OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/ssl/channel_id_service.h" | 5 #include "net/ssl/channel_id_service.h" |
6 | 6 |
7 #include <algorithm> | 7 #include <algorithm> |
8 #include <limits> | 8 #include <limits> |
9 | 9 |
10 #include "base/bind.h" | 10 #include "base/bind.h" |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
81 base::TimeDelta::FromMinutes(5), | 81 base::TimeDelta::FromMinutes(5), |
82 50); | 82 50); |
83 } | 83 } |
84 | 84 |
85 // On success, returns a ChannelID object and sets |*error| to OK. | 85 // On success, returns a ChannelID object and sets |*error| to OK. |
86 // Otherwise, returns NULL, and |*error| will be set to a net error code. | 86 // Otherwise, returns NULL, and |*error| will be set to a net error code. |
87 // |serial_number| is passed in because base::RandInt cannot be called from an | 87 // |serial_number| is passed in because base::RandInt cannot be called from an |
88 // unjoined thread, due to relying on a non-leaked LazyInstance | 88 // unjoined thread, due to relying on a non-leaked LazyInstance |
89 scoped_ptr<ChannelIDStore::ChannelID> GenerateChannelID( | 89 scoped_ptr<ChannelIDStore::ChannelID> GenerateChannelID( |
90 const std::string& server_identifier, | 90 const std::string& server_identifier, |
91 uint32 serial_number, | |
92 int* error) { | 91 int* error) { |
93 scoped_ptr<ChannelIDStore::ChannelID> result; | 92 scoped_ptr<ChannelIDStore::ChannelID> result; |
94 | 93 |
95 base::TimeTicks start = base::TimeTicks::Now(); | 94 base::TimeTicks start = base::TimeTicks::Now(); |
96 base::Time not_valid_before = base::Time::Now(); | 95 base::Time not_valid_before = base::Time::Now(); |
97 base::Time not_valid_after = | 96 scoped_ptr<crypto::ECPrivateKey> key(crypto::ECPrivateKey::Create()); |
98 not_valid_before + base::TimeDelta::FromDays(kValidityPeriodInDays); | 97 |
99 std::string der_cert; | 98 if (!key.get()) { |
Ryan Sleevi
2015/04/09 22:40:09
if (!key)
nharper
2015/04/10 00:32:09
Done.
| |
100 std::vector<uint8> private_key_info; | 99 DLOG(ERROR) << "Unable to create channel ID key pair"; |
101 scoped_ptr<crypto::ECPrivateKey> key; | 100 *error = ERR_KEY_GENERATION_FAILED; |
102 if (!x509_util::CreateKeyAndChannelIDEC(server_identifier, | |
103 serial_number, | |
104 not_valid_before, | |
105 not_valid_after, | |
106 &key, | |
107 &der_cert)) { | |
108 DLOG(ERROR) << "Unable to create x509 cert for client"; | |
109 *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED; | |
110 return result.Pass(); | 101 return result.Pass(); |
111 } | 102 } |
112 | 103 |
113 if (!key->ExportEncryptedPrivateKey(ChannelIDService::kEPKIPassword, | 104 std::string private_key_out; |
114 1, &private_key_info)) { | 105 std::string public_key_out; |
115 DLOG(ERROR) << "Unable to export private key"; | 106 *error = ExportKeypair(key, &public_key_out, &private_key_out); |
116 *error = ERR_PRIVATE_KEY_EXPORT_FAILED; | 107 if (*error != OK) |
117 return result.Pass(); | 108 return result.Pass(); |
118 } | |
119 | |
120 // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a | |
121 // std::string* to prevent this copying. | |
122 std::string key_out(private_key_info.begin(), private_key_info.end()); | |
123 | 109 |
124 result.reset(new ChannelIDStore::ChannelID( | 110 result.reset(new ChannelIDStore::ChannelID( |
125 server_identifier, | 111 server_identifier, not_valid_before, private_key_out, public_key_out)); |
126 not_valid_before, | |
127 not_valid_after, | |
128 key_out, | |
129 der_cert)); | |
130 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime", | 112 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime", |
131 base::TimeTicks::Now() - start, | 113 base::TimeTicks::Now() - start, |
132 base::TimeDelta::FromMilliseconds(1), | 114 base::TimeDelta::FromMilliseconds(1), |
133 base::TimeDelta::FromMinutes(5), | 115 base::TimeDelta::FromMinutes(5), |
134 50); | 116 50); |
135 *error = OK; | 117 *error = OK; |
136 return result.Pass(); | 118 return result.Pass(); |
137 } | 119 } |
138 | 120 |
139 } // namespace | 121 } // namespace |
140 | 122 |
123 int CreateECPrivateKeyFromSerializedKey( | |
Ryan Sleevi
2015/04/09 22:40:09
return net::Error instead?
nharper
2015/04/10 00:32:09
The callsites of CreateECPrivateKey expect an int
Ryan Sleevi
2015/04/10 00:42:14
net::Error is just an enum that promotes to int. I
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
Still seems to be int?
| |
124 const std::string& public_key, | |
125 const std::string& private_key, | |
126 scoped_ptr<crypto::ECPrivateKey>* key_out) { | |
127 if (public_key.empty() || private_key.empty()) { | |
128 return ERR_UNEXPECTED; | |
129 } | |
Ryan Sleevi
2015/04/09 22:40:09
no braces
nharper
2015/04/10 00:32:09
Done.
| |
130 // crypto::ECPrivateKey expects std::vector<uint8> instead of std::string. | |
Ryan Sleevi
2015/04/09 22:40:09
newline + delete the comment
nharper
2015/04/10 00:32:09
Done.
