| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/ssl/server_bound_cert_service.h" | 5 #include "net/ssl/server_bound_cert_service.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <limits> | 8 #include <limits> |
| 9 | 9 |
| 10 #include "base/bind.h" | 10 #include "base/bind.h" |
| (...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 63 // We don't support any of the cert types the server requested. | 63 // We don't support any of the cert types the server requested. |
| 64 UNSUPPORTED_TYPE = 8, | 64 UNSUPPORTED_TYPE = 8, |
| 65 // Server asked for a different type of certs while we were generating one. | 65 // Server asked for a different type of certs while we were generating one. |
| 66 TYPE_MISMATCH = 9, | 66 TYPE_MISMATCH = 9, |
| 67 // Couldn't start a worker to generate a cert. | 67 // Couldn't start a worker to generate a cert. |
| 68 WORKER_FAILURE = 10, | 68 WORKER_FAILURE = 10, |
| 69 GET_CERT_RESULT_MAX | 69 GET_CERT_RESULT_MAX |
| 70 }; | 70 }; |
| 71 | 71 |
| 72 void RecordGetDomainBoundCertResult(GetCertResult result) { | 72 void RecordGetDomainBoundCertResult(GetCertResult result) { |
| 73 UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.GetDomainBoundCertResult", result, | 73 UMA_HISTOGRAM_ENUMERATION( |
| 74 GET_CERT_RESULT_MAX); | 74 "DomainBoundCerts.GetDomainBoundCertResult", result, GET_CERT_RESULT_MAX); |
| 75 } | 75 } |
| 76 | 76 |
| 77 void RecordGetCertTime(base::TimeDelta request_time) { | 77 void RecordGetCertTime(base::TimeDelta request_time) { |
| 78 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTime", | 78 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTime", |
| 79 request_time, | 79 request_time, |
| 80 base::TimeDelta::FromMilliseconds(1), | 80 base::TimeDelta::FromMilliseconds(1), |
| 81 base::TimeDelta::FromMinutes(5), | 81 base::TimeDelta::FromMinutes(5), |
| 82 50); | 82 50); |
| 83 } | 83 } |
| 84 | 84 |
| (...skipping 18 matching lines...) Expand all Loading... |
| 103 serial_number, | 103 serial_number, |
| 104 not_valid_before, | 104 not_valid_before, |
| 105 not_valid_after, | 105 not_valid_after, |
| 106 &key, | 106 &key, |
| 107 &der_cert)) { | 107 &der_cert)) { |
| 108 DLOG(ERROR) << "Unable to create x509 cert for client"; | 108 DLOG(ERROR) << "Unable to create x509 cert for client"; |
| 109 *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED; | 109 *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED; |
| 110 return result.Pass(); | 110 return result.Pass(); |
| 111 } | 111 } |
| 112 | 112 |
| 113 if (!key->ExportEncryptedPrivateKey(ServerBoundCertService::kEPKIPassword, | 113 if (!key->ExportEncryptedPrivateKey( |
| 114 1, &private_key_info)) { | 114 ServerBoundCertService::kEPKIPassword, 1, &private_key_info)) { |
| 115 DLOG(ERROR) << "Unable to export private key"; | 115 DLOG(ERROR) << "Unable to export private key"; |
| 116 *error = ERR_PRIVATE_KEY_EXPORT_FAILED; | 116 *error = ERR_PRIVATE_KEY_EXPORT_FAILED; |
| 117 return result.Pass(); | 117 return result.Pass(); |
| 118 } | 118 } |
| 119 | 119 |
| 120 // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a | 120 // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a |
| 121 // std::string* to prevent this copying. | 121 // std::string* to prevent this copying. |
| 122 std::string key_out(private_key_info.begin(), private_key_info.end()); | 122 std::string key_out(private_key_info.begin(), private_key_info.end()); |
