OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_SSL_CHANNEL_ID_SERVICE_H_ | 5 #ifndef NET_SSL_CHANNEL_ID_SERVICE_H_ |
6 #define NET_SSL_CHANNEL_ID_SERVICE_H_ | 6 #define NET_SSL_CHANNEL_ID_SERVICE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/basictypes.h" | 12 #include "base/basictypes.h" |
13 #include "base/memory/scoped_ptr.h" | 13 #include "base/memory/scoped_ptr.h" |
14 #include "base/memory/weak_ptr.h" | 14 #include "base/memory/weak_ptr.h" |
15 #include "base/threading/non_thread_safe.h" | 15 #include "base/threading/non_thread_safe.h" |
16 #include "base/time/time.h" | 16 #include "base/time/time.h" |
17 #include "net/base/completion_callback.h" | 17 #include "net/base/completion_callback.h" |
18 #include "net/base/net_errors.h" | |
Ryan Sleevi
2015/05/08 23:43:14
unused?
nharper
2015/05/11 21:26:44
Done.
| |
18 #include "net/base/net_export.h" | 19 #include "net/base/net_export.h" |
19 #include "net/ssl/channel_id_store.h" | 20 #include "net/ssl/channel_id_store.h" |
20 | 21 |
21 namespace base { | 22 namespace base { |
22 class TaskRunner; | 23 class TaskRunner; |
23 } | 24 } |
24 | 25 |
26 namespace crypto { | |
27 class ECPrivateKey; | |
28 } | |
Ryan Sleevi
2015/05/08 23:43:14
} // crypto
(and also line 24)
Style pedantry a
nharper
2015/05/11 21:26:44
Actually, it's
} // namespace crypto
| |
29 | |
25 namespace net { | 30 namespace net { |
26 | 31 |
27 class ChannelIDServiceJob; | 32 class ChannelIDServiceJob; |
28 class ChannelIDServiceRequest; | 33 class ChannelIDServiceRequest; |
29 class ChannelIDServiceWorker; | 34 class ChannelIDServiceWorker; |
30 | 35 |
31 // A class for creating and fetching domain bound certs. They are used | 36 // A class for creating and fetching domain bound certs. They are used |
32 // to identify users' machines; their public keys are used as channel IDs in | 37 // to identify users' machines; their public keys are used as channel IDs in |
33 // http://tools.ietf.org/html/draft-balfanz-tls-channelid-00. | 38 // http://tools.ietf.org/html/draft-balfanz-tls-channelid-00. |
34 // As a result although certs are set to be invalid after one year, we don't | 39 // As a result although certs are set to be invalid after one year, we don't |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
78 ChannelIDStore* channel_id_store, | 83 ChannelIDStore* channel_id_store, |
79 const scoped_refptr<base::TaskRunner>& task_runner); | 84 const scoped_refptr<base::TaskRunner>& task_runner); |
80 | 85 |
81 ~ChannelIDService(); | 86 ~ChannelIDService(); |
82 | 87 |
83 // Returns the domain to be used for |host|. The domain is the | 88 // Returns the domain to be used for |host|. The domain is the |
84 // "registry controlled domain", or the "ETLD + 1" where one exists, or | 89 // "registry controlled domain", or the "ETLD + 1" where one exists, or |
85 // the origin otherwise. | 90 // the origin otherwise. |
86 static std::string GetDomainForHost(const std::string& host); | 91 static std::string GetDomainForHost(const std::string& host); |
87 | 92 |
88 // Tests whether the system time is within the supported range for | |
89 // certificate generation. This value is cached when ChannelIDService | |
90 // is created, so if the system time is changed by a huge amount, this may no | |
91 // longer hold. | |
92 bool IsSystemTimeValid() const { return is_system_time_valid_; } | |
93 | |
94 // Fetches the domain bound cert for the specified host if one exists and | 93 // Fetches the domain bound cert for the specified host if one exists and |
95 // creates one otherwise. Returns OK if successful or an error code upon | 94 // creates one otherwise. Returns OK if successful or an error code upon |
96 // failure. | 95 // failure. |
97 // | 96 // |
98 // On successful completion, |private_key| stores a DER-encoded | 97 // On successful completion, |key| holds the ECDSA keypair used for this |
99 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 98 // channel ID. |
100 // The PrivateKeyInfo is always an ECDSA private key. | |
101 // | 99 // |
102 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 100 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
103 // could not be completed immediately, in which case the result code will | 101 // could not be completed immediately, in which case the result code will |
104 // be passed to the callback when available. | 102 // be passed to the callback when available. |
105 // | 103 // |
106 // |*out_req| will be initialized with a handle to the async request. This | 104 // |*out_req| will be initialized with a handle to the async request. This |
