Enable device-wide EAP-TLS networks

chromeos/cert_loader.cc

Index: chromeos/cert_loader.cc
diff --git a/chromeos/cert_loader.cc b/chromeos/cert_loader.cc
index 9d9a4a90f95903d0d792f0af14f9f027a0ca561a..329061ea1e840467145fbf0eca3833f9a7ab3478 100644
--- a/chromeos/cert_loader.cc
+++ b/chromeos/cert_loader.cc
@@ -14,12 +14,120 @@
 #include "base/task_scheduler/post_task.h"
 #include "crypto/nss_util.h"
 #include "crypto/scoped_nss_types.h"
+#include "net/cert/cert_database.h"
 #include "net/cert/nss_cert_database.h"
 #include "net/cert/nss_cert_database_chromeos.h"
 #include "net/cert/x509_certificate.h"
 
 namespace chromeos {
 
+// Caches certificates from a NSSCertDatabase. Handles reloading of certificates
+// on update notifications and provides status flags (loading / loaded).
+class CertLoader::CertCache : public net::CertDatabase::Observer {
+ public:
+  explicit CertCache(base::RepeatingClosure certificates_updated_callback)
+      : certificates_updated_callback_(certificates_updated_callback),
+        cert_list_(base::MakeUnique<net::CertificateList>()),
+        weak_factory_(this) {}
+
+  ~CertCache() override {
+    net::CertDatabase::GetInstance()->RemoveObserver(this);
+  }
+
+  void StartWithNSSDB(net::NSSCertDatabase* database) {
+    CHECK(!database_);
+    database_ = database;
+
+    // Start observing cert database for changes.
+    // Observing net::CertDatabase is preferred over observing |database_|
+    // directly, as |database_| observers receive only events generated directly
+    // by |database_|, so they may miss a few relevant ones.
+    // TODO(tbarzic): Once singleton NSSCertDatabase is removed, investigate if
+    // it would be OK to observe |database_| directly; or change NSSCertDatabase
+    // to send notification on all relevant changes.
+    net::CertDatabase::GetInstance()->AddObserver(this);
+
+    LoadCertificates();
+  }
+
+  net::NSSCertDatabase* GetNSSDB() { return database_; }

[stevenjb, 2017/05/09 17:04:02]

nit: database()
(and maybe rename the member/accessor nss_database)

[pmarko, 2017/05/10 11:48:01]

Done.

+
+  // Trigger a certificate load. If a certificate loading task is already in
+  // progress, will start a reload once the current task is finished.
+  void LoadCertificates() {
+    CHECK(thread_checker_.CalledOnValidThread());
+    VLOG(1) << "LoadCertificates: " << certificates_update_running_;
+
+    if (certificates_update_running_) {
+      certificates_update_required_ = true;
+      return;
+    }
+
+    certificates_update_running_ = true;
+    certificates_update_required_ = false;
+
+    if (database_) {
+      has_system_certificates_ = static_cast<bool>(database_->GetSystemSlot());
+      database_->ListCerts(base::Bind(&CertCache::UpdateCertificates,
+                                      weak_factory_.GetWeakPtr()));
+    }
+  }
+
+  // Called if a certificate load task is finished.
+  void UpdateCertificates(std::unique_ptr<net::CertificateList> cert_list) {
+    CHECK(thread_checker_.CalledOnValidThread());
+    DCHECK(certificates_update_running_);
+    VLOG(1) << "UpdateCertificates: " << cert_list->size();
+
+    // Ignore any existing certificates.
+    cert_list_ = std::move(cert_list);
+
+    certificates_loaded_ = true;
+    certificates_updated_callback_.Run();
+
+    certificates_update_running_ = false;
+    if (certificates_update_required_)
+      LoadCertificates();
+  }
+
+  // net::CertDatabase::Observer
+  void OnCertDBChanged() override {
+    VLOG(1) << "OnCertDBChanged";
+    LoadCertificates();
+  }
+
+  const net::CertificateList& cert_list() const { return *cert_list_; }
+
+  bool CertificatesLoading() const {
+    return database_ && !certificates_loaded_;
+  }
+
+  bool certificates_loaded() const { return certificates_loaded_; }
+  bool has_system_certificates() const { return has_system_certificates_; }
+
+ private:
+  // To be called when certificates have been updated.
+  base::RepeatingClosure certificates_updated_callback_;
+
+  bool has_system_certificates_ = false;
+
+  // Flags describing current CertLoader state.
+  bool certificates_loaded_ = false;
+  bool certificates_update_required_ = false;
+  bool certificates_update_running_ = false;
+
+  // The user-specific NSS certificate database from which the certificates
+  // should be loaded.
+  net::NSSCertDatabase* database_ = nullptr;
+
+  // Cached Certificates loaded from the database.
+  std::unique_ptr<net::CertificateList> cert_list_;
+
+  base::ThreadChecker thread_checker_;
+
+  base::WeakPtrFactory<CertCache> weak_factory_;
+};
+
 namespace {
 
