OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/ssl/client_cert_store_nss.h" | 5 #include "net/ssl/client_cert_store_nss.h" |
6 | 6 |
7 #include <nss.h> | 7 #include <nss.h> |
8 #include <ssl.h> | 8 #include <ssl.h> |
9 | 9 |
10 #include <algorithm> | 10 #include <algorithm> |
11 #include <memory> | 11 #include <memory> |
12 #include <utility> | 12 #include <utility> |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/bind.h" | 15 #include "base/bind.h" |
16 #include "base/bind_helpers.h" | 16 #include "base/bind_helpers.h" |
17 #include "base/location.h" | 17 #include "base/location.h" |
18 #include "base/logging.h" | 18 #include "base/logging.h" |
19 #include "base/strings/string_piece.h" | 19 #include "base/strings/string_piece.h" |
20 #include "base/task_runner_util.h" | |
21 #include "base/threading/worker_pool.h" | 20 #include "base/threading/worker_pool.h" |
22 #include "crypto/nss_crypto_module_delegate.h" | 21 #include "crypto/nss_crypto_module_delegate.h" |
23 #include "net/cert/scoped_nss_types.h" | 22 #include "net/cert/scoped_nss_types.h" |
24 #include "net/cert/x509_util.h" | 23 #include "net/cert/x509_util.h" |
25 #include "net/ssl/ssl_cert_request_info.h" | 24 #include "net/ssl/ssl_cert_request_info.h" |
26 #include "net/third_party/nss/ssl/cmpcert.h" | 25 #include "net/third_party/nss/ssl/cmpcert.h" |
27 | 26 |
28 namespace net { | 27 namespace net { |
29 | 28 |
30 ClientCertStoreNSS::ClientCertStoreNSS( | 29 ClientCertStoreNSS::ClientCertStoreNSS( |
31 const PasswordDelegateFactory& password_delegate_factory) | 30 const PasswordDelegateFactory& password_delegate_factory) |
32 : password_delegate_factory_(password_delegate_factory) {} | 31 : password_delegate_factory_(password_delegate_factory) {} |
33 | 32 |
34 ClientCertStoreNSS::~ClientCertStoreNSS() {} | 33 ClientCertStoreNSS::~ClientCertStoreNSS() {} |
35 | 34 |
36 void ClientCertStoreNSS::GetClientCerts( | 35 void ClientCertStoreNSS::GetClientCerts(const SSLCertRequestInfo& request, |
37 const SSLCertRequestInfo& request, | 36 CertificateList* selected_certs, |
38 const ClientCertListCallback& callback) { | 37 const base::Closure& callback) { |
39 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 38 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
40 password_delegate; | 39 password_delegate; |
41 if (!password_delegate_factory_.is_null()) { | 40 if (!password_delegate_factory_.is_null()) { |
42 password_delegate.reset( | 41 password_delegate.reset( |
43 password_delegate_factory_.Run(request.host_and_port)); | 42 password_delegate_factory_.Run(request.host_and_port)); |
44 } | 43 } |
45 if (base::PostTaskAndReplyWithResult( | 44 if (base::WorkerPool::PostTaskAndReply( |
46 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), | |
47 FROM_HERE, | 45 FROM_HERE, |
48 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, | 46 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, |
49 // Caller is responsible for keeping the ClientCertStore | 47 // Caller is responsible for keeping the ClientCertStore |
50 // alive until the callback is run. | 48 // alive until the callback is run. |
51 base::Unretained(this), base::Passed(&password_delegate), | 49 base::Unretained(this), base::Passed(&password_delegate), |
52 &request), | 50 &request, selected_certs), |
53 callback)) { | 51 callback, true)) { |
54 return; | 52 return; |
55 } | 53 } |
56 // If the task could not be posted, behave as if there were no certificates. | 54 // If the task could not be posted, behave as if there were no certificates |
57 callback.Run(CertificateList()); | 55 // which requires to clear |selected_certs|. |
| 56 selected_certs->clear(); |
| 57 callback.Run(); |
58 } | 58 } |
59 | 59 |
60 // static | 60 // static |
61 void ClientCertStoreNSS::FilterCertsOnWorkerThread( | 61 void ClientCertStoreNSS::FilterCertsOnWorkerThread( |
