OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/ssl/client_cert_store_nss.h" | 5 #include "net/ssl/client_cert_store_nss.h" |
6 | 6 |
7 #include <nss.h> | 7 #include <nss.h> |
8 #include <ssl.h> | 8 #include <ssl.h> |
9 | 9 |
10 #include <algorithm> | 10 #include <algorithm> |
11 #include <memory> | 11 #include <memory> |
12 #include <utility> | 12 #include <utility> |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/bind.h" | 15 #include "base/bind.h" |
16 #include "base/bind_helpers.h" | 16 #include "base/bind_helpers.h" |
17 #include "base/location.h" | 17 #include "base/location.h" |
18 #include "base/logging.h" | 18 #include "base/logging.h" |
| 19 #include "base/memory/ptr_util.h" |
19 #include "base/strings/string_piece.h" | 20 #include "base/strings/string_piece.h" |
20 #include "base/task_runner_util.h" | 21 #include "base/task_runner_util.h" |
21 #include "base/threading/worker_pool.h" | 22 #include "base/threading/worker_pool.h" |
22 #include "crypto/nss_crypto_module_delegate.h" | 23 #include "crypto/nss_crypto_module_delegate.h" |
23 #include "net/cert/scoped_nss_types.h" | 24 #include "net/cert/scoped_nss_types.h" |
24 #include "net/cert/x509_util.h" | 25 #include "net/cert/x509_util.h" |
25 #include "net/ssl/ssl_cert_request_info.h" | 26 #include "net/ssl/ssl_cert_request_info.h" |
| 27 #include "net/ssl/ssl_platform_key_nss.h" |
| 28 #include "net/ssl/threaded_ssl_private_key.h" |
26 #include "net/third_party/nss/ssl/cmpcert.h" | 29 #include "net/third_party/nss/ssl/cmpcert.h" |
27 | 30 |
28 namespace net { | 31 namespace net { |
29 | 32 |
| 33 namespace { |
| 34 |
| 35 class ClientCertIdentityNSS : public ClientCertIdentity { |
| 36 public: |
| 37 ClientCertIdentityNSS( |
| 38 scoped_refptr<net::X509Certificate> cert, |
| 39 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> |
| 40 password_delegate) |
| 41 : ClientCertIdentity(std::move(cert)), |
| 42 password_delegate_(std::move(password_delegate)) {} |
| 43 ~ClientCertIdentityNSS() override = default; |
| 44 |
| 45 void AcquirePrivateKey( |
| 46 const base::Callback<void(scoped_refptr<SSLPrivateKey>)>& |
| 47 private_key_callback) override { |
| 48 if (base::PostTaskAndReplyWithResult( |
| 49 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), |
| 50 FROM_HERE, |
| 51 base::Bind(&FetchClientCertPrivateKey, |
| 52 base::RetainedRef(certificate()), |
| 53 base::RetainedRef(password_delegate_)), |
| 54 private_key_callback)) { |
| 55 return; |
| 56 } |
| 57 // If the task could not be posted, behave as if there was no key. |
| 58 private_key_callback.Run(nullptr); |
| 59 } |
| 60 |
| 61 private: |
| 62 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> |
| 63 password_delegate_; |
| 64 }; |
| 65 |
| 66 } // namespace |
| 67 |
30 ClientCertStoreNSS::ClientCertStoreNSS( | 68 ClientCertStoreNSS::ClientCertStoreNSS( |
31 const PasswordDelegateFactory& password_delegate_factory) | 69 const PasswordDelegateFactory& password_delegate_factory) |
32 : password_delegate_factory_(password_delegate_factory) {} | 70 : password_delegate_factory_(password_delegate_factory) {} |
33 | 71 |
34 ClientCertStoreNSS::~ClientCertStoreNSS() {} | 72 ClientCertStoreNSS::~ClientCertStoreNSS() {} |
35 | 73 |
36 void ClientCertStoreNSS::GetClientCerts( | 74 void ClientCertStoreNSS::GetClientCerts( |
37 const SSLCertRequestInfo& request, | 75 const SSLCertRequestInfo& request, |
38 const ClientCertListCallback& callback) { | 76 const ClientCertListCallback& callback) { |
39 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 77 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate; |
40 password_delegate; | 78 if (!password_delegate_factory_.is_null()) |
41 if (!password_delegate_factory_.is_null()) { | 79 password_delegate = password_delegate_factory_.Run(request.host_and_port); |
42 password_delegate.reset( | |
43 password_delegate_factory_.Run(request.host_and_port)); | |
44 } | |
45 if (base::PostTaskAndReplyWithResult( | 80 if (base::PostTaskAndReplyWithResult( |
46 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), | 81 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), |
47 FROM_HERE, | 82 FROM_HERE, |
48 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, | 83 base::Bind(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread, |