| |
131 std::vector<uint8> public_key_vector(public_key.size()); | |
132 memcpy(&public_key_vector[0], public_key.data(), public_key.size()); | |
133 std::vector<uint8> private_key_vector(private_key.size()); | |
134 memcpy(&private_key_vector[0], private_key.data(), private_key.size()); | |
135 crypto::ECPrivateKey* key = | |
mattm
2015/04/10 01:00:27
make this a scoped_ptr or stick directly in key_ou
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
Doesn't seem to be done either. Did some changes g
nharper
2015/04/29 22:07:15
Some changes got dropped (I found them in my git s
| |
136 crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | |
137 ChannelIDService::kEPKIPassword, private_key_vector, | |
138 public_key_vector); | |
139 if (key == nullptr) | |
mattm
2015/04/10 01:00:27
if (!key)
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
same
| |
140 return ERR_UNEXPECTED; | |
141 key_out->reset(key); | |
142 return OK; | |
143 } | |
144 | |
145 int ExportKeypair(scoped_ptr<crypto::ECPrivateKey>& key, | |
146 std::string* public_key, | |
147 std::string* private_key) { | |
148 std::vector<uint8> public_key_vector; | |
149 std::vector<uint8> private_key_vector; | |
150 | |
151 if (!key.get()) | |
nharper
2015/04/10 00:32:09
I also changed this to if (!key)
| |
152 return ERR_UNEXPECTED; | |
153 | |
154 if (!key->ExportEncryptedPrivateKey(ChannelIDService::kEPKIPassword, 1, | |
155 &private_key_vector) || | |
156 !key->ExportPublicKey(&public_key_vector)) { | |
157 DLOG(ERROR) << "Unable to export key"; | |
158 return ERR_PRIVATE_KEY_EXPORT_FAILED; | |
159 } | |
160 | |
161 // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a | |
162 // std::string* to prevent this copying. | |
163 *public_key = std::string(public_key_vector.begin(), public_key_vector.end()); | |
164 *private_key = | |
165 std::string(private_key_vector.begin(), private_key_vector.end()); | |
166 return OK; | |
167 } | |
168 | |
141 // Represents the output and result callback of a request. | 169 // Represents the output and result callback of a request. |
142 class ChannelIDServiceRequest { | 170 class ChannelIDServiceRequest { |
143 public: | 171 public: |
144 ChannelIDServiceRequest(base::TimeTicks request_start, | 172 ChannelIDServiceRequest(base::TimeTicks request_start, |
145 const CompletionCallback& callback, | 173 const CompletionCallback& callback, |
146 std::string* private_key, | 174 scoped_ptr<crypto::ECPrivateKey>* key) |
147 std::string* cert) | 175 : request_start_(request_start), callback_(callback), key_(key) {} |
148 : request_start_(request_start), | |
149 callback_(callback), | |
150 private_key_(private_key), | |
151 cert_(cert) { | |
152 } | |
153 | 176 |
154 // Ensures that the result callback will never be made. | 177 // Ensures that the result callback will never be made. |
155 void Cancel() { | 178 void Cancel() { |
156 RecordGetChannelIDResult(ASYNC_CANCELLED); | 179 RecordGetChannelIDResult(ASYNC_CANCELLED); |
157 callback_.Reset(); | 180 callback_.Reset(); |
158 private_key_ = NULL; | 181 key_->reset(); |
159 cert_ = NULL; | |
160 } | 182 } |
161 | 183 |
162 // Copies the contents of |private_key| and |cert| to the caller's output | 184 // Copies the contents of |private_key| and |cert| to the caller's output |
163 // arguments and calls the callback. | 185 // arguments and calls the callback. |
164 void Post(int error, | 186 void Post(int error, |
165 const std::string& private_key, | 187 const std::string& private_key, |
166 const std::string& cert) { | 188 const std::string& public_key) { |
167 switch (error) { | 189 switch (error) { |
168 case OK: { | 190 case OK: { |
169 base::TimeDelta request_time = base::TimeTicks::Now() - request_start_; | 191 base::TimeDelta request_time = base::TimeTicks::Now() - request_start_; |
170 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTimeAsync", | 192 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTimeAsync", |
171 request_time, | 193 request_time, |
172 base::TimeDelta::FromMilliseconds(1), | 194 base::TimeDelta::FromMilliseconds(1), |
173 base::TimeDelta::FromMinutes(5), | 195 base::TimeDelta::FromMinutes(5), |
174 50); | 196 50); |
175 RecordGetChannelIDTime(request_time); | 197 RecordGetChannelIDTime(request_time); |
176 RecordGetChannelIDResult(ASYNC_SUCCESS); | 198 RecordGetChannelIDResult(ASYNC_SUCCESS); |
177 break; | 199 break; |
178 } | 200 } |
179 case ERR_KEY_GENERATION_FAILED: | 201 case ERR_KEY_GENERATION_FAILED: |
180 RecordGetChannelIDResult(ASYNC_FAILURE_KEYGEN); | 202 RecordGetChannelIDResult(ASYNC_FAILURE_KEYGEN); |
181 break; | 203 break; |
182 case ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED: | 204 case ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED: |
mattm
2015/04/10 01:00:27
Can remove this case.
