OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_database.h" | 5 #include "net/cert/cert_database.h" |
6 | 6 |
7 #include <Security/Security.h> | 7 #include <Security/Security.h> |
8 | 8 |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "base/mac/mac_logging.h" | 10 #include "base/mac/mac_logging.h" |
11 #include "base/message_loop/message_loop.h" | 11 #include "base/message_loop/message_loop.h" |
12 #include "base/observer_list_threadsafe.h" | 12 #include "base/observer_list_threadsafe.h" |
13 #include "base/process/process_handle.h" | 13 #include "base/process/process_handle.h" |
14 #include "base/single_thread_task_runner.h" | 14 #include "base/single_thread_task_runner.h" |
15 #include "base/synchronization/lock.h" | 15 #include "base/synchronization/lock.h" |
16 #include "crypto/mac_security_services_lock.h" | 16 #include "crypto/mac_security_services_lock.h" |
17 #include "net/base/net_errors.h" | 17 #include "net/base/net_errors.h" |
18 #include "net/cert/x509_certificate.h" | 18 #include "net/cert/x509_certificate.h" |
19 | 19 |
20 namespace net { | 20 namespace net { |
21 | 21 |
22 // Helper that observes events from the Keychain and forwards them to the | 22 // Helper that observes events from the Keychain and forwards them to the |
23 // given CertDatabase. | 23 // given CertDatabase. |
24 class CertDatabase::Notifier { | 24 class CertDatabase::Notifier { |
25 public: | 25 public: |
26 // Creates a new Notifier that will forward Keychain events to |cert_db|. | 26 // Creates a new Notifier that will forward Keychain events to |cert_db|. |
27 // |message_loop| must refer to a thread with an associated CFRunLoop - a | 27 // |message_loop| must refer to a thread with an associated CFRunLoop - a |
28 // TYPE_UI thread. Events will be dispatched from this message loop. | 28 // TYPE_UI thread. Events will be dispatched from this message loop. |
29 Notifier(CertDatabase* cert_db, base::MessageLoop* message_loop) | 29 Notifier(CertDatabase* cert_db, base::MessageLoop* message_loop) |
30 : cert_db_(cert_db), | 30 : cert_db_(cert_db), registered_(false), called_shutdown_(false) { |
31 registered_(false), | |
32 called_shutdown_(false) { | |
33 // Ensure an associated CFRunLoop. | 31 // Ensure an associated CFRunLoop. |
34 DCHECK(base::MessageLoopForUI::IsCurrent()); | 32 DCHECK(base::MessageLoopForUI::IsCurrent()); |
35 task_runner_ = message_loop->message_loop_proxy(); | 33 task_runner_ = message_loop->message_loop_proxy(); |
36 task_runner_->PostTask(FROM_HERE, | 34 task_runner_->PostTask(FROM_HERE, |
37 base::Bind(&Notifier::Init, | 35 base::Bind(&Notifier::Init, base::Unretained(this))); |
38 base::Unretained(this))); | |
39 } | 36 } |
40 | 37 |
41 // Should be called from the |task_runner_|'s thread. Use Shutdown() | 38 // Should be called from the |task_runner_|'s thread. Use Shutdown() |
42 // to shutdown on arbitrary threads. | 39 // to shutdown on arbitrary threads. |
43 ~Notifier() { | 40 ~Notifier() { |
44 DCHECK(called_shutdown_); | 41 DCHECK(called_shutdown_); |
45 // Only unregister from the same thread where registration was performed. | 42 // Only unregister from the same thread where registration was performed. |
46 if (registered_ && task_runner_->RunsTasksOnCurrentThread()) | 43 if (registered_ && task_runner_->RunsTasksOnCurrentThread()) |
47 SecKeychainRemoveCallback(&Notifier::KeychainCallback); | 44 SecKeychainRemoveCallback(&Notifier::KeychainCallback); |
48 } | 45 } |
49 | 46 |
50 void Shutdown() { | 47 void Shutdown() { |
51 called_shutdown_ = true; | 48 called_shutdown_ = true; |
52 if (!task_runner_->DeleteSoon(FROM_HERE, this)) { | 49 if (!task_runner_->DeleteSoon(FROM_HERE, this)) { |
53 // If the task runner is no longer running, it's safe to just delete | 50 // If the task runner is no longer running, it's safe to just delete |
54 // the object, since no further events will or can be delivered by | 51 // the object, since no further events will or can be delivered by |
