| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/ssl/client_cert_store_nss.h" | 5 #include "net/ssl/client_cert_store_nss.h" |
| 6 | 6 |
| 7 #include <nss.h> | 7 #include <nss.h> |
| 8 #include <ssl.h> | 8 #include <ssl.h> |
| 9 | 9 |
| 10 #include <algorithm> | 10 #include <algorithm> |
| 11 #include <memory> | 11 #include <memory> |
| 12 #include <utility> | 12 #include <utility> |
| 13 #include <vector> | 13 #include <vector> |
| 14 | 14 |
| 15 #include "base/bind.h" | 15 #include "base/bind.h" |
| 16 #include "base/bind_helpers.h" | 16 #include "base/bind_helpers.h" |
| 17 #include "base/location.h" | 17 #include "base/location.h" |
| 18 #include "base/logging.h" | 18 #include "base/logging.h" |
| 19 #include "base/strings/string_piece.h" | 19 #include "base/strings/string_piece.h" |
| 20 #include "base/task_runner_util.h" | |
| 21 #include "base/threading/worker_pool.h" | 20 #include "base/threading/worker_pool.h" |
| 22 #include "crypto/nss_crypto_module_delegate.h" | 21 #include "crypto/nss_crypto_module_delegate.h" |
| 23 #include "net/cert/scoped_nss_types.h" | 22 #include "net/cert/scoped_nss_types.h" |
| 24 #include "net/cert/x509_util.h" | 23 #include "net/cert/x509_util.h" |
| 25 #include "net/ssl/ssl_cert_request_info.h" | 24 #include "net/ssl/ssl_cert_request_info.h" |
| 26 #include "net/third_party/nss/ssl/cmpcert.h" | 25 #include "net/third_party/nss/ssl/cmpcert.h" |
| 27 | 26 |
| 28 namespace net { | 27 namespace net { |
| 29 | 28 |
| 30 ClientCertStoreNSS::ClientCertStoreNSS( | 29 ClientCertStoreNSS::ClientCertStoreNSS( |
| 31 const PasswordDelegateFactory& password_delegate_factory) | 30 const PasswordDelegateFactory& password_delegate_factory) |
| 32 : password_delegate_factory_(password_delegate_factory) {} | 31 : password_delegate_factory_(password_delegate_factory) {} |
| 33 | 32 |
| 34 ClientCertStoreNSS::~ClientCertStoreNSS() {} | 33 ClientCertStoreNSS::~ClientCertStoreNSS() {} |
| 35 | 34 |
| 36 void ClientCertStoreNSS::GetClientCerts( | 35 void ClientCertStoreNSS::GetClientCerts(const SSLCertRequestInfo& request, |
| 37 const SSLCertRequestInfo& request, | 36 CertificateList* selected_certs, |
| 38 const ClientCertListCallback& callback) { | 37 const base::Closure& callback) { |
| 39 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 38 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
| 40 password_delegate; | 39 password_delegate; |
| 41 if (!password_delegate_factory_.is_null()) { | 40 if (!password_delegate_factory_.is_null()) { |
| 42 password_delegate.reset( | 41 password_delegate.reset( |
| 43 password_delegate_factory_.Run(request.host_and_port)); | 42 password_delegate_factory_.Run(request.host_and_port)); |
| 44 } | 43 } |
| 45 if (base::PostTaskAndReplyWithResult( | 44 if (base::WorkerPool::PostTaskAndReply( |
| 46 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), | |
| 47 FROM_HERE, | 45 FROM_HERE, |
| 48 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, | 46 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, |
| 49 // Caller is responsible for keeping the ClientCertStore | 47 // Caller is responsible for keeping the ClientCertStore |
| 50 // alive until the callback is run. | 48 // alive until the callback is run. |
| 51 base::Unretained(this), base::Passed(&password_delegate), | 49 base::Unretained(this), base::Passed(&password_delegate), |
| 52 &request), | 50 &request, selected_certs), |
| 53 callback)) { | 51 callback, true)) { |
| 54 return; | 52 return; |
| 55 } | 53 } |
| 56 // If the task could not be posted, behave as if there were no certificates. | 54 // If the task could not be posted, behave as if there were no certificates |
| 57 callback.Run(CertificateList()); | 55 // which requires to clear |selected_certs|. |
| 56 selected_certs->clear(); |
| 57 callback.Run(); |
| 58 } | 58 } |
| 59 | 59 |
| 60 // static | 60 // static |
| 61 void ClientCertStoreNSS::FilterCertsOnWorkerThread( | 61 void ClientCertStoreNSS::FilterCertsOnWorkerThread( |