Also "remove" ERR_ORIGIN_BO
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
same
| |
183 RecordGetChannelIDResult(ASYNC_FAILURE_CREATE_CERT); | 205 RecordGetChannelIDResult(ASYNC_FAILURE_CREATE_CERT); |
184 break; | 206 break; |
185 case ERR_PRIVATE_KEY_EXPORT_FAILED: | 207 case ERR_PRIVATE_KEY_EXPORT_FAILED: |
186 RecordGetChannelIDResult(ASYNC_FAILURE_EXPORT_KEY); | 208 RecordGetChannelIDResult(ASYNC_FAILURE_EXPORT_KEY); |
187 break; | 209 break; |
188 case ERR_INSUFFICIENT_RESOURCES: | 210 case ERR_INSUFFICIENT_RESOURCES: |
189 RecordGetChannelIDResult(WORKER_FAILURE); | 211 RecordGetChannelIDResult(WORKER_FAILURE); |
190 break; | 212 break; |
191 default: | 213 default: |
192 RecordGetChannelIDResult(ASYNC_FAILURE_UNKNOWN); | 214 RecordGetChannelIDResult(ASYNC_FAILURE_UNKNOWN); |
193 break; | 215 break; |
194 } | 216 } |
195 if (!callback_.is_null()) { | 217 if (!callback_.is_null()) { |
196 *private_key_ = private_key; | 218 int err = |
197 *cert_ = cert; | 219 CreateECPrivateKeyFromSerializedKey(public_key, private_key, key_); |
mattm
2015/04/10 01:00:27
Is there a reason to try this if error is not OK?
nharper
2015/04/25 02:59:18
If I don't call it when error is not OK, the unit
| |
220 if (error == OK && err != OK) { | |
mattm
2015/04/10 01:00:27
Having such similarly named variables is confusing
nharper
2015/04/25 02:59:18
Done.
| |
221 error = err; | |
222 } | |
Ryan Sleevi
2015/04/09 22:40:10
no braces
nharper
2015/04/10 00:32:09
Done.
| |
198 callback_.Run(error); | 223 callback_.Run(error); |
199 } | 224 } |
200 delete this; | 225 delete this; |
201 } | 226 } |
202 | 227 |
203 bool canceled() const { return callback_.is_null(); } | 228 bool canceled() const { return callback_.is_null(); } |
204 | 229 |
205 private: | 230 private: |
206 base::TimeTicks request_start_; | 231 base::TimeTicks request_start_; |
207 CompletionCallback callback_; | 232 CompletionCallback callback_; |
208 std::string* private_key_; | 233 scoped_ptr<crypto::ECPrivateKey>* key_; |
209 std::string* cert_; | |
210 }; | 234 }; |
211 | 235 |
212 // ChannelIDServiceWorker runs on a worker thread and takes care of the | 236 // ChannelIDServiceWorker runs on a worker thread and takes care of the |
213 // blocking process of performing key generation. Will take care of deleting | 237 // blocking process of performing key generation. Will take care of deleting |
214 // itself once Start() is called. | 238 // itself once Start() is called. |
215 class ChannelIDServiceWorker { | 239 class ChannelIDServiceWorker { |
216 public: | 240 public: |
217 typedef base::Callback<void( | 241 typedef base::Callback<void( |
218 const std::string&, | 242 const std::string&, |
219 int, | 243 int, |
220 scoped_ptr<ChannelIDStore::ChannelID>)> WorkerDoneCallback; | 244 scoped_ptr<ChannelIDStore::ChannelID>)> WorkerDoneCallback; |
221 | 245 |
222 ChannelIDServiceWorker( | 246 ChannelIDServiceWorker( |
223 const std::string& server_identifier, | 247 const std::string& server_identifier, |
224 const WorkerDoneCallback& callback) | 248 const WorkerDoneCallback& callback) |
225 : server_identifier_(server_identifier), | 249 : server_identifier_(server_identifier), |
226 serial_number_(base::RandInt(0, std::numeric_limits<int>::max())), | |
227 origin_loop_(base::MessageLoopProxy::current()), | 250 origin_loop_(base::MessageLoopProxy::current()), |
228 callback_(callback) { | 251 callback_(callback) { |
229 } | 252 } |
230 | 253 |
231 // Starts the worker on |task_runner|. If the worker fails to start, such as | 254 // Starts the worker on |task_runner|. If the worker fails to start, such as |
232 // if the task runner is shutting down, then it will take care of deleting | 255 // if the task runner is shutting down, then it will take care of deleting |
233 // itself. | 256 // itself. |
234 bool Start(const scoped_refptr<base::TaskRunner>& task_runner) { | 257 bool Start(const scoped_refptr<base::TaskRunner>& task_runner) { |
235 DCHECK(origin_loop_->RunsTasksOnCurrentThread()); | 258 DCHECK(origin_loop_->RunsTasksOnCurrentThread()); |
236 | 259 |
237 return task_runner->PostTask( | 260 return task_runner->PostTask( |
238 FROM_HERE, | 261 FROM_HERE, |
239 base::Bind(&ChannelIDServiceWorker::Run, base::Owned(this))); | 262 base::Bind(&ChannelIDServiceWorker::Run, base::Owned(this))); |
240 } | 263 } |
241 | 264 |
242 private: | 265 private: |
243 void Run() { | 266 void Run() { |
244 // Runs on a worker thread. | 267 // Runs on a worker thread. |
245 int error = ERR_FAILED; | 268 int error = ERR_FAILED; |
246 scoped_ptr<ChannelIDStore::ChannelID> cert = | 269 scoped_ptr<ChannelIDStore::ChannelID> cert = |
247 GenerateChannelID(server_identifier_, serial_number_, &error); | 270 GenerateChannelID(server_identifier_, &error); |
248 DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error; | 271 DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error; |
249 #if defined(USE_NSS) | 272 #if defined(USE_NSS) |
250 // Detach the thread from NSPR. | 273 // Detach the thread from NSPR. |
