Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1)

Side by Side Diff: chromeos/cert_loader.cc

Issue 2858113003: Enable device-wide EAP-TLS networks (Closed)
Patch Set: std::unique_ptr<net::CertificateList> -> net::CertificateList where possible. Created 3 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "chromeos/cert_loader.h" 5 #include "chromeos/cert_loader.h"
6 6
7 #include <algorithm> 7 #include <algorithm>
8 #include <utility> 8 #include <utility>
9 9
10 #include "base/bind.h" 10 #include "base/bind.h"
11 #include "base/location.h" 11 #include "base/location.h"
12 #include "base/logging.h"
12 #include "base/memory/ptr_util.h" 13 #include "base/memory/ptr_util.h"
13 #include "base/strings/string_number_conversions.h" 14 #include "base/strings/string_number_conversions.h"
14 #include "base/task_scheduler/post_task.h" 15 #include "base/task_scheduler/post_task.h"
15 #include "crypto/nss_util.h" 16 #include "crypto/nss_util.h"
16 #include "crypto/scoped_nss_types.h" 17 #include "crypto/scoped_nss_types.h"
18 #include "net/cert/cert_database.h"
17 #include "net/cert/nss_cert_database.h" 19 #include "net/cert/nss_cert_database.h"
18 #include "net/cert/nss_cert_database_chromeos.h" 20 #include "net/cert/nss_cert_database_chromeos.h"
19 #include "net/cert/x509_certificate.h" 21 #include "net/cert/x509_certificate.h"
20 22
21 namespace chromeos { 23 namespace chromeos {
22 24
25 // Caches certificates from a NSSCertDatabase. Handles reloading of certificates
26 // on update notifications and provides status flags (loading / loaded).
27 // CertLoader can use multiple CertCaches to combine certificates from multiple
28 // sources.
29 class CertLoader::CertCache : public net::CertDatabase::Observer {
30 public:
31 explicit CertCache(base::RepeatingClosure certificates_updated_callback)
32 : certificates_updated_callback_(certificates_updated_callback),
33 weak_factory_(this) {}
34
35 ~CertCache() override {
36 net::CertDatabase::GetInstance()->RemoveObserver(this);
37 }
38
39 void SetNSSDB(net::NSSCertDatabase* nss_database) {
40 CHECK(!nss_database_);
41 nss_database_ = nss_database;
42
43 // Start observing cert database for changes.
44 // Observing net::CertDatabase is preferred over observing |nss_database_|
45 // directly, as |nss_database_| observers receive only events generated
46 // directly by |nss_database_|, so they may miss a few relevant ones.
47 // TODO(tbarzic): Once singleton NSSCertDatabase is removed, investigate if
48 // it would be OK to observe |nss_database_| directly; or change
49 // NSSCertDatabase to send notification on all relevant changes.
50 net::CertDatabase::GetInstance()->AddObserver(this);
51
52 LoadCertificates();
53 }
54
55 net::NSSCertDatabase* nss_database() { return nss_database_; }
56
57 // net::CertDatabase::Observer
58 void OnCertDBChanged() override {
59 VLOG(1) << "OnCertDBChanged";
60 LoadCertificates();
61 }
62
63 const net::CertificateList& cert_list() const { return cert_list_; }
64
65 bool initial_load_running() const {
66 return nss_database_ && !initial_load_finished_;
67 }
68
69 bool initial_load_finished() const { return initial_load_finished_; }
70
71 // Returns true if the underlying NSSCertDatabase has access to the system
72 // slot.
73 bool has_system_certificates() const { return has_system_certificates_; }
74
75 private:
76 // Trigger a certificate load. If a certificate loading task is already in
77 // progress, will start a reload once the current task is finished.
78 void LoadCertificates() {
79 CHECK(thread_checker_.CalledOnValidThread());
80 VLOG(1) << "LoadCertificates: " << certificates_update_running_;
81
82 if (certificates_update_running_) {
83 certificates_update_required_ = true;
84 return;
85 }
86
87 certificates_update_running_ = true;
88 certificates_update_required_ = false;
89
90 if (nss_database_) {
91 has_system_certificates_ =
92 static_cast<bool>(nss_database_->GetSystemSlot());
93 nss_database_->ListCerts(base::Bind(&CertCache::UpdateCertificates,
94 weak_factory_.GetWeakPtr()));
95 }
96 }
97
98 // Called if a certificate load task is finished.