 // Checks if |certificate| is on the given |slot|.
@@ -97,31 +205,27 @@ bool CertLoader::IsInitialized() {
 }
 
 CertLoader::CertLoader()
-    : certificates_loaded_(false),
-      certificates_update_required_(false),
-      certificates_update_running_(false),
-      database_(nullptr),
+    : pending_initial_load_(true),
+      system_cert_cache_(base::MakeUnique<CertCache>(
+          base::BindRepeating(&CertLoader::CacheUpdated,
+                              base::Unretained(this)))),
+      user_cert_cache_(base::MakeUnique<CertCache>(
+          base::BindRepeating(&CertLoader::CacheUpdated,
+                              base::Unretained(this)))),
       all_certs_(base::MakeUnique<net::CertificateList>()),
+      system_certs_(base::MakeUnique<net::CertificateList>()),
       weak_factory_(this) {}
 
 CertLoader::~CertLoader() {
-  net::CertDatabase::GetInstance()->RemoveObserver(this);
 }
 
-void CertLoader::StartWithNSSDB(net::NSSCertDatabase* database) {
-  CHECK(!database_);
-  database_ = database;
-
-  // Start observing cert database for changes.
-  // Observing net::CertDatabase is preferred over observing |database_|
-  // directly, as |database_| observers receive only events generated directly
-  // by |database_|, so they may miss a few relevant ones.
-  // TODO(tbarzic): Once singleton NSSCertDatabase is removed, investigate if
-  // it would be OK to observe |database_| directly; or change NSSCertDatabase
-  // to send notification on all relevant changes.
-  net::CertDatabase::GetInstance()->AddObserver(this);
+void CertLoader::StartWithSystemNSSDB(
+    net::NSSCertDatabase* system_slot_database) {
+  system_cert_cache_->StartWithNSSDB(system_slot_database);
+}
 
-  LoadCertificates();
+void CertLoader::StartWithUserNSSDB(net::NSSCertDatabase* user_database) {
+  user_cert_cache_->StartWithNSSDB(user_database);
 }
 
 void CertLoader::AddObserver(CertLoader::Observer* observer) {
@@ -141,7 +245,13 @@ bool CertLoader::IsCertificateHardwareBacked(const net::X509Certificate* cert) {
 }
 
 bool CertLoader::CertificatesLoading() const {
-  return database_ && !certificates_loaded_;
+  return system_cert_cache_->CertificatesLoading() ||
+         user_cert_cache_->CertificatesLoading();
+}
+
+bool CertLoader::certificates_loaded() const {
+  return system_cert_cache_->certificates_loaded() ||
+         user_cert_cache_->certificates_loaded();

[stevenjb, 2017/05/09 17:04:02]

Is this correct?

I'm a bit fuzzy on whether both system_cert_cache_ and user_cert_cache_ can be
active? I assume the can be, otherwise we wouldn't need both, correct? In that
case shouldn't this be && ?

[pmarko, 2017/05/10 11:48:01]

CertLoader can be used with one or both - I've improved the comments on the
class to make this more clear.
The idea is that:
- Before user sign-in, we start with only the system token NSSCertDatabase, so
only system_cert_cache_ has data.
- After user sign-in, both system_cert_cache_ and user_cert_cache_ have data.