251 // Calling NSS functions attaches the thread to NSPR, which stores | 274 // Calling NSS functions attaches the thread to NSPR, which stores |
252 // the NSPR thread ID in thread-specific data. | 275 // the NSPR thread ID in thread-specific data. |
253 // The threads in our thread pool terminate after we have called | 276 // The threads in our thread pool terminate after we have called |
254 // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets | 277 // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets |
255 // segfaults on shutdown when the threads' thread-specific data | 278 // segfaults on shutdown when the threads' thread-specific data |
256 // destructors run. | 279 // destructors run. |
257 PR_DetachThread(); | 280 PR_DetachThread(); |
258 #endif | 281 #endif |
259 origin_loop_->PostTask(FROM_HERE, | 282 origin_loop_->PostTask(FROM_HERE, |
260 base::Bind(callback_, server_identifier_, error, | 283 base::Bind(callback_, server_identifier_, error, |
261 base::Passed(&cert))); | 284 base::Passed(&cert))); |
262 } | 285 } |
263 | 286 |
264 const std::string server_identifier_; | 287 const std::string server_identifier_; |
265 // Note that serial_number_ must be initialized on a non-worker thread | |
266 // (see documentation for GenerateCert). | |
267 uint32 serial_number_; | |
268 scoped_refptr<base::SequencedTaskRunner> origin_loop_; | 288 scoped_refptr<base::SequencedTaskRunner> origin_loop_; |
269 WorkerDoneCallback callback_; | 289 WorkerDoneCallback callback_; |
270 | 290 |
271 DISALLOW_COPY_AND_ASSIGN(ChannelIDServiceWorker); | 291 DISALLOW_COPY_AND_ASSIGN(ChannelIDServiceWorker); |
272 }; | 292 }; |
273 | 293 |
274 // A ChannelIDServiceJob is a one-to-one counterpart of an | 294 // A ChannelIDServiceJob is a one-to-one counterpart of an |
275 // ChannelIDServiceWorker. It lives only on the ChannelIDService's | 295 // ChannelIDServiceWorker. It lives only on the ChannelIDService's |
276 // origin message loop. | 296 // origin message loop. |
277 class ChannelIDServiceJob { | 297 class ChannelIDServiceJob { |
278 public: | 298 public: |
279 ChannelIDServiceJob(bool create_if_missing) | 299 ChannelIDServiceJob(bool create_if_missing) |
280 : create_if_missing_(create_if_missing) { | 300 : create_if_missing_(create_if_missing) { |
281 } | 301 } |
282 | 302 |
283 ~ChannelIDServiceJob() { | 303 ~ChannelIDServiceJob() { |
284 if (!requests_.empty()) | 304 if (!requests_.empty()) |
285 DeleteAllCanceled(); | 305 DeleteAllCanceled(); |
286 } | 306 } |
287 | 307 |
288 void AddRequest(ChannelIDServiceRequest* request, | 308 void AddRequest(ChannelIDServiceRequest* request, |
289 bool create_if_missing = false) { | 309 bool create_if_missing = false) { |
290 create_if_missing_ |= create_if_missing; | 310 create_if_missing_ |= create_if_missing; |
291 requests_.push_back(request); | 311 requests_.push_back(request); |
292 } | 312 } |
293 | 313 |
294 void HandleResult(int error, | 314 void HandleResult(int error, |
295 const std::string& private_key, | 315 const std::string& private_key, |
296 const std::string& cert) { | 316 const std::string& public_key) { |
297 PostAll(error, private_key, cert); | 317 PostAll(error, private_key, public_key); |
298 } | 318 } |
299 | 319 |
300 bool CreateIfMissing() const { return create_if_missing_; } | 320 bool CreateIfMissing() const { return create_if_missing_; } |
301 | 321 |
302 private: | 322 private: |
303 void PostAll(int error, | 323 void PostAll(int error, |
304 const std::string& private_key, | 324 const std::string& private_key, |
305 const std::string& cert) { | 325 const std::string& public_key) { |
306 std::vector<ChannelIDServiceRequest*> requests; | 326 std::vector<ChannelIDServiceRequest*> requests; |
307 requests_.swap(requests); | 327 requests_.swap(requests); |
308 | 328 |
309 for (std::vector<ChannelIDServiceRequest*>::iterator | 329 for (std::vector<ChannelIDServiceRequest*>::iterator |
310 i = requests.begin(); i != requests.end(); i++) { | 330 i = requests.begin(); i != requests.end(); i++) { |
311 (*i)->Post(error, private_key, cert); | 331 (*i)->Post(error, private_key, public_key); |
312 // Post() causes the ChannelIDServiceRequest to delete itself. | 332 // Post() causes the ChannelIDServiceRequest to delete itself. |
313 } | 333 } |
314 } | 334 } |
315 | 335 |
316 void DeleteAllCanceled() { | 336 void DeleteAllCanceled() { |
317 for (std::vector<ChannelIDServiceRequest*>::iterator | 337 for (std::vector<ChannelIDServiceRequest*>::iterator |
318 i = requests_.begin(); i != requests_.end(); i++) { | 338 i = requests_.begin(); i != requests_.end(); i++) { |
319 if ((*i)->canceled()) { | 339 if ((*i)->canceled()) { |
320 delete *i; | 340 delete *i; |
321 } else { | 341 } else { |
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
363 // members afterwards. Reset callback_ first. | 383 // members afterwards. Reset callback_ first. |
364 base::ResetAndReturn(&callback_).Run(result); | 384 base::ResetAndReturn(&callback_).Run(result); |
365 } | 385 } |
366 | 386 |
367 ChannelIDService::ChannelIDService( | 387 ChannelIDService::ChannelIDService( |