99 void UpdateCertificates(std::unique_ptr<net::CertificateList> cert_list) {
100 CHECK(thread_checker_.CalledOnValidThread());
101 DCHECK(certificates_update_running_);
102 VLOG(1) << "UpdateCertificates: " << cert_list->size();
103
104 // Ignore any existing certificates.
105 cert_list_ = std::move(*cert_list);
106
107 initial_load_finished_ = true;
108 certificates_updated_callback_.Run();
109
110 certificates_update_running_ = false;
111 if (certificates_update_required_)
112 LoadCertificates();
113 }
114
115 // To be called when certificates have been updated.
116 base::RepeatingClosure certificates_updated_callback_;
117
118 bool has_system_certificates_ = false;
119
120 // This is true after certificates have been loaded initially.
121 bool initial_load_finished_ = false;
122 // This is true if a notification about certificate DB changes arrived while
123 // loading certificates and means that we will have to trigger another
124 // certificates load after that.
125 bool certificates_update_required_ = false;
126 // This is true while certificates are being loaded.
127 bool certificates_update_running_ = false;
128
129 // The NSS certificate database from which the certificates should be loaded.
130 net::NSSCertDatabase* nss_database_ = nullptr;
131
132 // Cached Certificates loaded from the database.
133 net::CertificateList cert_list_;
134
135 base::ThreadChecker thread_checker_;
136
137 base::WeakPtrFactory<CertCache> weak_factory_;
138
139 DISALLOW_COPY_AND_ASSIGN(CertCache);
140 };
141
23 namespace { 142 namespace {
24 143
25 // Checks if |certificate| is on the given |slot|. 144 // Checks if |certificate| is on the given |slot|.
26 bool IsCertificateOnSlot(const net::X509Certificate* certificate, 145 bool IsCertificateOnSlot(const net::X509Certificate* certificate,
27 PK11SlotInfo* slot) { 146 PK11SlotInfo* slot) {
28 crypto::ScopedPK11SlotList slots_for_cert( 147 crypto::ScopedPK11SlotList slots_for_cert(
29 PK11_GetAllSlotsForCert(certificate->os_cert_handle(), nullptr)); 148 PK11_GetAllSlotsForCert(certificate->os_cert_handle(), nullptr));
30 if (!slots_for_cert) 149 if (!slots_for_cert)
31 return false; 150 return false;
32 151
33 for (PK11SlotListElement* slot_element = 152 for (PK11SlotListElement* slot_element =
34 PK11_GetFirstSafe(slots_for_cert.get()); 153 PK11_GetFirstSafe(slots_for_cert.get());
35 slot_element; slot_element = PK11_GetNextSafe(slots_for_cert.get(), 154 slot_element; slot_element = PK11_GetNextSafe(slots_for_cert.get(),
36 slot_element, PR_FALSE)) { 155 slot_element, PR_FALSE)) {
37 if (slot_element->slot == slot) { 156 if (slot_element->slot == slot) {
38 // All previously visited elements have been freed by PK11_GetNextSafe, 157 // All previously visited elements have been freed by PK11_GetNextSafe,
39 // but we're not calling that for the last one, so free it explicitly. 158 // but we're not calling that for the last one, so free it explicitly.
40 // The slots_for_cert list itself will be freed because ScopedPK11SlotList 159 // The slots_for_cert list itself will be freed because ScopedPK11SlotList
41 // is a unique_ptr. 160 // is a unique_ptr.
42 PK11_FreeSlotListElement(slots_for_cert.get(), slot_element); 161 PK11_FreeSlotListElement(slots_for_cert.get(), slot_element);
43 return true; 162 return true;
44 } 163 }
45 } 164 }
46 return false; 165 return false;
47 } 166 }
48 167
49 // Goes through all certificates in |all_certs| and copies those certificates 168 // Goes through all certificates in |all_certs| and copies those certificates
50 // which are on |system_slot| to a new list. 169 // which are on |system_slot| to a new list.
