Automatically resolve ClientCertificatePatterns.

chromeos/cert_loader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/cert_loader.h"
 
 #include <algorithm>
 
 #include "base/chromeos/chromeos_version.h"
 #include "base/message_loop/message_loop_proxy.h"
@@ skipping 34 matching lines @@
 
 void LoadNSSCertificates(net::CertificateList* cert_list) {
   net::NSSCertDatabase::GetInstance()->ListCerts(cert_list);
 }
 
 void CallOpenPersistentNSSDB() {
   // Called from crypto_task_runner_.
   VLOG(1) << "CallOpenPersistentNSSDB";
 
   // Ensure we've opened the user's key/certificate database.
-  crypto::OpenPersistentNSSDB();
+  if (base::chromeos::IsRunningOnChromeOS())
+    crypto::OpenPersistentNSSDB();
   crypto::EnableTPMTokenForNSS();
 }
 
 }  // namespace
 
 static CertLoader* g_cert_loader = NULL;
 
 // static
 void CertLoader::Initialize() {
   CHECK(!g_cert_loader);
   g_cert_loader = new CertLoader();
-  g_cert_loader->Init();
 }
 
 // static
 void CertLoader::Shutdown() {
   CHECK(g_cert_loader);
   delete g_cert_loader;
   g_cert_loader = NULL;
 }
 
 // static
 CertLoader* CertLoader::Get() {
   CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()";
   return g_cert_loader;
 }
 
 // static
 bool CertLoader::IsInitialized() {
   return g_cert_loader;
 }
 
 CertLoader::CertLoader()
-    : certificates_requested_(false),
+    : initialize_tpm_for_test_(false),
+      certificates_requested_(false),
       certificates_loaded_(false),
       certificates_update_required_(false),
       certificates_update_running_(false),
       tpm_token_state_(TPM_STATE_UNKNOWN),
       tpm_request_delay_(
           base::TimeDelta::FromMilliseconds(kInitialRequestDelayMs)),
       initialize_token_factory_(this),
       update_certificates_factory_(this) {
+  if (LoginState::IsInitialized())
+    LoginState::Get()->AddObserver(this);
 }
 
-void CertLoader::Init() {
-  net::CertDatabase::GetInstance()->AddObserver(this);
-  if (LoginState::IsInitialized())
-    LoginState::Get()->AddObserver(this);
+void CertLoader::InitializeTPMForTest() {
+  initialize_tpm_for_test_ = true;
 }
 
 void CertLoader::SetCryptoTaskRunner(
     const scoped_refptr<base::SequencedTaskRunner>& crypto_task_runner) {
   crypto_task_runner_ = crypto_task_runner;
   MaybeRequestCertificates();
 }
 
 void CertLoader::SetSlowTaskRunnerForTest(
     const scoped_refptr<base::TaskRunner>& task_runner) {
@@ skipping 33 matching lines @@
   const bool logged_in = LoginState::IsInitialized() ?
       LoginState::Get()->IsUserLoggedIn() : false;
   VLOG(1) << "RequestCertificates: " << logged_in;
   if (!logged_in)
     return;
 
   certificates_requested_ = true;
 
   // Ensure we only initialize the TPM token once.
   DCHECK_EQ(tpm_token_state_, TPM_STATE_UNKNOWN);
-  if (!base::chromeos::IsRunningOnChromeOS())
+  if (!initialize_tpm_for_test_ && !base::chromeos::IsRunningOnChromeOS())
+    tpm_token_state_ = TPM_DISABLED;
+
+  // Treat TPM as disabled for guest users since they do not store certs.
+  if (LoginState::IsInitialized() && LoginState::Get()->IsGuestUser())
     tpm_token_state_ = TPM_DISABLED;
 
   InitializeTokenAndLoadCertificates();
 }
 
 void CertLoader::InitializeTokenAndLoadCertificates() {
   CHECK(thread_checker_.CalledOnValidThread());
   VLOG(1) << "InitializeTokenAndLoadCertificates: " << tpm_token_state_;
 