368 ChannelIDStore* channel_id_store, | 388 ChannelIDStore* channel_id_store, |
369 const scoped_refptr<base::TaskRunner>& task_runner) | 389 const scoped_refptr<base::TaskRunner>& task_runner) |
370 : channel_id_store_(channel_id_store), | 390 : channel_id_store_(channel_id_store), |
371 task_runner_(task_runner), | 391 task_runner_(task_runner), |
372 requests_(0), | 392 requests_(0), |
373 cert_store_hits_(0), | 393 key_store_hits_(0), |
374 inflight_joins_(0), | 394 inflight_joins_(0), |
375 workers_created_(0), | 395 workers_created_(0), |
376 weak_ptr_factory_(this) { | 396 weak_ptr_factory_(this) { |
377 base::Time start = base::Time::Now(); | 397 base::Time start = base::Time::Now(); |
378 base::Time end = start + base::TimeDelta::FromDays( | 398 base::Time end = start + base::TimeDelta::FromDays( |
379 kValidityPeriodInDays + kSystemTimeValidityBufferInDays); | 399 kValidityPeriodInDays + kSystemTimeValidityBufferInDays); |
380 is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end); | 400 is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end); |
381 } | 401 } |
382 | 402 |
383 ChannelIDService::~ChannelIDService() { | 403 ChannelIDService::~ChannelIDService() { |
384 STLDeleteValues(&inflight_); | 404 STLDeleteValues(&inflight_); |
385 } | 405 } |
386 | 406 |
387 //static | 407 //static |
388 std::string ChannelIDService::GetDomainForHost(const std::string& host) { | 408 std::string ChannelIDService::GetDomainForHost(const std::string& host) { |
389 std::string domain = | 409 std::string domain = |
390 registry_controlled_domains::GetDomainAndRegistry( | 410 registry_controlled_domains::GetDomainAndRegistry( |
391 host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); | 411 host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); |
392 if (domain.empty()) | 412 if (domain.empty()) |
393 return host; | 413 return host; |
394 return domain; | 414 return domain; |
395 } | 415 } |
396 | 416 |
397 int ChannelIDService::GetOrCreateChannelID( | 417 int ChannelIDService::GetOrCreateChannelID( |
398 const std::string& host, | 418 const std::string& host, |
399 std::string* private_key, | 419 scoped_ptr<crypto::ECPrivateKey>* key, |
400 std::string* cert, | |
401 const CompletionCallback& callback, | 420 const CompletionCallback& callback, |
402 RequestHandle* out_req) { | 421 RequestHandle* out_req) { |
403 DVLOG(1) << __FUNCTION__ << " " << host; | 422 DVLOG(1) << __FUNCTION__ << " " << host; |
404 DCHECK(CalledOnValidThread()); | 423 DCHECK(CalledOnValidThread()); |
405 base::TimeTicks request_start = base::TimeTicks::Now(); | 424 base::TimeTicks request_start = base::TimeTicks::Now(); |
406 | 425 |
407 if (callback.is_null() || !private_key || !cert || host.empty()) { | 426 if (callback.is_null() || !key || host.empty()) { |
408 RecordGetChannelIDResult(INVALID_ARGUMENT); | 427 RecordGetChannelIDResult(INVALID_ARGUMENT); |
409 return ERR_INVALID_ARGUMENT; | 428 return ERR_INVALID_ARGUMENT; |
410 } | 429 } |
411 | 430 |
412 std::string domain = GetDomainForHost(host); | 431 std::string domain = GetDomainForHost(host); |
413 if (domain.empty()) { | 432 if (domain.empty()) { |
414 RecordGetChannelIDResult(INVALID_ARGUMENT); | 433 RecordGetChannelIDResult(INVALID_ARGUMENT); |
415 return ERR_INVALID_ARGUMENT; | 434 return ERR_INVALID_ARGUMENT; |
416 } | 435 } |
417 | 436 |
418 requests_++; | 437 requests_++; |
419 | 438 |
439 std::string public_key; | |
440 std::string private_key; | |
mattm
2015/04/10 01:00:27
these are unused
nharper
2015/04/25 02:59:18
Done.
| |
441 | |
420 // See if a request for the same domain is currently in flight. | 442 // See if a request for the same domain is currently in flight. |
421 bool create_if_missing = true; | 443 bool create_if_missing = true; |
422 if (JoinToInFlightRequest(request_start, domain, private_key, cert, | 444 if (JoinToInFlightRequest(request_start, domain, key, create_if_missing, |
423 create_if_missing, callback, out_req)) { | 445 callback, out_req)) { |
424 return ERR_IO_PENDING; | 446 return ERR_IO_PENDING; |
425 } | 447 } |
426 | 448 |
427 int err = LookupChannelID(request_start, domain, private_key, cert, | 449 int err = LookupChannelID(request_start, domain, key, create_if_missing, |
428 create_if_missing, callback, out_req); | 450 callback, out_req); |
429 if (err == ERR_FILE_NOT_FOUND) { | 451 if (err == ERR_FILE_NOT_FOUND) { |
430 // Sync lookup did not find a valid cert. Start generating a new one. | 452 // Sync lookup did not find a valid cert. Start generating a new one. |
431 workers_created_++; | 453 workers_created_++; |
432 ChannelIDServiceWorker* worker = new ChannelIDServiceWorker( | 454 ChannelIDServiceWorker* worker = new ChannelIDServiceWorker( |
433 domain, | 455 domain, |
434 base::Bind(&ChannelIDService::GeneratedChannelID, | 456 base::Bind(&ChannelIDService::GeneratedChannelID, |
435 weak_ptr_factory_.GetWeakPtr())); | 457 weak_ptr_factory_.GetWeakPtr())); |
436 if (!worker->Start(task_runner_)) { | 458 if (!worker->Start(task_runner_)) { |
437 // TODO(rkn): Log to the NetLog. | 459 // TODO(rkn): Log to the NetLog. |
