OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/ssl/client_cert_store_nss.h" | 5 #include "net/ssl/client_cert_store_nss.h" |
6 | 6 |
7 #include <nss.h> | 7 #include <nss.h> |
8 #include <ssl.h> | 8 #include <ssl.h> |
9 | 9 |
10 #include "base/bind.h" | 10 #include "base/bind.h" |
11 #include "base/location.h" | 11 #include "base/location.h" |
12 #include "base/logging.h" | 12 #include "base/logging.h" |
13 #include "base/memory/scoped_ptr.h" | 13 #include "base/memory/scoped_ptr.h" |
14 #include "base/strings/string_piece.h" | 14 #include "base/strings/string_piece.h" |
15 #include "base/threading/worker_pool.h" | 15 #include "base/threading/worker_pool.h" |
16 #include "crypto/nss_crypto_module_delegate.h" | 16 #include "crypto/nss_crypto_module_delegate.h" |
17 #include "net/cert/x509_util.h" | 17 #include "net/cert/x509_util.h" |
18 | 18 |
19 namespace net { | 19 namespace net { |
20 | 20 |
21 ClientCertStoreNSS::ClientCertStoreNSS( | 21 ClientCertStoreNSS::ClientCertStoreNSS( |
22 const PasswordDelegateFactory& password_delegate_factory) | 22 const PasswordDelegateFactory& password_delegate_factory) |
23 : password_delegate_factory_(password_delegate_factory) {} | 23 : password_delegate_factory_(password_delegate_factory) { |
| 24 } |
24 | 25 |
25 ClientCertStoreNSS::~ClientCertStoreNSS() {} | 26 ClientCertStoreNSS::~ClientCertStoreNSS() { |
| 27 } |
26 | 28 |
27 void ClientCertStoreNSS::GetClientCerts(const SSLCertRequestInfo& request, | 29 void ClientCertStoreNSS::GetClientCerts(const SSLCertRequestInfo& request, |
28 CertificateList* selected_certs, | 30 CertificateList* selected_certs, |
29 const base::Closure& callback) { | 31 const base::Closure& callback) { |
30 scoped_ptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate; | 32 scoped_ptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate; |
31 if (!password_delegate_factory_.is_null()) { | 33 if (!password_delegate_factory_.is_null()) { |
32 password_delegate.reset( | 34 password_delegate.reset( |
33 password_delegate_factory_.Run(request.host_and_port)); | 35 password_delegate_factory_.Run(request.host_and_port)); |
34 } | 36 } |
35 if (base::WorkerPool::PostTaskAndReply( | 37 if (base::WorkerPool::PostTaskAndReply( |
36 FROM_HERE, | 38 FROM_HERE, |
37 base::Bind(&ClientCertStoreNSS::GetClientCertsOnWorkerThread, | 39 base::Bind(&ClientCertStoreNSS::GetClientCertsOnWorkerThread, |
38 // Caller is responsible for keeping the ClientCertStore | 40 // Caller is responsible for keeping the ClientCertStore |
39 // alive until the callback is run. | 41 // alive until the callback is run. |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
88 DVLOG(2) << "skipped expired cert: " | 90 DVLOG(2) << "skipped expired cert: " |
89 << base::StringPiece(node->cert->nickname); | 91 << base::StringPiece(node->cert->nickname); |
90 continue; | 92 continue; |
91 } | 93 } |
92 | 94 |
93 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( | 95 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( |
94 node->cert, X509Certificate::OSCertHandles()); | 96 node->cert, X509Certificate::OSCertHandles()); |
95 | 97 |
96 // Check if the certificate issuer is allowed by the server. | 98 // Check if the certificate issuer is allowed by the server. |
97 if (request.cert_authorities.empty() || | 99 if (request.cert_authorities.empty() || |
98 (!query_nssdb && | 100 (!query_nssdb && cert->IsIssuedByEncoded(request.cert_authorities)) || |
99 cert->IsIssuedByEncoded(request.cert_authorities)) || | |
100 (query_nssdb && | 101 (query_nssdb && |
101 NSS_CmpCertChainWCANames(node->cert, &ca_names) == SECSuccess)) { | 102 NSS_CmpCertChainWCANames(node->cert, &ca_names) == SECSuccess)) { |