51 std::unique_ptr<net::CertificateList> FilterSystemTokenCertificates( 170 net::CertificateList FilterSystemTokenCertificates(
52 const net::CertificateList* all_certs, 171 net::CertificateList certs,
53 crypto::ScopedPK11Slot system_slot) { 172 crypto::ScopedPK11Slot system_slot) {
54 VLOG(1) << "FilterSystemTokenCertificates"; 173 VLOG(1) << "FilterSystemTokenCertificates";
55 std::unique_ptr<net::CertificateList> system_certs =
56 base::MakeUnique<net::CertificateList>();
57 if (!system_slot) 174 if (!system_slot)
58 return system_certs; 175 return net::CertificateList();
59 176
60 // Extract certificates which are in the system token into the 177 // Only keep certificates which are on the |system_slot|.
61 // |system_certs_| sublist. 178 PK11SlotInfo* system_slot_ptr = system_slot.get();
62 for (const auto& cert : *all_certs) { 179 certs.erase(
63 if (IsCertificateOnSlot(cert.get(), system_slot.get())) { 180 std::remove_if(
64 system_certs->push_back(cert); 181 certs.begin(), certs.end(),
65 } 182 [system_slot_ptr](const scoped_refptr<net::X509Certificate>& cert) {
66 } 183 return !IsCertificateOnSlot(cert.get(), system_slot_ptr);
67 return system_certs; 184 }),
185 certs.end());
186 return certs;
68 } 187 }
69 188
70 } // namespace 189 } // namespace
71 190
72 static CertLoader* g_cert_loader = nullptr; 191 static CertLoader* g_cert_loader = nullptr;
73 static bool g_force_hardware_backed_for_test = false; 192 static bool g_force_hardware_backed_for_test = false;
74 193
75 // static 194 // static
76 void CertLoader::Initialize() { 195 void CertLoader::Initialize() {
77 CHECK(!g_cert_loader); 196 CHECK(!g_cert_loader);
(...skipping 12 matching lines...) Expand all
90 CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()"; 209 CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()";
91 return g_cert_loader; 210 return g_cert_loader;
92 } 211 }
93 212
94 // static 213 // static
95 bool CertLoader::IsInitialized() { 214 bool CertLoader::IsInitialized() {
96 return g_cert_loader; 215 return g_cert_loader;
97 } 216 }
98 217
99 CertLoader::CertLoader() 218 CertLoader::CertLoader()
100 : certificates_loaded_(false), 219 : pending_initial_load_(true),
101 certificates_update_required_(false), 220 system_cert_cache_(base::MakeUnique<CertCache>(
102 certificates_update_running_(false), 221 base::BindRepeating(&CertLoader::CacheUpdated,
103 database_(nullptr), 222 base::Unretained(this)))),
104 all_certs_(base::MakeUnique<net::CertificateList>()), 223 user_cert_cache_(base::MakeUnique<CertCache>(
224 base::BindRepeating(&CertLoader::CacheUpdated,
225 base::Unretained(this)))),
stevenjb 2017/05/11 18:25:35 nit: I think this would be a little more readable
pmarko 2017/05/11 21:01:46 Done.
105 weak_factory_(this) {} 226 weak_factory_(this) {}
106 227
107 CertLoader::~CertLoader() { 228 CertLoader::~CertLoader() {
108 net::CertDatabase::GetInstance()->RemoveObserver(this);
109 } 229 }
110 230
111 void CertLoader::StartWithNSSDB(net::NSSCertDatabase* database) { 231 void CertLoader::SetSystemNSSDB(net::NSSCertDatabase* system_slot_database) {
112 CHECK(!database_); 232 system_cert_cache_->SetNSSDB(system_slot_database);
113 database_ = database; 233 }
114 234
115 // Start observing cert database for changes. 235 void CertLoader::SetUserNSSDB(net::NSSCertDatabase* user_database) {
116 // Observing net::CertDatabase is preferred over observing |database_| 236 user_cert_cache_->SetNSSDB(user_database);
117 // directly, as |database_| observers receive only events generated directly
118 // by |database_|, so they may miss a few relevant ones.
