Add NetworkConnectionHandler class

chromeos/network/cert_loader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/cert_loader.h"
 
 #include <algorithm>
 
 #include "base/chromeos/chromeos_version.h"
 #include "base/observer_list.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/task_runner_util.h"
 #include "base/threading/worker_pool.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "crypto/encryptor.h"
 #include "crypto/nss_util.h"
 #include "crypto/sha2.h"
 #include "crypto/symmetric_key.h"
 #include "net/cert/nss_cert_database.h"
 
 namespace chromeos {
 
 namespace {
 
 // Delay between certificate requests while waiting for TPM/PKCS#11 init.
 const int kRequestDelayMs = 500;
 
 net::CertificateList* LoadNSSCertificates() {
   net::CertificateList* cert_list(new net::CertificateList());
-  net::NSSCertDatabase::GetInstance()->ListCerts(cert_list);
+  if (base::chromeos::IsRunningOnChromeOS())

[pneubeck (no reviews), 2013/05/13 09:29:36]

did or how did certificates work in chromeos-on-linux with CertLibrary?

[stevenjb, 2013/05/13 20:25:52]

I do not believe that they ever have worked.

+    net::NSSCertDatabase::GetInstance()->ListCerts(cert_list);
   return cert_list;
 }
 
 }  // namespace
 
 static CertLoader* g_cert_loader = NULL;
 
 // static
 void CertLoader::Initialize() {
   CHECK(!g_cert_loader);
@@ skipping 71 matching lines @@
   certificates_requested_ = true;
 
   VLOG(1) << "Requesting Certificates.";
   DBusThreadManager::Get()->GetCryptohomeClient()->TpmIsEnabled(
       base::Bind(&CertLoader::OnTpmIsEnabled,
                  weak_ptr_factory_.GetWeakPtr()));
 
   return;
 }
 
+// For background see this discussion on dev-tech-crypto.lists.mozilla.org:

[pneubeck (no reviews), 2013/05/13 09:29:36]

Nit: maybe drop a comment where you copied this from.

+// http://web.archiveorange.com/archive/v/6JJW7E40sypfZGtbkzxX
+//
+// NOTE: This function relies on the convention that the same PKCS#11 ID
+// is shared between a certificate and its associated private and public
+// keys.  I tried to implement this with PK11_GetLowLevelKeyIDForCert(),
+// but that always returns NULL on Chrome OS for me.
+std::string CertLoader::GetPkcs11IdForCert(
+    const net::X509Certificate& cert) const {
+  if (!IsHardwareBacked())
+    return std::string();
+
+  CERTCertificateStr* cert_handle = cert.os_cert_handle();
+  SECKEYPrivateKey *priv_key =
+      PK11_FindKeyByAnyCert(cert_handle, NULL /* wincx */);
+  if (!priv_key)
+    return std::string();
+
+  // Get the CKA_ID attribute for a key.
+  SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(priv_key);
+  std::string pkcs11_id;
+  if (sec_item) {
+    pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
+    SECITEM_FreeItem(sec_item, PR_TRUE);
+  }
+  SECKEY_DestroyPrivateKey(priv_key);
+
+  return pkcs11_id;
+}
+
 void CertLoader::OnTpmIsEnabled(DBusMethodCallStatus call_status,
                                 bool tpm_is_enabled) {
   VLOG(1) << "OnTpmIsEnabled: " << tpm_is_enabled;
   if (call_status != DBUS_METHOD_CALL_SUCCESS || !tpm_is_enabled) {
     // TPM is not enabled, so proceed with empty tpm token name.
     VLOG(1) << "TPM not available.";
     StartLoadCertificates();
   } else if (tpm_token_ready_) {
     // Once the TPM token is ready, initialize it.
     InitializeTPMToken();
@@ skipping 33 matching lines @@
   const char kHardcodedTpmSlot[] = "0";
   tpm_token_slot_ = kHardcodedTpmSlot;
   tpm_user_pin_ = user_pin;
   tpm_token_ready_ = true;
 
   InitializeTPMToken();
 }
 
 void CertLoader::InitializeTPMToken() {
   VLOG(1) << "InitializeTPMToken";
-  if (!crypto::InitializeTPMToken(tpm_token_name_, tpm_user_pin_)) {
+  if (base::chromeos::IsRunningOnChromeOS() &&
+      !crypto::InitializeTPMToken(tpm_token_name_, tpm_user_pin_)) {
     MaybeRetryRequestCertificates();
     return;
   }
   StartLoadCertificates();
 }
 
 void CertLoader::StartLoadCertificates() {
   VLOG(1) << "Start Load Certificates";
   base::PostTaskAndReplyWithResult(
       base::WorkerPool::GetTaskRunner(true /* task_is_slow */),
@@ skipping 20 matching lines @@
     NotifyCertificatesLoaded(true);
   } else {
     NotifyCertificatesLoaded(false);
   }
 }
 
 void CertLoader::MaybeRetryRequestCertificates() {
   if (!request_task_.is_null())
     return;
 
+  LOG(WARNING) << "Re-Requesting Certificates.";

[pneubeck (no reviews), 2013/05/13 09:29:36]

nit: if this is happens frequently on normal starts, then maybe vlog

[stevenjb, 2013/05/13 20:25:52]

It doesn't, or shouldn't.

+
   // Cryptohome does not notify us when the token is ready, so call
   // this again after a delay.
   request_task_ = base::Bind(&CertLoader::RequestCertificatesTask,
                              weak_ptr_factory_.GetWeakPtr());
   MessageLoop::current()->PostDelayedTask(
       FROM_HERE,
       request_task_,
       base::TimeDelta::FromMilliseconds(kRequestDelayMs));
 }
 
@@ skipping 25 matching lines @@
   StartLoadCertificates();
 }
 
 void CertLoader::LoggedInStateChanged(LoginState::LoggedInState state) {
   VLOG(1) << "LoggedInStateChanged: " << state;
   if (LoginState::Get()->IsUserLoggedIn() && !certificates_requested_)
     RequestCertificates();
 }
 
 }  // namespace chromeos