| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 5 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
| 6 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 6 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| (...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 67 }; | 67 }; |
| 68 | 68 |
| 69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key | 69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key |
| 70 // values. (This is not used to provide any security, but to workaround NSS | 70 // values. (This is not used to provide any security, but to workaround NSS |
| 71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) | 71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) |
| 72 static const char kEPKIPassword[]; | 72 static const char kEPKIPassword[]; |
| 73 | 73 |
| 74 // This object owns |server_bound_cert_store|. |task_runner| will | 74 // This object owns |server_bound_cert_store|. |task_runner| will |
| 75 // be used to post certificate generation worker tasks. The tasks are | 75 // be used to post certificate generation worker tasks. The tasks are |
| 76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. | 76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. |
| 77 ServerBoundCertService( | 77 ServerBoundCertService(ServerBoundCertStore* server_bound_cert_store, |
| 78 ServerBoundCertStore* server_bound_cert_store, | 78 const scoped_refptr<base::TaskRunner>& task_runner); |
| 79 const scoped_refptr<base::TaskRunner>& task_runner); | |
| 80 | 79 |
| 81 ~ServerBoundCertService(); | 80 ~ServerBoundCertService(); |
| 82 | 81 |
| 83 // Returns the domain to be used for |host|. The domain is the | 82 // Returns the domain to be used for |host|. The domain is the |
| 84 // "registry controlled domain", or the "ETLD + 1" where one exists, or | 83 // "registry controlled domain", or the "ETLD + 1" where one exists, or |
| 85 // the origin otherwise. | 84 // the origin otherwise. |
| 86 static std::string GetDomainForHost(const std::string& host); | 85 static std::string GetDomainForHost(const std::string& host); |
| 87 | 86 |
| 88 // Tests whether the system time is within the supported range for | 87 // Tests whether the system time is within the supported range for |
| 89 // certificate generation. This value is cached when ServerBoundCertService | 88 // certificate generation. This value is cached when ServerBoundCertService |
| 90 // is created, so if the system time is changed by a huge amount, this may no | 89 // is created, so if the system time is changed by a huge amount, this may no |
| 91 // longer hold. | 90 // longer hold. |
| 92 bool IsSystemTimeValid() const { return is_system_time_valid_; } | 91 bool IsSystemTimeValid() const { return is_system_time_valid_; } |
| 93 | 92 |
| 94 // Fetches the domain bound cert for the specified host if one exists and | 93 // Fetches the domain bound cert for the specified host if one exists and |
| 95 // creates one otherwise. Returns OK if successful or an error code upon | 94 // creates one otherwise. Returns OK if successful or an error code upon |
| 96 // failure. | 95 // failure. |
| 97 // | 96 // |
| 98 // On successful completion, |private_key| stores a DER-encoded | 97 // On successful completion, |private_key| stores a DER-encoded |
| 99 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 98 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
| 100 // The PrivateKeyInfo is always an ECDSA private key. | 99 // The PrivateKeyInfo is always an ECDSA private key. |
| 101 // | 100 // |
| 102 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 101 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
| 103 // could not be completed immediately, in which case the result code will | 102 // could not be completed immediately, in which case the result code will |
| 104 // be passed to the callback when available. | 103 // be passed to the callback when available. |
| 105 // | 104 // |
| 106 // |*out_req| will be initialized with a handle to the async request. This | 105 // |*out_req| will be initialized with a handle to the async request. This |
| 107 // RequestHandle object must be cancelled or destroyed before the | 106 // RequestHandle object must be cancelled or destroyed before the |
| 108 // ServerBoundCertService is destroyed. | 107 // ServerBoundCertService is destroyed. |
| 109 int GetOrCreateDomainBoundCert( | 108 int GetOrCreateDomainBoundCert(const std::string& host, |
| 110 const std::string& host, | 109 std::string* private_key, |
| 111 std::string* private_key, | 110 std::string* cert, |
| 112 std::string* cert, | 111 const CompletionCallback& callback, |
| 113 const CompletionCallback& callback, | 112 RequestHandle* out_req); |
| 114 RequestHandle* out_req); | |
| 115 | 113 |
| 116 // Fetches the domain bound cert for the specified host if one exists. | 114 // Fetches the domain bound cert for the specified host if one exists. |
| 117 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error | 115 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error |
| 118 // code upon failure. | 116 // code upon failure. |
| 119 // | 117 // |
| 120 // On successful completion, |private_key| stores a DER-encoded | 118 // On successful completion, |private_key| stores a DER-encoded |
| 121 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 119 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
| 122 // The PrivateKeyInfo is always an ECDSA private key. | 120 // The PrivateKeyInfo is always an ECDSA private key. |
| 123 // | 121 // |
| 124 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 122 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
| 125 // could not be completed immediately, in which case the result code will | 123 // could not be completed immediately, in which case the result code will |
| 126 // be passed to the callback when available. If an in-flight | 124 // be passed to the callback when available. If an in-flight |
| 127 // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert | 125 // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert |
| 128 // request arrives for the same domain, the GetDomainBoundCert request will | 126 // request arrives for the same domain, the GetDomainBoundCert request will |
| 129 // not complete until a new cert is created. | 127 // not complete until a new cert is created. |
| 130 // | 128 // |
| 131 // |*out_req| will be initialized with a handle to the async request. This | 129 // |*out_req| will be initialized with a handle to the async request. This |
| 132 // RequestHandle object must be cancelled or destroyed before the | 130 // RequestHandle object must be cancelled or destroyed before the |
| 133 // ServerBoundCertService is destroyed. | 131 // ServerBoundCertService is destroyed. |
| 134 int GetDomainBoundCert( | 132 int GetDomainBoundCert(const std::string& host, |
| 135 const std::string& host, | 133 std::string* private_key, |
| 136 std::string* private_key, | 134 std::string* cert, |
| 137 std::string* cert, | 135 const CompletionCallback& callback, |
| 138 const CompletionCallback& callback, | 136 RequestHandle* out_req); |
| 139 RequestHandle* out_req); | |
| 140 | 137 |
| 141 // Returns the backing ServerBoundCertStore. | 138 // Returns the backing ServerBoundCertStore. |
| 142 ServerBoundCertStore* GetCertStore(); | 139 ServerBoundCertStore* GetCertStore(); |
| 143 | 140 |
| 144 // Public only for unit testing. | 141 // Public only for unit testing. |
| 145 int cert_count(); | 142 int cert_count(); |
| 146 uint64 requests() const { return requests_; } | 143 uint64 requests() const { return requests_; } |
| 147 uint64 cert_store_hits() const { return cert_store_hits_; } | 144 uint64 cert_store_hits() const { return cert_store_hits_; } |
| 148 uint64 inflight_joins() const { return inflight_joins_; } | 145 uint64 inflight_joins() const { return inflight_joins_; } |
| 149 uint64 workers_created() const { return workers_created_; } | 146 uint64 workers_created() const { return workers_created_; } |
| (...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 206 bool is_system_time_valid_; | 203 bool is_system_time_valid_; |
| 207 | 204 |
| 208 base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; | 205 base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; |
| 209 | 206 |
| 210 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); | 207 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); |
| 211 }; | 208 }; |
| 212 | 209 |
| 213 } // namespace net | 210 } // namespace net |
| 214 | 211 |
| 215 #endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 212 #endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
| OLD | NEW |