438 LOG(ERROR) << "ChannelIDServiceWorker couldn't be started."; | 460 LOG(ERROR) << "ChannelIDServiceWorker couldn't be started."; |
439 RecordGetChannelIDResult(WORKER_FAILURE); | 461 RecordGetChannelIDResult(WORKER_FAILURE); |
440 return ERR_INSUFFICIENT_RESOURCES; | 462 return ERR_INSUFFICIENT_RESOURCES; |
441 } | 463 } |
442 // We are waiting for cert generation. Create a job & request to track it. | 464 // We are waiting for cert generation. Create a job & request to track it. |
443 ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing); | 465 ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing); |
444 inflight_[domain] = job; | 466 inflight_[domain] = job; |
445 | 467 |
446 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( | 468 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( |
447 request_start, | 469 request_start, base::Bind(&RequestHandle::OnRequestComplete, |
448 base::Bind(&RequestHandle::OnRequestComplete, | 470 base::Unretained(out_req)), |
449 base::Unretained(out_req)), | 471 key); |
450 private_key, | |
451 cert); | |
452 job->AddRequest(request); | 472 job->AddRequest(request); |
453 out_req->RequestStarted(this, request, callback); | 473 out_req->RequestStarted(this, request, callback); |
454 return ERR_IO_PENDING; | 474 return ERR_IO_PENDING; |
455 } | 475 } |
456 | 476 |
457 return err; | 477 return err; |
458 } | 478 } |
459 | 479 |
460 int ChannelIDService::GetChannelID( | 480 int ChannelIDService::GetChannelID(const std::string& host, |
461 const std::string& host, | 481 scoped_ptr<crypto::ECPrivateKey>* key, |
462 std::string* private_key, | 482 const CompletionCallback& callback, |
463 std::string* cert, | 483 RequestHandle* out_req) { |
464 const CompletionCallback& callback, | |
465 RequestHandle* out_req) { | |
466 DVLOG(1) << __FUNCTION__ << " " << host; | 484 DVLOG(1) << __FUNCTION__ << " " << host; |
467 DCHECK(CalledOnValidThread()); | 485 DCHECK(CalledOnValidThread()); |
468 base::TimeTicks request_start = base::TimeTicks::Now(); | 486 base::TimeTicks request_start = base::TimeTicks::Now(); |
469 | 487 |
470 if (callback.is_null() || !private_key || !cert || host.empty()) { | 488 if (callback.is_null() || !key || host.empty()) { |
471 RecordGetChannelIDResult(INVALID_ARGUMENT); | 489 RecordGetChannelIDResult(INVALID_ARGUMENT); |
472 return ERR_INVALID_ARGUMENT; | 490 return ERR_INVALID_ARGUMENT; |
473 } | 491 } |
474 | 492 |
475 std::string domain = GetDomainForHost(host); | 493 std::string domain = GetDomainForHost(host); |
476 if (domain.empty()) { | 494 if (domain.empty()) { |
477 RecordGetChannelIDResult(INVALID_ARGUMENT); | 495 RecordGetChannelIDResult(INVALID_ARGUMENT); |
478 return ERR_INVALID_ARGUMENT; | 496 return ERR_INVALID_ARGUMENT; |
479 } | 497 } |
480 | 498 |
481 requests_++; | 499 requests_++; |
482 | 500 |
483 // See if a request for the same domain currently in flight. | 501 // See if a request for the same domain currently in flight. |
484 bool create_if_missing = false; | 502 bool create_if_missing = false; |
485 if (JoinToInFlightRequest(request_start, domain, private_key, cert, | 503 if (JoinToInFlightRequest(request_start, domain, key, create_if_missing, |
486 create_if_missing, callback, out_req)) { | 504 callback, out_req)) { |
487 return ERR_IO_PENDING; | 505 return ERR_IO_PENDING; |
488 } | 506 } |
489 | 507 |
490 int err = LookupChannelID(request_start, domain, private_key, cert, | 508 int err = LookupChannelID(request_start, domain, key, create_if_missing, |
491 create_if_missing, callback, out_req); | 509 callback, out_req); |
492 return err; | 510 return err; |
493 } | 511 } |
494 | 512 |
495 void ChannelIDService::GotChannelID( | 513 void ChannelIDService::GotChannelID(int err, |
496 int err, | 514 const std::string& server_identifier, |
497 const std::string& server_identifier, | 515 const std::string& private_key, |
498 base::Time expiration_time, | 516 const std::string& public_key) { |
499 const std::string& key, | |
500 const std::string& cert) { | |
501 DCHECK(CalledOnValidThread()); | 517 DCHECK(CalledOnValidThread()); |
502 | 518 |
503 std::map<std::string, ChannelIDServiceJob*>::iterator j; | 519 std::map<std::string, ChannelIDServiceJob*>::iterator j; |
504 j = inflight_.find(server_identifier); | 520 j = inflight_.find(server_identifier); |
505 if (j == inflight_.end()) { | 521 if (j == inflight_.end()) { |
506 NOTREACHED(); | 522 NOTREACHED(); |
507 return; | 523 return; |
508 } | 524 } |
509 | 525 |
510 if (err == OK) { | 526 if (err == OK) { |
511 // Async DB lookup found a valid cert. | 527 // Async DB lookup found a valid cert. |
512 DVLOG(1) << "Cert store had valid cert for " << server_identifier; | 528 DVLOG(1) << "Cert store had valid key for " << server_identifier; |
513 cert_store_hits_++; | 529 key_store_hits_++; |
514 // ChannelIDServiceRequest::Post will do the histograms and stuff. | 530 // ChannelIDServiceRequest::Post will do the histograms and stuff. |
515 HandleResult(OK, server_identifier, key, cert); | 531 HandleResult(OK, server_identifier, private_key, public_key); |