62 const CertificateList& certs, | 62 const CertificateList& certs, |
63 const SSLCertRequestInfo& request, | 63 const SSLCertRequestInfo& request, |
64 CertificateList* filtered_certs) { | 64 CertificateList* filtered_certs) { |
65 DCHECK(filtered_certs); | 65 DCHECK(filtered_certs); |
66 | 66 |
67 filtered_certs->clear(); | 67 filtered_certs->clear(); |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
102 // |handle| was successfully parsed by |cert|, so this should never fail. | 102 // |handle| was successfully parsed by |cert|, so this should never fail. |
103 DCHECK(filtered_certs->back()); | 103 DCHECK(filtered_certs->back()); |
104 } | 104 } |
105 DVLOG(2) << "num_raw:" << num_raw | 105 DVLOG(2) << "num_raw:" << num_raw |
106 << " num_filtered:" << filtered_certs->size(); | 106 << " num_filtered:" << filtered_certs->size(); |
107 | 107 |
108 std::sort(filtered_certs->begin(), filtered_certs->end(), | 108 std::sort(filtered_certs->begin(), filtered_certs->end(), |
109 x509_util::ClientCertSorter()); | 109 x509_util::ClientCertSorter()); |
110 } | 110 } |
111 | 111 |
112 CertificateList ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( | 112 void ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( |
113 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 113 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
114 password_delegate, | 114 password_delegate, |
115 const SSLCertRequestInfo* request) { | 115 const SSLCertRequestInfo* request, |
| 116 CertificateList* selected_certs) { |
116 CertificateList platform_certs; | 117 CertificateList platform_certs; |
117 GetPlatformCertsOnWorkerThread(std::move(password_delegate), &platform_certs); | 118 GetPlatformCertsOnWorkerThread(std::move(password_delegate), &platform_certs); |
118 CertificateList selected_certs; | 119 FilterCertsOnWorkerThread(platform_certs, *request, selected_certs); |
119 FilterCertsOnWorkerThread(platform_certs, *request, &selected_certs); | |
120 return selected_certs; | |
121 } | 120 } |
122 | 121 |
123 // static | 122 // static |
124 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( | 123 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( |
125 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 124 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> |
126 password_delegate, | 125 password_delegate, |
127 net::CertificateList* certs) { | 126 net::CertificateList* certs) { |
128 CERTCertList* found_certs = | 127 CERTCertList* found_certs = |
129 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, | 128 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, |
130 PR_FALSE, PR_FALSE, password_delegate.get()); | 129 PR_FALSE, PR_FALSE, password_delegate.get()); |
131 if (!found_certs) { | 130 if (!found_certs) { |
132 DVLOG(2) << "No client certs found."; | 131 DVLOG(2) << "No client certs found."; |
133 return; | 132 return; |
134 } | 133 } |
135 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); | 134 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); |
136 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { | 135 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { |
137 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( | 136 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( |
138 node->cert, X509Certificate::OSCertHandles()); | 137 node->cert, X509Certificate::OSCertHandles()); |
139 if (!cert) { | 138 if (!cert) { |
140 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; | 139 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; |
141 continue; | 140 continue; |
142 } | 141 } |
143 certs->push_back(std::move(cert)); | 142 certs->push_back(std::move(cert)); |
144 } | 143 } |
145 CERT_DestroyCertList(found_certs); | 144 CERT_DestroyCertList(found_certs); |
146 } | 145 } |
147 | 146 |
148 } // namespace net | 147 } // namespace net |
OLD | NEW |