I've documented (in the header) that certificates_loaded() returns true if any
certificates have been loaded, so || makes sense.

 }
 
 // static
@@ -183,56 +293,54 @@ std::string CertLoader::GetPkcs11IdAndSlotForCert(
   return pkcs11_id;
 }
 
-void CertLoader::LoadCertificates() {
+void CertLoader::CacheUpdated() {
   DCHECK(thread_checker_.CalledOnValidThread());
-  VLOG(1) << "LoadCertificates: " << certificates_update_running_;
-
-  if (certificates_update_running_) {
-    certificates_update_required_ = true;
-    return;
+  VLOG(1) << "CacheUpdated";
+
+  if (user_cert_cache_->has_system_certificates()) {
+    // The user's cert cache also contains system certificates.
+    // Filter those.
+    crypto::ScopedPK11Slot system_slot =
+        user_cert_cache_->GetNSSDB()->GetSystemSlot();
+    DCHECK(system_slot);
+    std::unique_ptr<net::CertificateList> all_certs =
+        base::MakeUnique<net::CertificateList>(user_cert_cache_->cert_list());
+    base::PostTaskWithTraitsAndReplyWithResult(
+        FROM_HERE,
+        {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+        base::BindOnce(&FilterSystemTokenCertificates,
+                       base::Unretained(all_certs.get()),
+                       std::move(system_slot)),
+        base::BindOnce(&CertLoader::UpdateCertificates,
+                       weak_factory_.GetWeakPtr(), std::move(all_certs)));
+  } else {
+    // The user's cert cache does not contain system certificates.
+    std::unique_ptr<net::CertificateList> system_certs =
+        base::MakeUnique<net::CertificateList>(system_cert_cache_->cert_list());
+    std::unique_ptr<net::CertificateList> all_certs =
+        base::MakeUnique<net::CertificateList>(user_cert_cache_->cert_list());
+    all_certs->insert(all_certs->end(), system_certs->begin(),
+                      system_certs->end());
+    UpdateCertificates(std::move(all_certs), std::move(system_certs));
   }
-
-  certificates_update_running_ = true;
-  certificates_update_required_ = false;
-
-  database_->ListCerts(
-      base::Bind(&CertLoader::CertificatesLoaded, weak_factory_.GetWeakPtr()));
-}
-
-void CertLoader::CertificatesLoaded(
-    std::unique_ptr<net::CertificateList> all_certs) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  VLOG(1) << "CertificatesLoaded: " << all_certs->size();
-
-  crypto::ScopedPK11Slot system_slot = database_->GetSystemSlot();
-  base::PostTaskWithTraitsAndReplyWithResult(
-      FROM_HERE,
-      {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::BindOnce(&FilterSystemTokenCertificates,
-                     base::Unretained(all_certs.get()), std::move(system_slot)),
-      base::BindOnce(&CertLoader::UpdateCertificates,
-                     weak_factory_.GetWeakPtr(), std::move(all_certs)));
 }
 
 void CertLoader::UpdateCertificates(
     std::unique_ptr<net::CertificateList> all_certs,
     std::unique_ptr<net::CertificateList> system_certs) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(certificates_update_running_);
+  bool initial_load = pending_initial_load_;
+  pending_initial_load_ = false;
+
   VLOG(1) << "UpdateCertificates: " << all_certs->size() << " ("
-          << system_certs->size() << " on system slot)";
+          << system_certs->size() << " on system slot)"
+          << ", initial_load=" << initial_load;
 
   // Ignore any existing certificates.
   all_certs_ = std::move(all_certs);
   system_certs_ = std::move(system_certs);
 
-  bool initial_load = !certificates_loaded_;
-  certificates_loaded_ = true;
   NotifyCertificatesLoaded(initial_load);
-
-  certificates_update_running_ = false;
-  if (certificates_update_required_)
-    LoadCertificates();
 }
 
 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
@@ -240,9 +348,4 @@ void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
     observer.OnCertificatesLoaded(*all_certs_, initial_load);
 }
 
-void CertLoader::OnCertDBChanged() {
-  VLOG(1) << "OnCertDBChanged";
-  LoadCertificates();
-}
-
 }  // namespace chromeos