipping 10 matching lines @@
     scoped_ptr<PendingOperation> po(*it);
     switch (po->op()) {
       case PendingOperation::CERT_ADD: {
         add_smt.Reset();
         add_smt.BindString(0, po->cert().origin());
         const std::string& private_key = po->cert().private_key();
         add_smt.BindBlob(1, private_key.data(), private_key.size());
         const std::string& cert = po->cert().cert();
         add_smt.BindBlob(2, cert.data(), cert.size());
         add_smt.BindInt(3, po->cert().type());
+        add_smt.BindInt64(4, po->cert().expiration_time().ToInternalValue());
         if (!add_smt.Run())
           NOTREACHED() << "Could not add an origin bound cert to the DB.";
         break;
       }
       case PendingOperation::CERT_DELETE:
         del_smt.Reset();
         del_smt.BindString(0, po->cert().origin());
         if (!del_smt.Run())
           NOTREACHED() << "Could not delete an origin bound cert from the DB.";
         break;
@@ skipping 82 matching lines @@
   if (backend_.get())
     backend_->SetClearLocalStateOnExit(clear_local_state);
 }
 
 void SQLiteOriginBoundCertStore::Flush(const base::Closure& completion_task) {
   if (backend_.get())
     backend_->Flush(completion_task);
   else if (!completion_task.is_null())
     MessageLoop::current()->PostTask(FROM_HERE, completion_task);
 }