OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_SSL_CHANNEL_ID_STORE_H_ | 5 #ifndef NET_SSL_CHANNEL_ID_STORE_H_ |
6 #define NET_SSL_CHANNEL_ID_STORE_H_ | 6 #define NET_SSL_CHANNEL_ID_STORE_H_ |
7 | 7 |
8 #include <list> | 8 #include <list> |
9 #include <string> | 9 #include <string> |
10 | 10 |
11 #include "base/callback.h" | 11 #include "base/callback.h" |
12 #include "base/threading/non_thread_safe.h" | 12 #include "base/threading/non_thread_safe.h" |
13 #include "base/time/time.h" | 13 #include "base/time/time.h" |
14 #include "net/base/net_export.h" | 14 #include "net/base/net_export.h" |
15 | 15 |
16 namespace net { | 16 namespace net { |
17 | 17 |
18 // An interface for storing and retrieving server bound certs. | 18 // An interface for storing and retrieving channel ID keypairs. |
19 // There isn't a domain bound certs spec yet, but the old origin bound | 19 // There isn't a domain bound certs spec yet, but the old origin bound |
20 // certificates are specified in | 20 // certificates are specified in |
21 // http://balfanz.github.com/tls-obc-spec/draft-balfanz-tls-obc-01.html. | 21 // http://balfanz.github.com/tls-obc-spec/draft-balfanz-tls-obc-01.html. |
22 // TODO(wtc): Update this comment. | 22 // TODO(wtc): Update this comment. |
23 | 23 |
24 // Owned only by a single ChannelIDService object, which is responsible | 24 // Owned only by a single ChannelIDService object, which is responsible |
25 // for deleting it. | 25 // for deleting it. |
26 class NET_EXPORT ChannelIDStore | 26 class NET_EXPORT ChannelIDStore |
27 : NON_EXPORTED_BASE(public base::NonThreadSafe) { | 27 : NON_EXPORTED_BASE(public base::NonThreadSafe) { |
28 public: | 28 public: |
29 // The ChannelID class contains a private key in addition to the cert. | 29 // The ChannelID class contains a keypair, along with the corresponding |
| 30 // hostname (server identifier) and creation time. |
30 class NET_EXPORT ChannelID { | 31 class NET_EXPORT ChannelID { |
31 public: | 32 public: |
32 ChannelID(); | 33 ChannelID(); |
33 ChannelID(const std::string& server_identifier, | 34 ChannelID(const std::string& server_identifier, |
34 base::Time creation_time, | 35 base::Time creation_time, |
35 base::Time expiration_time, | |
36 const std::string& private_key, | 36 const std::string& private_key, |
37 const std::string& cert); | 37 const std::string& public_key); |
38 ~ChannelID(); | 38 ~ChannelID(); |
39 | 39 |
40 // Server identifier. For domain bound certs, for instance "verisign.com". | 40 // Server identifier. |
41 const std::string& server_identifier() const { return server_identifier_; } | 41 const std::string& server_identifier() const { return server_identifier_; } |
42 // The time the certificate was created, also the start of the certificate | 42 // The time the keypair was created. |
43 // validity period. | |
44 base::Time creation_time() const { return creation_time_; } | 43 base::Time creation_time() const { return creation_time_; } |
45 // The time after which this certificate is no longer valid. | 44 // DER-encoded EncryptedPrivateKeyInfo struct. |
46 base::Time expiration_time() const { return expiration_time_; } | |
47 // The encoding of the private key depends on the type. | |
48 // rsa_sign: DER-encoded PrivateKeyInfo struct. | |
49 // ecdsa_sign: DER-encoded EncryptedPrivateKeyInfo struct. | |
50 const std::string& private_key() const { return private_key_; } | 45 const std::string& private_key() const { return private_key_; } |
51 // DER-encoded certificate. | 46 // DER-encoded public key. |
52 const std::string& cert() const { return cert_; } | 47 const std::string& public_key() const { return public_key_; } |
53 | 48 |
54 private: | 49 private: |
55 std::string server_identifier_; | 50 std::string server_identifier_; |
56 base::Time creation_time_; | 51 base::Time creation_time_; |
57 base::Time expiration_time_; | |
58 std::string private_key_; | 52 std::string private_key_; |
59 std::string cert_; | 53 std::string public_key_; |
60 }; | 54 }; |
61 | 55 |
62 typedef std::list<ChannelID> ChannelIDList; | 56 typedef std::list<ChannelID> ChannelIDList; |
63 | 57 |
64 typedef base::Callback<void( | 58 typedef base::Callback<void( |
65 int, | 59 int, |
66 const std::string&, | 60 const std::string&, |
67 base::Time, | |
68 const std::string&, | 61 const std::string&, |
69 const std::string&)> GetChannelIDCallback; | 62 const std::string&)> GetChannelIDCallback; |
70 typedef base::Callback<void(const ChannelIDList&)> GetChannelIDListCallback; | 63 typedef base::Callback<void(const ChannelIDList&)> GetChannelIDListCallback; |
71 | 64 |
72 virtual ~ChannelIDStore() {} | 65 virtual ~ChannelIDStore() {} |
73 | 66 |