119 // TODO(tbarzic): Once singleton NSSCertDatabase is removed, investigate if
120 // it would be OK to observe |database_| directly; or change NSSCertDatabase
121 // to send notification on all relevant changes.
122 net::CertDatabase::GetInstance()->AddObserver(this);
123
124 LoadCertificates();
125 } 237 }
126 238
127 void CertLoader::AddObserver(CertLoader::Observer* observer) { 239 void CertLoader::AddObserver(CertLoader::Observer* observer) {
128 observers_.AddObserver(observer); 240 observers_.AddObserver(observer);
129 } 241 }
130 242
131 void CertLoader::RemoveObserver(CertLoader::Observer* observer) { 243 void CertLoader::RemoveObserver(CertLoader::Observer* observer) {
132 observers_.RemoveObserver(observer); 244 observers_.RemoveObserver(observer);
133 } 245 }
134 246
135 // static 247 // static
136 bool CertLoader::IsCertificateHardwareBacked(const net::X509Certificate* cert) { 248 bool CertLoader::IsCertificateHardwareBacked(const net::X509Certificate* cert) {
137 if (g_force_hardware_backed_for_test) 249 if (g_force_hardware_backed_for_test)
138 return true; 250 return true;
139 PK11SlotInfo* slot = cert->os_cert_handle()->slot; 251 PK11SlotInfo* slot = cert->os_cert_handle()->slot;
140 return slot && PK11_IsHW(slot); 252 return slot && PK11_IsHW(slot);
141 } 253 }
142 254
143 bool CertLoader::CertificatesLoading() const { 255 bool CertLoader::initial_load_of_any_database_running() const {
144 return database_ && !certificates_loaded_; 256 return system_cert_cache_->initial_load_running() ||
257 user_cert_cache_->initial_load_running();
258 }
259
260 bool CertLoader::initial_load_finished() const {
261 return system_cert_cache_->initial_load_finished() ||
262 user_cert_cache_->initial_load_finished();
145 } 263 }
146 264
147 // static 265 // static
148 void CertLoader::ForceHardwareBackedForTesting() { 266 void CertLoader::ForceHardwareBackedForTesting() {
149 g_force_hardware_backed_for_test = true; 267 g_force_hardware_backed_for_test = true;
150 } 268 }
151 269
152 // static 270 // static
153 // 271 //
154 // For background see this discussion on dev-tech-crypto.lists.mozilla.org: 272 // For background see this discussion on dev-tech-crypto.lists.mozilla.org:
(...skipping 21 matching lines...) Expand all
176 std::string pkcs11_id; 294 std::string pkcs11_id;
177 if (sec_item) { 295 if (sec_item) {
178 pkcs11_id = base::HexEncode(sec_item->data, sec_item->len); 296 pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
179 SECITEM_FreeItem(sec_item, PR_TRUE); 297 SECITEM_FreeItem(sec_item, PR_TRUE);
180 } 298 }
181 SECKEY_DestroyPrivateKey(priv_key); 299 SECKEY_DestroyPrivateKey(priv_key);
182 300
183 return pkcs11_id; 301 return pkcs11_id;
184 } 302 }
185 303
186 void CertLoader::LoadCertificates() { 304 void CertLoader::CacheUpdated() {
187 DCHECK(thread_checker_.CalledOnValidThread()); 305 DCHECK(thread_checker_.CalledOnValidThread());
188 VLOG(1) << "LoadCertificates: " << certificates_update_running_; 306 VLOG(1) << "CacheUpdated";
189 307
190 if (certificates_update_running_) { 308 // If user_cert_cache_ has access to system certificates and it has already
191 certificates_update_required_ = true; 309 // finished its initial load, it will contain system certificates which we can
192 return; 310 // filter.
311 if (user_cert_cache_->initial_load_finished() &&
312 user_cert_cache_->has_system_certificates()) {
313 crypto::ScopedPK11Slot system_slot =
314 user_cert_cache_->nss_database()->GetSystemSlot();
315 DCHECK(system_slot);
316 base::PostTaskWithTraitsAndReplyWithResult(
317 FROM_HERE,
318 {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
319 base::BindOnce(&FilterSystemTokenCertificates,
320 std::move(user_cert_cache_->cert_list()),
emaxx 2017/05/11 20:24:52 nit: std::move() has no effect here and may be omi
pmarko 2017/05/11 21:01:46 Done.