| 123 | 123 |
| 124 result.reset(new ServerBoundCertStore::ServerBoundCert( | 124 result.reset(new ServerBoundCertStore::ServerBoundCert( |
| 125 server_identifier, | 125 server_identifier, not_valid_before, not_valid_after, key_out, der_cert)); |
| 126 not_valid_before, | |
| 127 not_valid_after, | |
| 128 key_out, | |
| 129 der_cert)); | |
| 130 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime", | 126 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime", |
| 131 base::TimeTicks::Now() - start, | 127 base::TimeTicks::Now() - start, |
| 132 base::TimeDelta::FromMilliseconds(1), | 128 base::TimeDelta::FromMilliseconds(1), |
| 133 base::TimeDelta::FromMinutes(5), | 129 base::TimeDelta::FromMinutes(5), |
| 134 50); | 130 50); |
| 135 *error = OK; | 131 *error = OK; |
| 136 return result.Pass(); | 132 return result.Pass(); |
| 137 } | 133 } |
| 138 | 134 |
| 139 } // namespace | 135 } // namespace |
| 140 | 136 |
| 141 // Represents the output and result callback of a request. | 137 // Represents the output and result callback of a request. |
| 142 class ServerBoundCertServiceRequest { | 138 class ServerBoundCertServiceRequest { |
| 143 public: | 139 public: |
| 144 ServerBoundCertServiceRequest(base::TimeTicks request_start, | 140 ServerBoundCertServiceRequest(base::TimeTicks request_start, |
| 145 const CompletionCallback& callback, | 141 const CompletionCallback& callback, |
| 146 std::string* private_key, | 142 std::string* private_key, |
| 147 std::string* cert) | 143 std::string* cert) |
| 148 : request_start_(request_start), | 144 : request_start_(request_start), |
| 149 callback_(callback), | 145 callback_(callback), |
| 150 private_key_(private_key), | 146 private_key_(private_key), |
| 151 cert_(cert) { | 147 cert_(cert) {} |
| 152 } | |
| 153 | 148 |
| 154 // Ensures that the result callback will never be made. | 149 // Ensures that the result callback will never be made. |
| 155 void Cancel() { | 150 void Cancel() { |
| 156 RecordGetDomainBoundCertResult(ASYNC_CANCELLED); | 151 RecordGetDomainBoundCertResult(ASYNC_CANCELLED); |
| 157 callback_.Reset(); | 152 callback_.Reset(); |
| 158 private_key_ = NULL; | 153 private_key_ = NULL; |
| 159 cert_ = NULL; | 154 cert_ = NULL; |
| 160 } | 155 } |
| 161 | 156 |
| 162 // Copies the contents of |private_key| and |cert| to the caller's output | 157 // Copies the contents of |private_key| and |cert| to the caller's output |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 212 // ServerBoundCertServiceWorker runs on a worker thread and takes care of the | 207 // ServerBoundCertServiceWorker runs on a worker thread and takes care of the |
| 213 // blocking process of performing key generation. Will take care of deleting | 208 // blocking process of performing key generation. Will take care of deleting |
| 214 // itself once Start() is called. | 209 // itself once Start() is called. |
| 215 class ServerBoundCertServiceWorker { | 210 class ServerBoundCertServiceWorker { |
| 216 public: | 211 public: |
| 217 typedef base::Callback<void( | 212 typedef base::Callback<void( |
| 218 const std::string&, | 213 const std::string&, |
| 219 int, | 214 int, |
| 220 scoped_ptr<ServerBoundCertStore::ServerBoundCert>)> WorkerDoneCallback; | 215 scoped_ptr<ServerBoundCertStore::ServerBoundCert>)> WorkerDoneCallback; |
| 221 | 216 |
| 222 ServerBoundCertServiceWorker( | 217 ServerBoundCertServiceWorker(const std::string& server_identifier, |