516 return; | 532 return; |
517 } | 533 } |
518 // Async lookup failed or the certificate was missing. Return the error | 534 // Async lookup failed or the certificate was missing. Return the error |
519 // directly, unless the certificate was missing and a request asked to create | 535 // directly, unless the certificate was missing and a request asked to create |
520 // one. | 536 // one. |
521 if (err != ERR_FILE_NOT_FOUND || !j->second->CreateIfMissing()) { | 537 if (err != ERR_FILE_NOT_FOUND || !j->second->CreateIfMissing()) { |
522 HandleResult(err, server_identifier, key, cert); | 538 HandleResult(err, server_identifier, private_key, public_key); |
523 return; | 539 return; |
524 } | 540 } |
525 // At least one request asked to create a cert => start generating a new one. | 541 // At least one request asked to create a cert => start generating a new one. |
526 workers_created_++; | 542 workers_created_++; |
527 ChannelIDServiceWorker* worker = new ChannelIDServiceWorker( | 543 ChannelIDServiceWorker* worker = new ChannelIDServiceWorker( |
528 server_identifier, | 544 server_identifier, |
529 base::Bind(&ChannelIDService::GeneratedChannelID, | 545 base::Bind(&ChannelIDService::GeneratedChannelID, |
530 weak_ptr_factory_.GetWeakPtr())); | 546 weak_ptr_factory_.GetWeakPtr())); |
531 if (!worker->Start(task_runner_)) { | 547 if (!worker->Start(task_runner_)) { |
532 // TODO(rkn): Log to the NetLog. | 548 // TODO(rkn): Log to the NetLog. |
(...skipping 16 matching lines...) Expand all Loading... | |
549 | 565 |
550 void ChannelIDService::GeneratedChannelID( | 566 void ChannelIDService::GeneratedChannelID( |
551 const std::string& server_identifier, | 567 const std::string& server_identifier, |
552 int error, | 568 int error, |
553 scoped_ptr<ChannelIDStore::ChannelID> cert) { | 569 scoped_ptr<ChannelIDStore::ChannelID> cert) { |
554 DCHECK(CalledOnValidThread()); | 570 DCHECK(CalledOnValidThread()); |
555 | 571 |
556 if (error == OK) { | 572 if (error == OK) { |
557 // TODO(mattm): we should just Pass() the cert object to | 573 // TODO(mattm): we should just Pass() the cert object to |
558 // SetChannelID(). | 574 // SetChannelID(). |
559 channel_id_store_->SetChannelID( | 575 channel_id_store_->SetChannelID(cert->server_identifier(), |
560 cert->server_identifier(), | 576 cert->creation_time(), cert->private_key(), |
561 cert->creation_time(), | 577 cert->public_key()); |
562 cert->expiration_time(), | |
563 cert->private_key(), | |
564 cert->cert()); | |
565 | 578 |
566 HandleResult(error, server_identifier, cert->private_key(), cert->cert()); | 579 HandleResult(error, server_identifier, cert->private_key(), |
580 cert->public_key()); | |
567 } else { | 581 } else { |
568 HandleResult(error, server_identifier, std::string(), std::string()); | 582 HandleResult(error, server_identifier, std::string(), std::string()); |
569 } | 583 } |
570 } | 584 } |
571 | 585 |
572 void ChannelIDService::HandleResult( | 586 void ChannelIDService::HandleResult(int error, |
573 int error, | 587 const std::string& server_identifier, |
574 const std::string& server_identifier, | 588 const std::string& private_key, |
575 const std::string& private_key, | 589 const std::string& public_key) { |
576 const std::string& cert) { | |
577 DCHECK(CalledOnValidThread()); | 590 DCHECK(CalledOnValidThread()); |
578 | 591 |
579 std::map<std::string, ChannelIDServiceJob*>::iterator j; | 592 std::map<std::string, ChannelIDServiceJob*>::iterator j; |
580 j = inflight_.find(server_identifier); | 593 j = inflight_.find(server_identifier); |
581 if (j == inflight_.end()) { | 594 if (j == inflight_.end()) { |
582 NOTREACHED(); | 595 NOTREACHED(); |
583 return; | 596 return; |
584 } | 597 } |
585 ChannelIDServiceJob* job = j->second; | 598 ChannelIDServiceJob* job = j->second; |
586 inflight_.erase(j); | 599 inflight_.erase(j); |
587 | 600 |
588 job->HandleResult(error, private_key, cert); | 601 job->HandleResult(error, private_key, public_key); |
589 delete job; | 602 delete job; |
590 } | 603 } |
591 | 604 |
592 bool ChannelIDService::JoinToInFlightRequest( | 605 bool ChannelIDService::JoinToInFlightRequest( |
593 const base::TimeTicks& request_start, | 606 const base::TimeTicks& request_start, |
594 const std::string& domain, | 607 const std::string& domain, |
595 std::string* private_key, | 608 scoped_ptr<crypto::ECPrivateKey>* key, |
596 std::string* cert, | |
597 bool create_if_missing, | 609 bool create_if_missing, |
598 const CompletionCallback& callback, | 610 const CompletionCallback& callback, |
599 RequestHandle* out_req) { | 611 RequestHandle* out_req) { |
600 ChannelIDServiceJob* job = NULL; | 612 ChannelIDServiceJob* job = NULL; |
601 std::map<std::string, ChannelIDServiceJob*>::const_iterator j = | 613 std::map<std::string, ChannelIDServiceJob*>::const_iterator j = |
602 inflight_.find(domain); | 614 inflight_.find(domain); |
603 if (j != inflight_.end()) { | 615 if (j != inflight_.end()) { |
