OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 5 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
6 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 6 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
(...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
67 }; | 67 }; |
68 | 68 |
69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key | 69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key |
70 // values. (This is not used to provide any security, but to workaround NSS | 70 // values. (This is not used to provide any security, but to workaround NSS |
71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) | 71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) |
72 static const char kEPKIPassword[]; | 72 static const char kEPKIPassword[]; |
73 | 73 |
74 // This object owns |server_bound_cert_store|. |task_runner| will | 74 // This object owns |server_bound_cert_store|. |task_runner| will |
75 // be used to post certificate generation worker tasks. The tasks are | 75 // be used to post certificate generation worker tasks. The tasks are |
76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. | 76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. |
77 ServerBoundCertService( | 77 ServerBoundCertService(ServerBoundCertStore* server_bound_cert_store, |
78 ServerBoundCertStore* server_bound_cert_store, | 78 const scoped_refptr<base::TaskRunner>& task_runner); |
79 const scoped_refptr<base::TaskRunner>& task_runner); | |
80 | 79 |
81 ~ServerBoundCertService(); | 80 ~ServerBoundCertService(); |
82 | 81 |
83 // Returns the domain to be used for |host|. The domain is the | 82 // Returns the domain to be used for |host|. The domain is the |
84 // "registry controlled domain", or the "ETLD + 1" where one exists, or | 83 // "registry controlled domain", or the "ETLD + 1" where one exists, or |
85 // the origin otherwise. | 84 // the origin otherwise. |
86 static std::string GetDomainForHost(const std::string& host); | 85 static std::string GetDomainForHost(const std::string& host); |
87 | 86 |
88 // Tests whether the system time is within the supported range for | 87 // Tests whether the system time is within the supported range for |
89 // certificate generation. This value is cached when ServerBoundCertService | 88 // certificate generation. This value is cached when ServerBoundCertService |
90 // is created, so if the system time is changed by a huge amount, this may no | 89 // is created, so if the system time is changed by a huge amount, this may no |
91 // longer hold. | 90 // longer hold. |
92 bool IsSystemTimeValid() const { return is_system_time_valid_; } | 91 bool IsSystemTimeValid() const { return is_system_time_valid_; } |
93 | 92 |
94 // Fetches the domain bound cert for the specified host if one exists and | 93 // Fetches the domain bound cert for the specified host if one exists and |
95 // creates one otherwise. Returns OK if successful or an error code upon | 94 // creates one otherwise. Returns OK if successful or an error code upon |
96 // failure. | 95 // failure. |
97 // | 96 // |
98 // On successful completion, |private_key| stores a DER-encoded | 97 // On successful completion, |private_key| stores a DER-encoded |
99 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 98 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
100 // The PrivateKeyInfo is always an ECDSA private key. | 99 // The PrivateKeyInfo is always an ECDSA private key. |
101 // | 100 // |
102 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 101 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
103 // could not be completed immediately, in which case the result code will | 102 // could not be completed immediately, in which case the result code will |
104 // be passed to the callback when available. | 103 // be passed to the callback when available. |
105 // | 104 // |
106 // |*out_req| will be initialized with a handle to the async request. This | 105 // |*out_req| will be initialized with a handle to the async request. This |
107 // RequestHandle object must be cancelled or destroyed before the | 106 // RequestHandle object must be cancelled or destroyed before the |
108 // ServerBoundCertService is destroyed. | 107 // ServerBoundCertService is destroyed. |
109 int GetOrCreateDomainBoundCert( | 108 int GetOrCreateDomainBoundCert(const std::string& host, |
110 const std::string& host, | 109 std::string* private_key, |
111 std::string* private_key, | 110 std::string* cert, |
112 std::string* cert, | 111 const CompletionCallback& callback, |
113 const CompletionCallback& callback, | 112 RequestHandle* out_req); |
114 RequestHandle* out_req); | |
115 | 113 |
116 // Fetches the domain bound cert for the specified host if one exists. | 114 // Fetches the domain bound cert for the specified host if one exists. |
117 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error | 115 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error |
118 // code upon failure. | 116 // code upon failure. |
119 // | 117 // |
120 // On successful completion, |private_key| stores a DER-encoded | 118 // On successful completion, |private_key| stores a DER-encoded |
121 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 119 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
122 // The PrivateKeyInfo is always an ECDSA private key. | 120 // The PrivateKeyInfo is always an ECDSA private key. |
123 // | 121 // |
124 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 122 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
125 // could not be completed immediately, in which case the result code will | 123 // could not be completed immediately, in which case the result code will |
126 // be passed to the callback when available. If an in-flight | 124 // be passed to the callback when available. If an in-flight |
127 // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert | 125 // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert |
128 // request arrives for the same domain, the GetDomainBoundCert request will | 126 // request arrives for the same domain, the GetDomainBoundCert request will |
129 // not complete until a new cert is created. | 127 // not complete until a new cert is created. |
130 // | 128 // |
131 // |*out_req| will be initialized with a handle to the async request. This | 129 // |*out_req| will be initialized with a handle to the async request. This |
132 // RequestHandle object must be cancelled or destroyed before the | 130 // RequestHandle object must be cancelled or destroyed before the |
133 // ServerBoundCertService is destroyed. | 131 // ServerBoundCertService is destroyed. |
134 int GetDomainBoundCert( | 132 int GetDomainBoundCert(const std::string& host, |
135 const std::string& host, | 133 std::string* private_key, |
136 std::string* private_key, | 134 std::string* cert, |
137 std::string* cert, | 135 const CompletionCallback& callback, |
138 const CompletionCallback& callback, | 136 RequestHandle* out_req); |
139 RequestHandle* out_req); | |
140 | 137 |
141 // Returns the backing ServerBoundCertStore. | 138 // Returns the backing ServerBoundCertStore. |
142 ServerBoundCertStore* GetCertStore(); | 139 ServerBoundCertStore* GetCertStore(); |
143 | 140 |
144 // Public only for unit testing. | 141 // Public only for unit testing. |
145 int cert_count(); | 142 int cert_count(); |
146 uint64 requests() const { return requests_; } | 143 uint64 requests() const { return requests_; } |
147 uint64 cert_store_hits() const { return cert_store_hits_; } | 144 uint64 cert_store_hits() const { return cert_store_hits_; } |
148 uint64 inflight_joins() const { return inflight_joins_; } | 145 uint64 inflight_joins() const { return inflight_joins_; } |
149 uint64 workers_created() const { return workers_created_; } | 146 uint64 workers_created() const { return workers_created_; } |
(...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 bool is_system_time_valid_; | 203 bool is_system_time_valid_; |
207 | 204 |
208 base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; | 205 base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; |
209 | 206 |
210 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); | 207 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); |
211 }; | 208 }; |
212 | 209 |
213 } // namespace net | 210 } // namespace net |
214 | 211 |
215 #endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 212 #endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
OLD | NEW |