| 223 const std::string& server_identifier, | 218 const WorkerDoneCallback& callback) |
| 224 const WorkerDoneCallback& callback) | |
| 225 : server_identifier_(server_identifier), | 219 : server_identifier_(server_identifier), |
| 226 serial_number_(base::RandInt(0, std::numeric_limits<int>::max())), | 220 serial_number_(base::RandInt(0, std::numeric_limits<int>::max())), |
| 227 origin_loop_(base::MessageLoopProxy::current()), | 221 origin_loop_(base::MessageLoopProxy::current()), |
| 228 callback_(callback) { | 222 callback_(callback) {} |
| 229 } | |
| 230 | 223 |
| 231 // Starts the worker on |task_runner|. If the worker fails to start, such as | 224 // Starts the worker on |task_runner|. If the worker fails to start, such as |
| 232 // if the task runner is shutting down, then it will take care of deleting | 225 // if the task runner is shutting down, then it will take care of deleting |
| 233 // itself. | 226 // itself. |
| 234 bool Start(const scoped_refptr<base::TaskRunner>& task_runner) { | 227 bool Start(const scoped_refptr<base::TaskRunner>& task_runner) { |
| 235 DCHECK(origin_loop_->RunsTasksOnCurrentThread()); | 228 DCHECK(origin_loop_->RunsTasksOnCurrentThread()); |
| 236 | 229 |
| 237 return task_runner->PostTask( | 230 return task_runner->PostTask( |
| 238 FROM_HERE, | 231 FROM_HERE, |
| 239 base::Bind(&ServerBoundCertServiceWorker::Run, base::Owned(this))); | 232 base::Bind(&ServerBoundCertServiceWorker::Run, base::Owned(this))); |
| 240 } | 233 } |
| 241 | 234 |
| 242 private: | 235 private: |
| 243 void Run() { | 236 void Run() { |
| 244 // Runs on a worker thread. | 237 // Runs on a worker thread. |
| 245 int error = ERR_FAILED; | 238 int error = ERR_FAILED; |
| 246 scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert = | 239 scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert = |
| 247 GenerateCert(server_identifier_, serial_number_, &error); | 240 GenerateCert(server_identifier_, serial_number_, &error); |
| 248 DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error; | 241 DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error; |
| 249 #if defined(USE_NSS) | 242 #if defined(USE_NSS) |
| 250 // Detach the thread from NSPR. | 243 // Detach the thread from NSPR. |
| 251 // Calling NSS functions attaches the thread to NSPR, which stores | 244 // Calling NSS functions attaches the thread to NSPR, which stores |
| 252 // the NSPR thread ID in thread-specific data. | 245 // the NSPR thread ID in thread-specific data. |
| 253 // The threads in our thread pool terminate after we have called | 246 // The threads in our thread pool terminate after we have called |
| 254 // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets | 247 // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets |
| 255 // segfaults on shutdown when the threads' thread-specific data | 248 // segfaults on shutdown when the threads' thread-specific data |
| 256 // destructors run. | 249 // destructors run. |
| 257 PR_DetachThread(); | 250 PR_DetachThread(); |
| 258 #endif | 251 #endif |
| 259 origin_loop_->PostTask(FROM_HERE, | 252 origin_loop_->PostTask( |
| 260 base::Bind(callback_, server_identifier_, error, | 253 FROM_HERE, |
| 261 base::Passed(&cert))); | 254 base::Bind(callback_, server_identifier_, error, base::Passed(&cert))); |
| 262 } | 255 } |
| 263 | 256 |
| 264 const std::string server_identifier_; | 257 const std::string server_identifier_; |