604 // A request for the same domain is in flight already. We'll attach our | 616 // A request for the same domain is in flight already. We'll attach our |
605 // callback, but we'll also mark it as requiring a cert if one's mising. | 617 // callback, but we'll also mark it as requiring a cert if one's mising. |
606 job = j->second; | 618 job = j->second; |
607 inflight_joins_++; | 619 inflight_joins_++; |
608 | 620 |
609 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( | 621 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( |
610 request_start, | 622 request_start, base::Bind(&RequestHandle::OnRequestComplete, |
611 base::Bind(&RequestHandle::OnRequestComplete, | 623 base::Unretained(out_req)), |
612 base::Unretained(out_req)), | 624 key); |
613 private_key, | |
614 cert); | |
615 job->AddRequest(request, create_if_missing); | 625 job->AddRequest(request, create_if_missing); |
616 out_req->RequestStarted(this, request, callback); | 626 out_req->RequestStarted(this, request, callback); |
617 return true; | 627 return true; |
618 } | 628 } |
619 return false; | 629 return false; |
620 } | 630 } |
621 | 631 |
622 int ChannelIDService::LookupChannelID( | 632 int ChannelIDService::LookupChannelID(const base::TimeTicks& request_start, |
623 const base::TimeTicks& request_start, | 633 const std::string& domain, |
624 const std::string& domain, | 634 scoped_ptr<crypto::ECPrivateKey>* key, |
625 std::string* private_key, | 635 bool create_if_missing, |
626 std::string* cert, | 636 const CompletionCallback& callback, |
627 bool create_if_missing, | 637 RequestHandle* out_req) { |
628 const CompletionCallback& callback, | |
629 RequestHandle* out_req) { | |
630 // Check if a domain bound cert already exists for this domain. Note that | 638 // Check if a domain bound cert already exists for this domain. Note that |
631 // |expiration_time| is ignored, and expired certs are considered valid. | 639 // |expiration_time| is ignored, and expired certs are considered valid. |
mattm
2015/04/10 01:00:27
update comment
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
same
| |
632 base::Time expiration_time; | 640 std::string public_key; |
641 std::string private_key; | |
633 int err = channel_id_store_->GetChannelID( | 642 int err = channel_id_store_->GetChannelID( |
634 domain, | 643 domain, &private_key, &public_key, |
635 &expiration_time /* ignored */, | |
636 private_key, | |
637 cert, | |
638 base::Bind(&ChannelIDService::GotChannelID, | 644 base::Bind(&ChannelIDService::GotChannelID, |
639 weak_ptr_factory_.GetWeakPtr())); | 645 weak_ptr_factory_.GetWeakPtr())); |
640 | 646 |
641 if (err == OK) { | 647 if (err == OK) { |
648 err = CreateECPrivateKeyFromSerializedKey(public_key, private_key, key); | |
649 if (err != OK) { | |
650 return err; | |
651 } | |
mattm
2015/04/10 01:00:27
no braces
nharper
2015/04/25 02:59:18
Done.
mattm
2015/04/27 20:55:53
same
| |
642 // Sync lookup found a valid cert. | 652 // Sync lookup found a valid cert. |
643 DVLOG(1) << "Cert store had valid cert for " << domain; | 653 DVLOG(1) << "Cert store had valid key for " << domain; |
644 cert_store_hits_++; | 654 key_store_hits_++; |
645 RecordGetChannelIDResult(SYNC_SUCCESS); | 655 RecordGetChannelIDResult(SYNC_SUCCESS); |
646 base::TimeDelta request_time = base::TimeTicks::Now() - request_start; | 656 base::TimeDelta request_time = base::TimeTicks::Now() - request_start; |
647 UMA_HISTOGRAM_TIMES("DomainBoundCerts.GetCertTimeSync", request_time); | 657 UMA_HISTOGRAM_TIMES("DomainBoundCerts.GetCertTimeSync", request_time); |
648 RecordGetChannelIDTime(request_time); | 658 RecordGetChannelIDTime(request_time); |
649 return OK; | 659 return OK; |
650 } | 660 } |
651 | 661 |
652 if (err == ERR_IO_PENDING) { | 662 if (err == ERR_IO_PENDING) { |
653 // We are waiting for async DB lookup. Create a job & request to track it. | 663 // We are waiting for async DB lookup. Create a job & request to track it. |
654 ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing); | 664 ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing); |
655 inflight_[domain] = job; | 665 inflight_[domain] = job; |
656 | 666 |
657 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( | 667 ChannelIDServiceRequest* request = new ChannelIDServiceRequest( |
658 request_start, | 668 request_start, base::Bind(&RequestHandle::OnRequestComplete, |
659 base::Bind(&RequestHandle::OnRequestComplete, | 669 base::Unretained(out_req)), |
660 base::Unretained(out_req)), | 670 key); |
661 private_key, | |
662 cert); | |
663 job->AddRequest(request); | 671 job->AddRequest(request); |
664 out_req->RequestStarted(this, request, callback); | 672 out_req->RequestStarted(this, request, callback); |
665 return ERR_IO_PENDING; | 673 return ERR_IO_PENDING; |
666 } | 674 } |
667 | 675 |
668 return err; | 676 return err; |
669 } | 677 } |
670 | 678 |
671 int ChannelIDService::cert_count() { | 679 int ChannelIDService::cert_count() { |
672 return channel_id_store_->GetChannelIDCount(); | 680 return channel_id_store_->GetChannelIDCount(); |
673 } | 681 } |
674 | 682 |
675 } // namespace net | 683 } // namespace net |
OLD | NEW |