OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chromeos/network/onc/onc_certificate_importer.h" | 5 #include "chromeos/network/onc/onc_certificate_importer.h" |
6 | 6 |
7 #include <cert.h> | 7 #include <cert.h> |
8 #include <keyhi.h> | 8 #include <keyhi.h> |
9 #include <pk11pub.h> | 9 #include <pk11pub.h> |
10 | 10 |
11 #include "base/base64.h" | 11 #include "base/base64.h" |
12 #include "base/logging.h" | 12 #include "base/logging.h" |
13 #include "base/values.h" | 13 #include "base/values.h" |
14 #include "chromeos/network/network_event_log.h" | 14 #include "chromeos/network/network_event_log.h" |
15 #include "chromeos/network/onc/onc_constants.h" | 15 #include "chromeos/network/onc/onc_constants.h" |
16 #include "net/base/crypto_module.h" | 16 #include "net/base/crypto_module.h" |
17 #include "net/base/net_errors.h" | 17 #include "net/base/net_errors.h" |
18 #include "net/cert/nss_cert_database.h" | 18 #include "net/cert/nss_cert_database.h" |
19 #include "net/cert/pem_tokenizer.h" | 19 #include "net/cert/pem_tokenizer.h" |
20 #include "net/cert/x509_certificate.h" | 20 #include "net/cert/x509_certificate.h" |
21 | 21 |
22 #define ONC_LOG_WARNING(message) NET_LOG_WARNING("ONC", message) | 22 #define ONC_LOG_WARNING(message) \ |
23 #define ONC_LOG_ERROR(message) NET_LOG_ERROR("ONC", message) | 23 NET_LOG_DEBUG("ONC Certificate Import Warning", message) |
| 24 #define ONC_LOG_ERROR(message) \ |
| 25 NET_LOG_ERROR("ONC Certificate Import Error", message) |
24 | 26 |
25 namespace { | 27 namespace { |
26 | 28 |
27 // The PEM block header used for DER certificates | 29 // The PEM block header used for DER certificates |
28 const char kCertificateHeader[] = "CERTIFICATE"; | 30 const char kCertificateHeader[] = "CERTIFICATE"; |
29 // This is an older PEM marker for DER certificates. | 31 // This is an older PEM marker for DER certificates. |
30 const char kX509CertificateHeader[] = "X509 CERTIFICATE"; | 32 const char kX509CertificateHeader[] = "X509 CERTIFICATE"; |
31 | 33 |
32 } // namespace | 34 } // namespace |
33 | 35 |
(...skipping 256 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
290 net::NSSCertDatabase::TrustBits trust = import_with_ssl_trust ? | 292 net::NSSCertDatabase::TrustBits trust = import_with_ssl_trust ? |
291 net::NSSCertDatabase::TRUSTED_SSL : | 293 net::NSSCertDatabase::TRUSTED_SSL : |
292 net::NSSCertDatabase::TRUST_DEFAULT; | 294 net::NSSCertDatabase::TRUST_DEFAULT; |
293 if (cert_type == certificate::kServer) { | 295 if (cert_type == certificate::kServer) { |
294 success = cert_database->ImportServerCert(cert_list, trust, &failures); | 296 success = cert_database->ImportServerCert(cert_list, trust, &failures); |
295 } else { // Authority cert | 297 } else { // Authority cert |
296 success = cert_database->ImportCACerts(cert_list, trust, &failures); | 298 success = cert_database->ImportCACerts(cert_list, trust, &failures); |
297 } | 299 } |
298 | 300 |
299 if (!failures.empty()) { | 301 if (!failures.empty()) { |
300 ONC_LOG_ERROR("Error (" + net::ErrorToString(failures[0].net_error) + | 302 ONC_LOG_ERROR(base::StringPrintf("Error ( %s ) importing %s certificate", |
301 ") importing " + cert_type + " certificate"); | 303 net::ErrorToString(failures[0].net_error), |
| 304 cert_type.c_str())); |
302 return false; | 305 return false; |
303 } | 306 } |
304 if (!success) { | 307 if (!success) { |
305 ONC_LOG_ERROR("Unknown error importing " + cert_type + " certificate."); | 308 ONC_LOG_ERROR("Unknown error importing " + cert_type + " certificate."); |
306 return false; | 309 return false; |
307 } | 310 } |
308 | 311 |
309 if (web_trust_flag && onc_trusted_certificates) | 312 if (web_trust_flag && onc_trusted_certificates) |
310 onc_trusted_certificates->push_back(x509_cert); | 313 onc_trusted_certificates->push_back(x509_cert); |
311 | 314 |
(...skipping 19 matching lines...) Expand all Loading... |
331 } | 334 } |
332 | 335 |
333 // Since this has a private key, always use the private module. | 336 // Since this has a private key, always use the private module. |
334 net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance(); | 337 net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance(); |
335 scoped_refptr<net::CryptoModule> module(cert_database->GetPrivateModule()); | 338 scoped_refptr<net::CryptoModule> module(cert_database->GetPrivateModule()); |
336 net::CertificateList imported_certs; | 339 net::CertificateList imported_certs; |
337 | 340 |
338 int import_result = cert_database->ImportFromPKCS12( | 341 int import_result = cert_database->ImportFromPKCS12( |
339 module.get(), decoded_pkcs12, string16(), false, &imported_certs); | 342 module.get(), decoded_pkcs12, string16(), false, &imported_certs); |
340 if (import_result != net::OK) { | 343 if (import_result != net::OK) { |
341 ONC_LOG_ERROR("Unable to import client certificate (error " + | 344 ONC_LOG_ERROR( |
342 net::ErrorToString(import_result) + ")."); | 345 base::StringPrintf("Unable to import client certificate (error %s)", |
| 346 net::ErrorToString(import_result))); |
343 return false; | 347 return false; |
344 } | 348 } |
345 | 349 |
346 if (imported_certs.size() == 0) { | 350 if (imported_certs.size() == 0) { |
347 ONC_LOG_WARNING("PKCS12 data contains no importable certificates."); | 351 ONC_LOG_WARNING("PKCS12 data contains no importable certificates."); |
348 return true; | 352 return true; |
349 } | 353 } |
350 | 354 |
351 if (imported_certs.size() != 1) { | 355 if (imported_certs.size() != 1) { |
352 ONC_LOG_WARNING("ONC File: PKCS12 data contains more than one certificate. " | 356 ONC_LOG_WARNING("ONC File: PKCS12 data contains more than one certificate. " |
(...skipping 12 matching lines...) Expand all Loading... |
365 PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str())); | 369 PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str())); |
366 SECKEY_DestroyPrivateKey(private_key); | 370 SECKEY_DestroyPrivateKey(private_key); |
367 } else { | 371 } else { |
368 ONC_LOG_WARNING("Unable to find private key for certificate."); | 372 ONC_LOG_WARNING("Unable to find private key for certificate."); |
369 } | 373 } |
370 return true; | 374 return true; |
371 } | 375 } |
372 | 376 |
373 } // namespace onc | 377 } // namespace onc |
374 } // namespace chromeos | 378 } // namespace chromeos |
OLD | NEW |