107 // RequestHandle object must be cancelled or destroyed before the | 105 // RequestHandle object must be cancelled or destroyed before the |
108 // ChannelIDService is destroyed. | 106 // ChannelIDService is destroyed. |
109 int GetOrCreateChannelID( | 107 int GetOrCreateChannelID(const std::string& host, |
110 const std::string& host, | 108 scoped_ptr<crypto::ECPrivateKey>* key, |
111 std::string* private_key, | 109 const CompletionCallback& callback, |
112 std::string* cert, | 110 RequestHandle* out_req); |
113 const CompletionCallback& callback, | |
114 RequestHandle* out_req); | |
115 | 111 |
116 // Fetches the domain bound cert for the specified host if one exists. | 112 // Fetches the domain bound cert for the specified host if one exists. |
117 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error | 113 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error |
118 // code upon failure. | 114 // code upon failure. |
119 // | 115 // |
120 // On successful completion, |private_key| stores a DER-encoded | 116 // On successful completion, |key| holds the ECDSA keypair used for this |
121 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 117 // channel ID. |
122 // The PrivateKeyInfo is always an ECDSA private key. | |
123 // | 118 // |
124 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 119 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
125 // could not be completed immediately, in which case the result code will | 120 // could not be completed immediately, in which case the result code will |
126 // be passed to the callback when available. If an in-flight | 121 // be passed to the callback when available. If an in-flight |
127 // GetChannelID is pending, and a new GetOrCreateDomainBoundCert | 122 // GetChannelID is pending, and a new GetOrCreateDomainBoundCert |
128 // request arrives for the same domain, the GetChannelID request will | 123 // request arrives for the same domain, the GetChannelID request will |
129 // not complete until a new cert is created. | 124 // not complete until a new cert is created. |
130 // | 125 // |
131 // |*out_req| will be initialized with a handle to the async request. This | 126 // |*out_req| will be initialized with a handle to the async request. This |
132 // RequestHandle object must be cancelled or destroyed before the | 127 // RequestHandle object must be cancelled or destroyed before the |
133 // ChannelIDService is destroyed. | 128 // ChannelIDService is destroyed. |
134 int GetChannelID( | 129 int GetChannelID(const std::string& host, |
135 const std::string& host, | 130 scoped_ptr<crypto::ECPrivateKey>* key, |
136 std::string* private_key, | 131 const CompletionCallback& callback, |
137 std::string* cert, | 132 RequestHandle* out_req); |
138 const CompletionCallback& callback, | |
139 RequestHandle* out_req); | |
140 | 133 |
141 // Returns the backing ChannelIDStore. | 134 // Returns the backing ChannelIDStore. |
142 ChannelIDStore* GetChannelIDStore(); | 135 ChannelIDStore* GetChannelIDStore(); |
143 | 136 |
144 // Public only for unit testing. | 137 // Public only for unit testing. |
145 int cert_count(); | 138 int cert_count(); |
146 uint64 requests() const { return requests_; } | 139 uint64 requests() const { return requests_; } |
147 uint64 cert_store_hits() const { return cert_store_hits_; } | 140 uint64 key_store_hits() const { return key_store_hits_; } |
148 uint64 inflight_joins() const { return inflight_joins_; } | 141 uint64 inflight_joins() const { return inflight_joins_; } |
149 uint64 workers_created() const { return workers_created_; } | 142 uint64 workers_created() const { return workers_created_; } |
150 | 143 |
151 private: | 144 private: |
152 // Cancels the specified request. |req| is the handle stored by | 145 // Cancels the specified request. |req| is the handle stored by |
153 // GetChannelID(). After a request is canceled, its completion | 146 // GetChannelID(). After a request is canceled, its completion |
154 // callback will not be called. | 147 // callback will not be called. |
155 void CancelRequest(ChannelIDServiceRequest* req); | 148 void CancelRequest(ChannelIDServiceRequest* req); |
156 | 149 |
157 void GotChannelID(int err, | 150 void GotChannelID(int err, |
158 const std::string& server_identifier, | 151 const std::string& server_identifier, |
159 base::Time expiration_time, | 152 const scoped_ptr<crypto::ECPrivateKey> key); |
Ryan Sleevi
2015/05/08 23:43:14
weird to pass this as const - bug?