| 265 // Note that serial_number_ must be initialized on a non-worker thread | 258 // Note that serial_number_ must be initialized on a non-worker thread |
| 266 // (see documentation for GenerateCert). | 259 // (see documentation for GenerateCert). |
| 267 uint32 serial_number_; | 260 uint32 serial_number_; |
| 268 scoped_refptr<base::SequencedTaskRunner> origin_loop_; | 261 scoped_refptr<base::SequencedTaskRunner> origin_loop_; |
| 269 WorkerDoneCallback callback_; | 262 WorkerDoneCallback callback_; |
| 270 | 263 |
| 271 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertServiceWorker); | 264 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertServiceWorker); |
| 272 }; | 265 }; |
| 273 | 266 |
| 274 // A ServerBoundCertServiceJob is a one-to-one counterpart of an | 267 // A ServerBoundCertServiceJob is a one-to-one counterpart of an |
| 275 // ServerBoundCertServiceWorker. It lives only on the ServerBoundCertService's | 268 // ServerBoundCertServiceWorker. It lives only on the ServerBoundCertService's |
| 276 // origin message loop. | 269 // origin message loop. |
| 277 class ServerBoundCertServiceJob { | 270 class ServerBoundCertServiceJob { |
| 278 public: | 271 public: |
| 279 ServerBoundCertServiceJob(bool create_if_missing) | 272 ServerBoundCertServiceJob(bool create_if_missing) |
| 280 : create_if_missing_(create_if_missing) { | 273 : create_if_missing_(create_if_missing) {} |
| 281 } | |
| 282 | 274 |
| 283 ~ServerBoundCertServiceJob() { | 275 ~ServerBoundCertServiceJob() { |
| 284 if (!requests_.empty()) | 276 if (!requests_.empty()) |
| 285 DeleteAllCanceled(); | 277 DeleteAllCanceled(); |
| 286 } | 278 } |
| 287 | 279 |
| 288 void AddRequest(ServerBoundCertServiceRequest* request, | 280 void AddRequest(ServerBoundCertServiceRequest* request, |
| 289 bool create_if_missing = false) { | 281 bool create_if_missing = false) { |
| 290 create_if_missing_ |= create_if_missing; | 282 create_if_missing_ |= create_if_missing; |
| 291 requests_.push_back(request); | 283 requests_.push_back(request); |
| 292 } | 284 } |
| 293 | 285 |
| 294 void HandleResult(int error, | 286 void HandleResult(int error, |
| 295 const std::string& private_key, | 287 const std::string& private_key, |
| 296 const std::string& cert) { | 288 const std::string& cert) { |
| 297 PostAll(error, private_key, cert); | 289 PostAll(error, private_key, cert); |
| 298 } | 290 } |
| 299 | 291 |
| 300 bool CreateIfMissing() const { return create_if_missing_; } | 292 bool CreateIfMissing() const { return create_if_missing_; } |
| 301 | 293 |
| 302 private: | 294 private: |
| 303 void PostAll(int error, | 295 void PostAll(int error, |
| 304 const std::string& private_key, | 296 const std::string& private_key, |
| 305 const std::string& cert) { | 297 const std::string& cert) { |
| 306 std::vector<ServerBoundCertServiceRequest*> requests; | 298 std::vector<ServerBoundCertServiceRequest*> requests; |
| 307 requests_.swap(requests); | 299 requests_.swap(requests); |
| 308 | 300 |
| 309 for (std::vector<ServerBoundCertServiceRequest*>::iterator | 301 for (std::vector<ServerBoundCertServiceRequest*>::iterator i = |
| 310 i = requests.begin(); i != requests.end(); i++) { | 302 requests.begin(); |
| 303 i != requests.end(); |
| 304 i++) { |
| 311 (*i)->Post(error, private_key, cert); | 305 (*i)->Post(error, private_key, cert); |