| 62 const CertificateList& certs, | 62 const CertificateList& certs, |
| 63 const SSLCertRequestInfo& request, | 63 const SSLCertRequestInfo& request, |
| 64 CertificateList* filtered_certs) { | 64 CertificateList* filtered_certs) { |
| 65 DCHECK(filtered_certs); | 65 DCHECK(filtered_certs); |
| 66 | 66 |
| 67 filtered_certs->clear(); | 67 filtered_certs->clear(); |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 102 // |handle| was successfully parsed by |cert|, so this should never fail. | 102 // |handle| was successfully parsed by |cert|, so this should never fail. |
| 103 DCHECK(filtered_certs->back()); | 103 DCHECK(filtered_certs->back()); |
| 104 } | 104 } |
| 105 DVLOG(2) << "num_raw:" << num_raw | 105 DVLOG(2) << "num_raw:" << num_raw |
| 106 << " num_filtered:" << filtered_certs->size(); | 106 << " num_filtered:" << filtered_certs->size(); |
| 107 | 107 |
| 108 std::sort(filtered_certs->begin(), filtered_certs->end(), | 108 std::sort(filtered_certs->begin(), filtered_certs->end(), |
| 109 x509_util::ClientCertSorter()); | 109 x509_util::ClientCertSorter()); |
| 110 } | 110 } |
| 111 | 111 |
| 112 CertificateList ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( | 112 void ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( |
| 113 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 113 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
| 114 password_delegate, | 114 password_delegate, |
| 115 const SSLCertRequestInfo* request) { | 115 const SSLCertRequestInfo* request, |
| 116 CertificateList* selected_certs) { |
| 116 CertificateList platform_certs; | 117 CertificateList platform_certs; |
| 117 GetPlatformCertsOnWorkerThread(std::move(password_delegate), &platform_certs); | 118 GetPlatformCertsOnWorkerThread(std::move(password_delegate), &platform_certs); |
| 118 CertificateList selected_certs; | 119 FilterCertsOnWorkerThread(platform_certs, *request, selected_certs); |
| 119 FilterCertsOnWorkerThread(platform_certs, *request, &selected_certs); | |
| 120 return selected_certs; | |
| 121 } | 120 } |
| 122 | 121 |
| 123 // static | 122 // static |
| 124 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( | 123 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( |
| 125 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 124 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
| 126 password_delegate, | 125 password_delegate, |
| 127 net::CertificateList* certs) { | 126 net::CertificateList* certs) { |
| 128 CERTCertList* found_certs = | 127 CERTCertList* found_certs = |
| 129 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, | 128 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, |
| 130 PR_FALSE, PR_FALSE, password_delegate.get()); | 129 PR_FALSE, PR_FALSE, password_delegate.get()); |
| 131 if (!found_certs) { | 130 if (!found_certs) { |
| 132 DVLOG(2) << "No client certs found."; | 131 DVLOG(2) << "No client certs found."; |
| 133 return; | 132 return; |
| 134 } | 133 } |
| 135 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); | 134 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); |
| 136 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { | 135 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { |
| 137 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( | 136 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( |
| 138 node->cert, X509Certificate::OSCertHandles()); | 137 node->cert, X509Certificate::OSCertHandles()); |
| 139 if (!cert) { | 138 if (!cert) { |
| 140 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; | 139 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; |
| 141 continue; | 140 continue; |
| 142 } | 141 } |
| 143 certs->push_back(std::move(cert)); | 142 certs->push_back(std::move(cert)); |
| 144 } | 143 } |
| 145 CERT_DestroyCertList(found_certs); | 144 CERT_DestroyCertList(found_certs); |
| 146 } | 145 } |
| 147 | 146 |
| 148 } // namespace net | 147 } // namespace net |
| OLD | NEW |