-  // Treat TPM as disabled for guest users since they do not store certs.
-  if (LoginState::IsInitialized() && LoginState::Get()->IsGuestUser())
-    tpm_token_state_ = TPM_DISABLED;
-
   switch (tpm_token_state_) {
     case TPM_STATE_UNKNOWN: {
       crypto_task_runner_->PostTaskAndReply(
           FROM_HERE,
           base::Bind(&CallOpenPersistentNSSDB),
           base::Bind(&CertLoader::OnPersistentNSSDBOpened,
                      initialize_token_factory_.GetWeakPtr()));
       return;
     }
     case TPM_DB_OPENED: {
@@ skipping 23 matching lines @@
     }
     case TPM_TOKEN_INFO_RECEIVED: {
       base::PostTaskAndReplyWithResult(
           crypto_task_runner_.get(),
           FROM_HERE,
           base::Bind(
               &crypto::InitializeTPMToken, tpm_token_name_, tpm_user_pin_),
           base::Bind(&CertLoader::OnTPMTokenInitialized,
                      initialize_token_factory_.GetWeakPtr()));
       return;
-      tpm_token_state_ = TPM_TOKEN_INITIALIZED;
-      // FALL_THROUGH_INTENDED
     }
     case TPM_TOKEN_INITIALIZED: {
       StartLoadCertificates();
       return;
     }
   }
 }
 
 void CertLoader::RetryTokenInitializationLater() {
   CHECK(thread_checker_.CalledOnValidThread());
-  LOG(WARNING) << "Re-Requesting Certificates later.";
+  LOG(WARNING) << "Retry token initialization later.";
   base::MessageLoop::current()->PostDelayedTask(
       FROM_HERE,
       base::Bind(&CertLoader::InitializeTokenAndLoadCertificates,
                  initialize_token_factory_.GetWeakPtr()),
       tpm_request_delay_);
   tpm_request_delay_ = GetNextRequestDelayMs(tpm_request_delay_);
 }
 
 void CertLoader::OnPersistentNSSDBOpened() {
   VLOG(1) << "PersistentNSSDBOpened";
@@ skipping 80 matching lines @@
   VLOG(1) << "OnTPMTokenInitialized: " << success;
   if (!success) {
     RetryTokenInitializationLater();
     return;
   }
   tpm_token_state_ = TPM_TOKEN_INITIALIZED;
   InitializeTokenAndLoadCertificates();
 }
 
 void CertLoader::StartLoadCertificates() {
+  DCHECK(!certificates_loaded_ && !certificates_update_running_);
+  net::CertDatabase::GetInstance()->AddObserver(this);
+  LoadCertificates();
+}
+
+void CertLoader::LoadCertificates() {
   CHECK(thread_checker_.CalledOnValidThread());
-  VLOG(1) << "StartLoadCertificates: " << certificates_update_running_;
+  VLOG(1) << "LoadCertificates: " << certificates_update_running_;
 
   if (certificates_update_running_) {
     certificates_update_required_ = true;
     return;
   }
 
   net::CertificateList* cert_list = new net::CertificateList;
   certificates_update_running_ = true;
   certificates_update_required_ = false;
 
@@ skipping 15 matching lines @@
 
   // Ignore any existing certificates.
   cert_list_.swap(*cert_list);
 
   bool initial_load = !certificates_loaded_;
   certificates_loaded_ = true;
   NotifyCertificatesLoaded(initial_load);
 
   certificates_update_running_ = false;
   if (certificates_update_required_)
-    StartLoadCertificates();
+    LoadCertificates();
 }
 
 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
   FOR_EACH_OBSERVER(Observer, observers_,
                     OnCertificatesLoaded(cert_list_, initial_load));
 }
 
 void CertLoader::OnCertTrustChanged(const net::X509Certificate* cert) {
 }
 
 void CertLoader::OnCertAdded(const net::X509Certificate* cert) {
   VLOG(1) << "OnCertAdded";
-  StartLoadCertificates();
+  LoadCertificates();
 }
 
 void CertLoader::OnCertRemoved(const net::X509Certificate* cert) {
   VLOG(1) << "OnCertRemoved";
-  StartLoadCertificates();
+  LoadCertificates();
 }
 
 void CertLoader::LoggedInStateChanged(LoginState::LoggedInState state) {
   VLOG(1) << "LoggedInStateChanged: " << state;
   MaybeRequestCertificates();
 }
 
 }  // namespace chromeos