| 312 // Post() causes the ServerBoundCertServiceRequest to delete itself. | 306 // Post() causes the ServerBoundCertServiceRequest to delete itself. |
| 313 } | 307 } |
| 314 } | 308 } |
| 315 | 309 |
| 316 void DeleteAllCanceled() { | 310 void DeleteAllCanceled() { |
| 317 for (std::vector<ServerBoundCertServiceRequest*>::iterator | 311 for (std::vector<ServerBoundCertServiceRequest*>::iterator i = |
| 318 i = requests_.begin(); i != requests_.end(); i++) { | 312 requests_.begin(); |
| 313 i != requests_.end(); |
| 314 i++) { |
| 319 if ((*i)->canceled()) { | 315 if ((*i)->canceled()) { |
| 320 delete *i; | 316 delete *i; |
| 321 } else { | 317 } else { |
| 322 LOG(DFATAL) << "ServerBoundCertServiceRequest leaked!"; | 318 LOG(DFATAL) << "ServerBoundCertServiceRequest leaked!"; |
| 323 } | 319 } |
| 324 } | 320 } |
| 325 } | 321 } |
| 326 | 322 |
| 327 std::vector<ServerBoundCertServiceRequest*> requests_; | 323 std::vector<ServerBoundCertServiceRequest*> requests_; |
| 328 bool create_if_missing_; | 324 bool create_if_missing_; |
| 329 }; | 325 }; |
| 330 | 326 |
| 331 // static | 327 // static |
| 332 const char ServerBoundCertService::kEPKIPassword[] = ""; | 328 const char ServerBoundCertService::kEPKIPassword[] = ""; |
| 333 | 329 |
| 334 ServerBoundCertService::RequestHandle::RequestHandle() | 330 ServerBoundCertService::RequestHandle::RequestHandle() |
| 335 : service_(NULL), | 331 : service_(NULL), request_(NULL) { |
| 336 request_(NULL) {} | 332 } |
| 337 | 333 |
| 338 ServerBoundCertService::RequestHandle::~RequestHandle() { | 334 ServerBoundCertService::RequestHandle::~RequestHandle() { |
| 339 Cancel(); | 335 Cancel(); |
| 340 } | 336 } |
| 341 | 337 |
| 342 void ServerBoundCertService::RequestHandle::Cancel() { | 338 void ServerBoundCertService::RequestHandle::Cancel() { |
| 343 if (request_) { | 339 if (request_) { |
| 344 service_->CancelRequest(request_); | 340 service_->CancelRequest(request_); |
| 345 request_ = NULL; | 341 request_ = NULL; |
| 346 callback_.Reset(); | 342 callback_.Reset(); |
| (...skipping 21 matching lines...) Expand all Loading... |
| 368 ServerBoundCertStore* server_bound_cert_store, | 364 ServerBoundCertStore* server_bound_cert_store, |
| 369 const scoped_refptr<base::TaskRunner>& task_runner) | 365 const scoped_refptr<base::TaskRunner>& task_runner) |
| 370 : server_bound_cert_store_(server_bound_cert_store), | 366 : server_bound_cert_store_(server_bound_cert_store), |
| 371 task_runner_(task_runner), | 367 task_runner_(task_runner), |
| 372 requests_(0), | 368 requests_(0), |
| 373 cert_store_hits_(0), | 369 cert_store_hits_(0), |
| 374 inflight_joins_(0), | 370 inflight_joins_(0), |
| 375 workers_created_(0), | 371 workers_created_(0), |
| 376 weak_ptr_factory_(this) { | 372 weak_ptr_factory_(this) { |
| 377 base::Time start = base::Time::Now(); | 373 base::Time start = base::Time::Now(); |
| 378 base::Time end = start + base::TimeDelta::FromDays( | 374 base::Time end = |
| 379 kValidityPeriodInDays + kSystemTimeValidityBufferInDays); | 375 start + base::TimeDelta::FromDays(kValidityPeriodInDays + |
| 376 kSystemTimeValidityBufferInDays); |
| 380 is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end); | 377 is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end); |
| 381 } | 378 } |
| 382 | 379 |
| 383 ServerBoundCertService::~ServerBoundCertService() { | 380 ServerBoundCertService::~ServerBoundCertService() { |