74 // GetChannelID may return the result synchronously through the | 67 // GetChannelID may return the result synchronously through the |
75 // output parameters, in which case it will return either OK if a cert is | 68 // output parameters, in which case it will return either OK if a keypair is |
76 // found in the store, or ERR_FILE_NOT_FOUND if none is found. If the | 69 // found in the store, or ERR_FILE_NOT_FOUND if none is found. If the |
77 // result cannot be returned synchronously, GetChannelID will | 70 // result cannot be returned synchronously, GetChannelID will |
78 // return ERR_IO_PENDING and the callback will be called with the result | 71 // return ERR_IO_PENDING and the callback will be called with the result |
79 // asynchronously. | 72 // asynchronously. |
80 virtual int GetChannelID( | 73 virtual int GetChannelID(const std::string& server_identifier, |
81 const std::string& server_identifier, | 74 std::string* private_key_result, |
82 base::Time* expiration_time, | 75 std::string* public_key_result, |
83 std::string* private_key_result, | 76 const GetChannelIDCallback& callback) = 0; |
84 std::string* cert_result, | |
85 const GetChannelIDCallback& callback) = 0; | |
86 | 77 |
87 // Adds a server bound cert and the corresponding private key to the store. | 78 // Adds the keypair for a hostname to the store. |
88 virtual void SetChannelID( | 79 virtual void SetChannelID(const std::string& server_identifier, |
89 const std::string& server_identifier, | 80 base::Time creation_time, |
90 base::Time creation_time, | 81 const std::string& private_key, |
91 base::Time expiration_time, | 82 const std::string& public_key) = 0; |
92 const std::string& private_key, | |
93 const std::string& cert) = 0; | |
94 | 83 |
95 // Removes a server bound cert and the corresponding private key from the | 84 // Removes a keypair from the store. |
96 // store. | |
97 virtual void DeleteChannelID( | 85 virtual void DeleteChannelID( |
98 const std::string& server_identifier, | 86 const std::string& server_identifier, |
99 const base::Closure& completion_callback) = 0; | 87 const base::Closure& completion_callback) = 0; |
100 | 88 |
101 // Deletes all of the server bound certs that have a creation_date greater | 89 // Deletes all of the channel ID keypairs that have a creation_date greater |
102 // than or equal to |delete_begin| and less than |delete_end|. If a | 90 // than or equal to |delete_begin| and less than |delete_end|. If a |
103 // base::Time value is_null, that side of the comparison is unbounded. | 91 // base::Time value is_null, that side of the comparison is unbounded. |
104 virtual void DeleteAllCreatedBetween( | 92 virtual void DeleteAllCreatedBetween( |
105 base::Time delete_begin, | 93 base::Time delete_begin, |
106 base::Time delete_end, | 94 base::Time delete_end, |
107 const base::Closure& completion_callback) = 0; | 95 const base::Closure& completion_callback) = 0; |
108 | 96 |
109 // Removes all server bound certs and the corresponding private keys from | 97 // Removes all channel ID keypairs from the store. |
110 // the store. | |
111 virtual void DeleteAll(const base::Closure& completion_callback) = 0; | 98 virtual void DeleteAll(const base::Closure& completion_callback) = 0; |
112 | 99 |
113 // Returns all server bound certs and the corresponding private keys. | 100 // Returns all channel ID keypairs. |
114 virtual void GetAllChannelIDs(const GetChannelIDListCallback& callback) = 0; | 101 virtual void GetAllChannelIDs(const GetChannelIDListCallback& callback) = 0; |
115 | 102 |
116 // Helper function that adds all certs from |list| into this instance. | 103 // Helper function that adds all keypairs from |list| into this instance. |
117 void InitializeFrom(const ChannelIDList& list); | 104 void InitializeFrom(const ChannelIDList& list); |
118 | 105 |
119 // Returns the number of certs in the store. May return 0 if the backing | 106 // Returns the number of keypairs in the store. May return 0 if the backing |
120 // store is not loaded yet. | 107 // store is not loaded yet. |
121 // Public only for unit testing. | 108 // Public only for unit testing. |
122 virtual int GetChannelIDCount() = 0; | 109 virtual int GetChannelIDCount() = 0; |
123 | 110 |
124 // When invoked, instructs the store to keep session related data on | 111 // When invoked, instructs the store to keep session related data on |
125 // destruction. | 112 // destruction. |
126 virtual void SetForceKeepSessionState() = 0; | 113 virtual void SetForceKeepSessionState() = 0; |
127 }; | 114 }; |
128 | 115 |
129 } // namespace net | 116 } // namespace net |
130 | 117 |
131 #endif // NET_SSL_CHANNEL_ID_STORE_H_ | 118 #endif // NET_SSL_CHANNEL_ID_STORE_H_ |
OLD | NEW |