102 DVLOG(2) << "matched cert: " << base::StringPiece(node->cert->nickname); | 103 DVLOG(2) << "matched cert: " << base::StringPiece(node->cert->nickname); |
103 selected_certs->push_back(cert); | 104 selected_certs->push_back(cert); |
104 } | 105 } else |
105 else | |
106 DVLOG(2) << "skipped non-matching cert: " | 106 DVLOG(2) << "skipped non-matching cert: " |
107 << base::StringPiece(node->cert->nickname); | 107 << base::StringPiece(node->cert->nickname); |
108 } | 108 } |
109 DVLOG(2) << "num_raw:" << num_raw | 109 DVLOG(2) << "num_raw:" << num_raw |
110 << " num_selected:" << selected_certs->size(); | 110 << " num_selected:" << selected_certs->size(); |
111 | 111 |
112 std::sort(selected_certs->begin(), selected_certs->end(), | 112 std::sort(selected_certs->begin(), |
| 113 selected_certs->end(), |
113 x509_util::ClientCertSorter()); | 114 x509_util::ClientCertSorter()); |
114 } | 115 } |
115 | 116 |
116 void ClientCertStoreNSS::GetClientCertsOnWorkerThread( | 117 void ClientCertStoreNSS::GetClientCertsOnWorkerThread( |
117 scoped_ptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate, | 118 scoped_ptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate, |
118 const SSLCertRequestInfo* request, | 119 const SSLCertRequestInfo* request, |
119 CertificateList* selected_certs) { | 120 CertificateList* selected_certs) { |
120 CERTCertList* client_certs = CERT_FindUserCertsByUsage( | 121 CERTCertList* client_certs = |
121 CERT_GetDefaultCertDB(), | 122 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), |
122 certUsageSSLClient, | 123 certUsageSSLClient, |
123 PR_FALSE, | 124 PR_FALSE, |
124 PR_FALSE, | 125 PR_FALSE, |
125 password_delegate.get()); | 126 password_delegate.get()); |
126 // It is ok for a user not to have any client certs. | 127 // It is ok for a user not to have any client certs. |
127 if (!client_certs) { | 128 if (!client_certs) { |
128 DVLOG(2) << "No client certs found."; | 129 DVLOG(2) << "No client certs found."; |
129 selected_certs->clear(); | 130 selected_certs->clear(); |
130 return; | 131 return; |
131 } | 132 } |
132 | 133 |
133 GetClientCertsImpl(client_certs, *request, true, selected_certs); | 134 GetClientCertsImpl(client_certs, *request, true, selected_certs); |
134 CERT_DestroyCertList(client_certs); | 135 CERT_DestroyCertList(client_certs); |
135 } | 136 } |
136 | 137 |
137 bool ClientCertStoreNSS::SelectClientCertsForTesting( | 138 bool ClientCertStoreNSS::SelectClientCertsForTesting( |
138 const CertificateList& input_certs, | 139 const CertificateList& input_certs, |
139 const SSLCertRequestInfo& request, | 140 const SSLCertRequestInfo& request, |
140 CertificateList* selected_certs) { | 141 CertificateList* selected_certs) { |
141 CERTCertList* cert_list = CERT_NewCertList(); | 142 CERTCertList* cert_list = CERT_NewCertList(); |
142 if (!cert_list) | 143 if (!cert_list) |
143 return false; | 144 return false; |
144 for (size_t i = 0; i < input_certs.size(); ++i) { | 145 for (size_t i = 0; i < input_certs.size(); ++i) { |
145 CERT_AddCertToListTail( | 146 CERT_AddCertToListTail( |
146 cert_list, CERT_DupCertificate(input_certs[i]->os_cert_handle())); | 147 cert_list, CERT_DupCertificate(input_certs[i]->os_cert_handle())); |
147 } | 148 } |
148 | 149 |
149 GetClientCertsImpl(cert_list, request, false, selected_certs); | 150 GetClientCertsImpl(cert_list, request, false, selected_certs); |
150 CERT_DestroyCertList(cert_list); | 151 CERT_DestroyCertList(cert_list); |
151 return true; | 152 return true; |
152 } | 153 } |
153 | 154 |
154 } // namespace net | 155 } // namespace net |
OLD | NEW |