| 384 STLDeleteValues(&inflight_); | 381 STLDeleteValues(&inflight_); |
| 385 } | 382 } |
| 386 | 383 |
| 387 //static | 384 // static |
| 388 std::string ServerBoundCertService::GetDomainForHost(const std::string& host) { | 385 std::string ServerBoundCertService::GetDomainForHost(const std::string& host) { |
| 389 std::string domain = | 386 std::string domain = registry_controlled_domains::GetDomainAndRegistry( |
| 390 registry_controlled_domains::GetDomainAndRegistry( | 387 host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); |
| 391 host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); | |
| 392 if (domain.empty()) | 388 if (domain.empty()) |
| 393 return host; | 389 return host; |
| 394 return domain; | 390 return domain; |
| 395 } | 391 } |
| 396 | 392 |
| 397 int ServerBoundCertService::GetOrCreateDomainBoundCert( | 393 int ServerBoundCertService::GetOrCreateDomainBoundCert( |
| 398 const std::string& host, | 394 const std::string& host, |
| 399 std::string* private_key, | 395 std::string* private_key, |
| 400 std::string* cert, | 396 std::string* cert, |
| 401 const CompletionCallback& callback, | 397 const CompletionCallback& callback, |
| (...skipping 10 matching lines...) Expand all Loading... |
| 412 std::string domain = GetDomainForHost(host); | 408 std::string domain = GetDomainForHost(host); |
| 413 if (domain.empty()) { | 409 if (domain.empty()) { |
| 414 RecordGetDomainBoundCertResult(INVALID_ARGUMENT); | 410 RecordGetDomainBoundCertResult(INVALID_ARGUMENT); |
| 415 return ERR_INVALID_ARGUMENT; | 411 return ERR_INVALID_ARGUMENT; |
| 416 } | 412 } |
| 417 | 413 |
| 418 requests_++; | 414 requests_++; |
| 419 | 415 |
| 420 // See if a request for the same domain is currently in flight. | 416 // See if a request for the same domain is currently in flight. |
| 421 bool create_if_missing = true; | 417 bool create_if_missing = true; |
| 422 if (JoinToInFlightRequest(request_start, domain, private_key, cert, | 418 if (JoinToInFlightRequest(request_start, |
| 423 create_if_missing, callback, out_req)) { | 419 domain, |
| 420 private_key, |
| 421 cert, |
| 422 create_if_missing, |
| 423 callback, |
| 424 out_req)) { |
| 424 return ERR_IO_PENDING; | 425 return ERR_IO_PENDING; |
| 425 } | 426 } |
| 426 | 427 |
| 427 int err = LookupDomainBoundCert(request_start, domain, private_key, cert, | 428 int err = LookupDomainBoundCert(request_start, |
| 428 create_if_missing, callback, out_req); | 429 domain, |
| 430 private_key, |
| 431 cert, |
| 432 create_if_missing, |
| 433 callback, |
| 434 out_req); |
| 429 if (err == ERR_FILE_NOT_FOUND) { | 435 if (err == ERR_FILE_NOT_FOUND) { |
| 430 // Sync lookup did not find a valid cert. Start generating a new one. | 436 // Sync lookup did not find a valid cert. Start generating a new one. |
| 431 workers_created_++; | 437 workers_created_++; |
| 432 ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker( | 438 ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker( |
| 433 domain, | 439 domain, |
| 434 base::Bind(&ServerBoundCertService::GeneratedServerBoundCert, | 440 base::Bind(&ServerBoundCertService::GeneratedServerBoundCert, |
| 435 weak_ptr_factory_.GetWeakPtr())); | 441 weak_ptr_factory_.GetWeakPtr())); |
| 436 if (!worker->Start(task_runner_)) { | 442 if (!worker->Start(task_runner_)) { |
| 437 // TODO(rkn): Log to the NetLog. | 443 // TODO(rkn): Log to the NetLog. |