55 // Keychain Services. | 52 // Keychain Services. |
56 delete this; | 53 delete this; |
57 } | 54 } |
58 } | 55 } |
59 | 56 |
60 private: | 57 private: |
61 void Init() { | 58 void Init() { |
62 SecKeychainEventMask event_mask = | 59 SecKeychainEventMask event_mask = |
63 kSecKeychainListChangedMask | kSecTrustSettingsChangedEventMask; | 60 kSecKeychainListChangedMask | kSecTrustSettingsChangedEventMask; |
64 OSStatus status = SecKeychainAddCallback(&Notifier::KeychainCallback, | 61 OSStatus status = |
65 event_mask, this); | 62 SecKeychainAddCallback(&Notifier::KeychainCallback, event_mask, this); |
66 if (status == noErr) | 63 if (status == noErr) |
67 registered_ = true; | 64 registered_ = true; |
68 } | 65 } |
69 | 66 |
70 // SecKeychainCallback function that receives notifications from securityd | 67 // SecKeychainCallback function that receives notifications from securityd |
71 // and forwards them to the |cert_db_|. | 68 // and forwards them to the |cert_db_|. |
72 static OSStatus KeychainCallback(SecKeychainEvent keychain_event, | 69 static OSStatus KeychainCallback(SecKeychainEvent keychain_event, |
73 SecKeychainCallbackInfo* info, | 70 SecKeychainCallbackInfo* info, |
74 void* context); | 71 void* context); |
75 | 72 |
(...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
129 } | 126 } |
130 | 127 |
131 int CertDatabase::CheckUserCert(X509Certificate* cert) { | 128 int CertDatabase::CheckUserCert(X509Certificate* cert) { |
132 if (!cert) | 129 if (!cert) |
133 return ERR_CERT_INVALID; | 130 return ERR_CERT_INVALID; |
134 if (cert->HasExpired()) | 131 if (cert->HasExpired()) |
135 return ERR_CERT_DATE_INVALID; | 132 return ERR_CERT_DATE_INVALID; |
136 | 133 |
137 // Verify the Keychain already has the corresponding private key: | 134 // Verify the Keychain already has the corresponding private key: |
138 SecIdentityRef identity = NULL; | 135 SecIdentityRef identity = NULL; |
139 OSStatus err = SecIdentityCreateWithCertificate(NULL, cert->os_cert_handle(), | 136 OSStatus err = |
140 &identity); | 137 SecIdentityCreateWithCertificate(NULL, cert->os_cert_handle(), &identity); |
141 if (err == errSecItemNotFound) | 138 if (err == errSecItemNotFound) |
142 return ERR_NO_PRIVATE_KEY_FOR_CERT; | 139 return ERR_NO_PRIVATE_KEY_FOR_CERT; |
143 | 140 |
144 if (err != noErr || !identity) { | 141 if (err != noErr || !identity) { |
145 // TODO(snej): Map the error code more intelligently. | 142 // TODO(snej): Map the error code more intelligently. |
146 return ERR_CERT_INVALID; | 143 return ERR_CERT_INVALID; |
147 } | 144 } |
148 | 145 |
149 CFRelease(identity); | 146 CFRelease(identity); |
150 return OK; | 147 return OK; |
151 } | 148 } |
152 | 149 |
153 int CertDatabase::AddUserCert(X509Certificate* cert) { | 150 int CertDatabase::AddUserCert(X509Certificate* cert) { |
154 OSStatus err; | 151 OSStatus err; |
155 { | 152 { |
156 base::AutoLock locked(crypto::GetMacSecurityServicesLock()); | 153 base::AutoLock locked(crypto::GetMacSecurityServicesLock()); |
157 err = SecCertificateAddToKeychain(cert->os_cert_handle(), NULL); | 154 err = SecCertificateAddToKeychain(cert->os_cert_handle(), NULL); |
158 } | 155 } |
159 switch (err) { | 156 switch (err) { |
160 case noErr: | 157 case noErr: |
161 CertDatabase::NotifyObserversOfCertAdded(cert); | 158 CertDatabase::NotifyObserversOfCertAdded(cert); |
162 // Fall through. | 159 // Fall through. |
163 case errSecDuplicateItem: | 160 case errSecDuplicateItem: |
164 return OK; | 161 return OK; |
165 default: | 162 default: |
166 OSSTATUS_LOG(ERROR, err) << "CertDatabase failed to add cert to keychain"; | 163 OSSTATUS_LOG(ERROR, err) << "CertDatabase failed to add cert to keychain"; |
167 // TODO(snej): Map the error code more intelligently. | 164 // TODO(snej): Map the error code more intelligently. |
168 return ERR_ADD_USER_CERT_FAILED; | 165 return ERR_ADD_USER_CERT_FAILED; |
169 } | 166 } |
170 } | 167 } |
171 | 168 |
172 } // namespace net | 169 } // namespace net |
OLD | NEW |