321 std::move(system_slot)),
322 base::BindOnce(&CertLoader::UpdateCertificates,
323 weak_factory_.GetWeakPtr(),
324 std::move(user_cert_cache_->cert_list())));
emaxx 2017/05/11 20:24:52 nit: std::move() has no effect here and may be omi
pmarko 2017/05/11 21:01:46 Done.
325 } else {
326 // The user's cert cache does not contain system certificates.
327 net::CertificateList system_certs = system_cert_cache_->cert_list();
328 net::CertificateList all_certs = user_cert_cache_->cert_list();
329 all_certs.insert(all_certs.end(), system_certs.begin(), system_certs.end());
330 UpdateCertificates(std::move(all_certs), std::move(system_certs));
193 } 331 }
194
195 certificates_update_running_ = true;
196 certificates_update_required_ = false;
197
198 database_->ListCerts(
199 base::Bind(&CertLoader::CertificatesLoaded, weak_factory_.GetWeakPtr()));
200 } 332 }
201 333
202 void CertLoader::CertificatesLoaded( 334 void CertLoader::UpdateCertificates(net::CertificateList all_certs,
203 std::unique_ptr<net::CertificateList> all_certs) { 335 net::CertificateList system_certs) {
204 DCHECK(thread_checker_.CalledOnValidThread()); 336 CHECK(thread_checker_.CalledOnValidThread());
205 VLOG(1) << "CertificatesLoaded: " << all_certs->size(); 337 bool initial_load = pending_initial_load_;
338 pending_initial_load_ = false;
206 339
207 crypto::ScopedPK11Slot system_slot = database_->GetSystemSlot(); 340 VLOG(1) << "UpdateCertificates: " << all_certs.size() << " ("
208 base::PostTaskWithTraitsAndReplyWithResult( 341 << system_certs.size() << " on system slot)"
209 FROM_HERE, 342 << ", initial_load=" << initial_load;
210 {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
211 base::BindOnce(&FilterSystemTokenCertificates,
212 base::Unretained(all_certs.get()), std::move(system_slot)),
213 base::BindOnce(&CertLoader::UpdateCertificates,
214 weak_factory_.GetWeakPtr(), std::move(all_certs)));
215 }
216
217 void CertLoader::UpdateCertificates(
218 std::unique_ptr<net::CertificateList> all_certs,
219 std::unique_ptr<net::CertificateList> system_certs) {
220 DCHECK(thread_checker_.CalledOnValidThread());
221 DCHECK(certificates_update_running_);
222 VLOG(1) << "UpdateCertificates: " << all_certs->size() << " ("
223 << system_certs->size() << " on system slot)";
224 343
225 // Ignore any existing certificates. 344 // Ignore any existing certificates.
226 all_certs_ = std::move(all_certs); 345 all_certs_ = std::move(all_certs);
227 system_certs_ = std::move(system_certs); 346 system_certs_ = std::move(system_certs);
228 347
229 bool initial_load = !certificates_loaded_;
230 certificates_loaded_ = true;
231 NotifyCertificatesLoaded(initial_load); 348 NotifyCertificatesLoaded(initial_load);
232
233 certificates_update_running_ = false;
234 if (certificates_update_required_)
235 LoadCertificates();
236 } 349 }
237 350
238 void CertLoader::NotifyCertificatesLoaded(bool initial_load) { 351 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
239 for (auto& observer : observers_) 352 for (auto& observer : observers_)
240 observer.OnCertificatesLoaded(*all_certs_, initial_load); 353 observer.OnCertificatesLoaded(all_certs_, initial_load);
241 }
242
243 void CertLoader::OnCertDBChanged() {
244 VLOG(1) << "OnCertDBChanged";
245 LoadCertificates();
246 } 354 }
247 355
248 } // namespace chromeos 356 } // namespace chromeos
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698