| 438 LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started."; | 444 LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started."; |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 476 std::string domain = GetDomainForHost(host); | 482 std::string domain = GetDomainForHost(host); |
| 477 if (domain.empty()) { | 483 if (domain.empty()) { |
| 478 RecordGetDomainBoundCertResult(INVALID_ARGUMENT); | 484 RecordGetDomainBoundCertResult(INVALID_ARGUMENT); |
| 479 return ERR_INVALID_ARGUMENT; | 485 return ERR_INVALID_ARGUMENT; |
| 480 } | 486 } |
| 481 | 487 |
| 482 requests_++; | 488 requests_++; |
| 483 | 489 |
| 484 // See if a request for the same domain currently in flight. | 490 // See if a request for the same domain currently in flight. |
| 485 bool create_if_missing = false; | 491 bool create_if_missing = false; |
| 486 if (JoinToInFlightRequest(request_start, domain, private_key, cert, | 492 if (JoinToInFlightRequest(request_start, |
| 487 create_if_missing, callback, out_req)) { | 493 domain, |
| 494 private_key, |
| 495 cert, |
| 496 create_if_missing, |
| 497 callback, |
| 498 out_req)) { |
| 488 return ERR_IO_PENDING; | 499 return ERR_IO_PENDING; |
| 489 } | 500 } |
| 490 | 501 |
| 491 int err = LookupDomainBoundCert(request_start, domain, private_key, cert, | 502 int err = LookupDomainBoundCert(request_start, |
| 492 create_if_missing, callback, out_req); | 503 domain, |
| 504 private_key, |
| 505 cert, |
| 506 create_if_missing, |
| 507 callback, |
| 508 out_req); |
| 493 return err; | 509 return err; |
| 494 } | 510 } |
| 495 | 511 |
| 496 void ServerBoundCertService::GotServerBoundCert( | 512 void ServerBoundCertService::GotServerBoundCert( |
| 497 int err, | 513 int err, |
| 498 const std::string& server_identifier, | 514 const std::string& server_identifier, |
| 499 base::Time expiration_time, | 515 base::Time expiration_time, |
| 500 const std::string& key, | 516 const std::string& key, |
| 501 const std::string& cert) { | 517 const std::string& cert) { |
| 502 DCHECK(CalledOnValidThread()); | 518 DCHECK(CalledOnValidThread()); |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 549 | 565 |
| 550 void ServerBoundCertService::GeneratedServerBoundCert( | 566 void ServerBoundCertService::GeneratedServerBoundCert( |
| 551 const std::string& server_identifier, | 567 const std::string& server_identifier, |
| 552 int error, | 568 int error, |
| 553 scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert) { | 569 scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert) { |
| 554 DCHECK(CalledOnValidThread()); | 570 DCHECK(CalledOnValidThread()); |
| 555 | 571 |
| 556 if (error == OK) { | 572 if (error == OK) { |
| 557 // TODO(mattm): we should just Pass() the cert object to | 573 // TODO(mattm): we should just Pass() the cert object to |
| 558 // SetServerBoundCert(). | 574 // SetServerBoundCert(). |
| 559 server_bound_cert_store_->SetServerBoundCert( | 575 server_bound_cert_store_->SetServerBoundCert(cert->server_identifier(), |
| 560 cert->server_identifier(), | 576 cert->creation_time(), |
| 561 cert->creation_time(), | 577 cert->expiration_time(), |
| 562 cert->expiration_time(), | 578 cert->private_key(), |
| 563 cert->private_key(), | 579 cert->cert()); |
| 564 cert->cert()); | |
| 565 | 580 |
| 566 HandleResult(error, server_identifier, cert->private_key(), cert->cert()); | 581 HandleResult(error, server_identifier, cert->private_key(), cert->cert()); |