nharper
2015/05/11 21:26:44
Refactoring mistake - I think it was a const-ref a
| |
160 const std::string& key, | |
161 const std::string& cert); | |
162 void GeneratedChannelID( | 153 void GeneratedChannelID( |
163 const std::string& server_identifier, | 154 const std::string& server_identifier, |
164 int error, | 155 int error, |
165 scoped_ptr<ChannelIDStore::ChannelID> channel_id); | 156 scoped_ptr<ChannelIDStore::ChannelID> channel_id); |
166 void HandleResult(int error, | 157 void HandleResult(int error, |
167 const std::string& server_identifier, | 158 const std::string& server_identifier, |
168 const std::string& private_key, | 159 crypto::ECPrivateKey* key); |
169 const std::string& cert); | |
170 | 160 |
171 // Searches for an in-flight request for the same domain. If found, | 161 // Searches for an in-flight request for the same domain. If found, |
172 // attaches to the request and returns true. Returns false if no in-flight | 162 // attaches to the request and returns true. Returns false if no in-flight |
173 // request is found. | 163 // request is found. |
174 bool JoinToInFlightRequest(const base::TimeTicks& request_start, | 164 bool JoinToInFlightRequest(const base::TimeTicks& request_start, |
175 const std::string& domain, | 165 const std::string& domain, |
176 std::string* private_key, | 166 scoped_ptr<crypto::ECPrivateKey>* key, |
177 std::string* cert, | |
178 bool create_if_missing, | 167 bool create_if_missing, |
179 const CompletionCallback& callback, | 168 const CompletionCallback& callback, |
180 RequestHandle* out_req); | 169 RequestHandle* out_req); |
181 | 170 |
182 // Looks for the domain bound cert for |domain| in this service's store. | 171 // Looks for the domain bound cert for |domain| in this service's store. |
183 // Returns OK if it can be found synchronously, ERR_IO_PENDING if the | 172 // Returns OK if it can be found synchronously, ERR_IO_PENDING if the |
184 // result cannot be obtained synchronously, or a network error code on | 173 // result cannot be obtained synchronously, or a network error code on |
185 // failure (including failure to find a domain-bound cert of |domain|). | 174 // failure (including failure to find a domain-bound cert of |domain|). |
186 int LookupChannelID(const base::TimeTicks& request_start, | 175 int LookupChannelID(const base::TimeTicks& request_start, |
187 const std::string& domain, | 176 const std::string& domain, |
188 std::string* private_key, | 177 scoped_ptr<crypto::ECPrivateKey>* key, |
189 std::string* cert, | |
190 bool create_if_missing, | 178 bool create_if_missing, |
191 const CompletionCallback& callback, | 179 const CompletionCallback& callback, |
192 RequestHandle* out_req); | 180 RequestHandle* out_req); |
193 | 181 |
194 scoped_ptr<ChannelIDStore> channel_id_store_; | 182 scoped_ptr<ChannelIDStore> channel_id_store_; |
195 scoped_refptr<base::TaskRunner> task_runner_; | 183 scoped_refptr<base::TaskRunner> task_runner_; |
196 | 184 |
197 // inflight_ maps from a server to an active generation which is taking | 185 // inflight_ maps from a server to an active generation which is taking |
198 // place. | 186 // place. |
199 std::map<std::string, ChannelIDServiceJob*> inflight_; | 187 std::map<std::string, ChannelIDServiceJob*> inflight_; |
200 | 188 |
201 uint64 requests_; | 189 uint64 requests_; |
202 uint64 cert_store_hits_; | 190 uint64 key_store_hits_; |
203 uint64 inflight_joins_; | 191 uint64 inflight_joins_; |
204 uint64 workers_created_; | 192 uint64 workers_created_; |
205 | 193 |
206 bool is_system_time_valid_; | |
207 | |
208 base::WeakPtrFactory<ChannelIDService> weak_ptr_factory_; | 194 base::WeakPtrFactory<ChannelIDService> weak_ptr_factory_; |
209 | 195 |
210 DISALLOW_COPY_AND_ASSIGN(ChannelIDService); | 196 DISALLOW_COPY_AND_ASSIGN(ChannelIDService); |
211 }; | 197 }; |
212 | 198 |
213 } // namespace net | 199 } // namespace net |
214 | 200 |
215 #endif // NET_SSL_CHANNEL_ID_SERVICE_H_ | 201 #endif // NET_SSL_CHANNEL_ID_SERVICE_H_ |
OLD | NEW |