| 567 } else { | 582 } else { |
| 568 HandleResult(error, server_identifier, std::string(), std::string()); | 583 HandleResult(error, server_identifier, std::string(), std::string()); |
| 569 } | 584 } |
| 570 } | 585 } |
| 571 | 586 |
| 572 void ServerBoundCertService::HandleResult( | 587 void ServerBoundCertService::HandleResult(int error, |
| 573 int error, | 588 const std::string& server_identifier, |
| 574 const std::string& server_identifier, | 589 const std::string& private_key, |
| 575 const std::string& private_key, | 590 const std::string& cert) { |
| 576 const std::string& cert) { | |
| 577 DCHECK(CalledOnValidThread()); | 591 DCHECK(CalledOnValidThread()); |
| 578 | 592 |
| 579 std::map<std::string, ServerBoundCertServiceJob*>::iterator j; | 593 std::map<std::string, ServerBoundCertServiceJob*>::iterator j; |
| 580 j = inflight_.find(server_identifier); | 594 j = inflight_.find(server_identifier); |
| 581 if (j == inflight_.end()) { | 595 if (j == inflight_.end()) { |
| 582 NOTREACHED(); | 596 NOTREACHED(); |
| 583 return; | 597 return; |
| 584 } | 598 } |
| 585 ServerBoundCertServiceJob* job = j->second; | 599 ServerBoundCertServiceJob* job = j->second; |
| 586 inflight_.erase(j); | 600 inflight_.erase(j); |
| (...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 625 std::string* private_key, | 639 std::string* private_key, |
| 626 std::string* cert, | 640 std::string* cert, |
| 627 bool create_if_missing, | 641 bool create_if_missing, |
| 628 const CompletionCallback& callback, | 642 const CompletionCallback& callback, |
| 629 RequestHandle* out_req) { | 643 RequestHandle* out_req) { |
| 630 // Check if a domain bound cert already exists for this domain. Note that | 644 // Check if a domain bound cert already exists for this domain. Note that |
| 631 // |expiration_time| is ignored, and expired certs are considered valid. | 645 // |expiration_time| is ignored, and expired certs are considered valid. |
| 632 base::Time expiration_time; | 646 base::Time expiration_time; |
| 633 int err = server_bound_cert_store_->GetServerBoundCert( | 647 int err = server_bound_cert_store_->GetServerBoundCert( |
| 634 domain, | 648 domain, |
| 635 &expiration_time /* ignored */, | 649 &expiration_time /* ignored */, |
| 636 private_key, | 650 private_key, |
| 637 cert, | 651 cert, |
| 638 base::Bind(&ServerBoundCertService::GotServerBoundCert, | 652 base::Bind(&ServerBoundCertService::GotServerBoundCert, |
| 639 weak_ptr_factory_.GetWeakPtr())); | 653 weak_ptr_factory_.GetWeakPtr())); |
| 640 | 654 |
| 641 if (err == OK) { | 655 if (err == OK) { |
| 642 // Sync lookup found a valid cert. | 656 // Sync lookup found a valid cert. |
| 643 DVLOG(1) << "Cert store had valid cert for " << domain; | 657 DVLOG(1) << "Cert store had valid cert for " << domain; |
| 644 cert_store_hits_++; | 658 cert_store_hits_++; |
| 645 RecordGetDomainBoundCertResult(SYNC_SUCCESS); | 659 RecordGetDomainBoundCertResult(SYNC_SUCCESS); |
| (...skipping 21 matching lines...) Expand all Loading... |
| 667 } | 681 } |
| 668 | 682 |
| 669 return err; | 683 return err; |
| 670 } | 684 } |
| 671 | 685 |
| 672 int ServerBoundCertService::cert_count() { | 686 int ServerBoundCertService::cert_count() { |
| 673 return server_bound_cert_store_->GetCertCount(); | 687 return server_bound_cert_store_->GetCertCount(); |
| 674 } | 688 } |
| 675 | 689 |
| 676 } // namespace net | 690 } // namespace net |
| OLD | NEW |