49 // Caller is responsible for keeping the ClientCertStore | 84 // Caller is responsible for keeping the ClientCertStore |
50 // alive until the callback is run. | 85 // alive until the callback is run. |
51 base::Unretained(this), base::Passed(&password_delegate), | 86 base::Unretained(this), std::move(password_delegate), |
52 &request), | 87 &request), |
53 callback)) { | 88 callback)) { |
54 return; | 89 return; |
55 } | 90 } |
56 // If the task could not be posted, behave as if there were no certificates. | 91 // If the task could not be posted, behave as if there were no certificates. |
57 callback.Run(CertificateList()); | 92 callback.Run(ClientCertIdentityList()); |
58 } | 93 } |
59 | 94 |
60 // static | 95 // static |
61 void ClientCertStoreNSS::FilterCertsOnWorkerThread( | 96 void ClientCertStoreNSS::FilterCertsOnWorkerThread( |
62 const CertificateList& certs, | 97 ClientCertIdentityList* identities, |
63 const SSLCertRequestInfo& request, | 98 const SSLCertRequestInfo& request) { |
64 CertificateList* filtered_certs) { | 99 size_t num_raw = 0; |
65 DCHECK(filtered_certs); | |
66 | 100 |
67 filtered_certs->clear(); | 101 auto keep_iter = identities->begin(); |
68 | 102 |
69 size_t num_raw = 0; | 103 for (auto examine_iter = identities->begin(); |
70 for (const auto& cert : certs) { | 104 examine_iter != identities->end(); ++examine_iter) { |
71 ++num_raw; | 105 ++num_raw; |
72 X509Certificate::OSCertHandle handle = cert->os_cert_handle(); | 106 X509Certificate::OSCertHandle handle = |
| 107 (*examine_iter)->certificate()->os_cert_handle(); |
73 | 108 |
74 // Only offer unexpired certificates. | 109 // Only offer unexpired certificates. |
75 if (CERT_CheckCertValidTimes(handle, PR_Now(), PR_TRUE) != | 110 if (CERT_CheckCertValidTimes(handle, PR_Now(), PR_TRUE) != |
76 secCertTimeValid) { | 111 secCertTimeValid) { |
77 DVLOG(2) << "skipped expired cert: " | 112 DVLOG(2) << "skipped expired cert: " |
78 << base::StringPiece(handle->nickname); | 113 << base::StringPiece(handle->nickname); |
79 continue; | 114 continue; |
80 } | 115 } |
81 | 116 |
82 std::vector<ScopedCERTCertificate> intermediates; | 117 std::vector<ScopedCERTCertificate> intermediates; |
83 if (!MatchClientCertificateIssuers(handle, request.cert_authorities, | 118 if (!MatchClientCertificateIssuers(handle, request.cert_authorities, |
84 &intermediates)) { | 119 &intermediates)) { |
85 DVLOG(2) << "skipped non-matching cert: " | 120 DVLOG(2) << "skipped non-matching cert: " |
86 << base::StringPiece(handle->nickname); | 121 << base::StringPiece(handle->nickname); |
87 continue; | 122 continue; |
88 } | 123 } |
89 | 124 |
90 DVLOG(2) << "matched cert: " << base::StringPiece(handle->nickname); | 125 DVLOG(2) << "matched cert: " << base::StringPiece(handle->nickname); |
91 | 126 |
92 X509Certificate::OSCertHandles intermediates_raw; | 127 X509Certificate::OSCertHandles intermediates_raw; |
93 for (const auto& intermediate : intermediates) { | 128 for (const auto& intermediate : intermediates) { |
94 intermediates_raw.push_back(intermediate.get()); | 129 intermediates_raw.push_back(intermediate.get()); |
95 } | 130 } |
96 | 131 |
97 // Retain a copy of the intermediates. Some deployments expect the client to | 132 // Retain a copy of the intermediates. Some deployments expect the client to |
98 // supply intermediates out of the local store. See | 133 // supply intermediates out of the local store. See |
99 // https://crbug.com/548631. | 134 // https://crbug.com/548631. |
100 filtered_certs->push_back( | 135 (*examine_iter)->SetIntermediates(intermediates_raw); |
101 X509Certificate::CreateFromHandle(handle, intermediates_raw)); | 136 |
102 // |handle| was successfully parsed by |cert|, so this should never fail. | 137 if (examine_iter == keep_iter) |
103 DCHECK(filtered_certs->back()); | 138 ++keep_iter; |
| 139 else |
| 140 *keep_iter++ = std::move(*examine_iter); |
104 } | 141 } |
105 DVLOG(2) << "num_raw:" << num_raw | 142 identities->erase(keep_iter, identities->end()); |
106 << " num_filtered:" << filtered_certs->size(); | |
107 | 143 |
108 std::sort(filtered_certs->begin(), filtered_certs->end(), | 144 DVLOG(2) << "num_raw:" << num_raw << " num_filtered:" << identities->size(); |
109 x509_util::ClientCertSorter()); | 145 |
| 146 std::sort(identities->begin(), identities->end(), ClientCertIdentitySorter()); |
110 } | 147 } |
111 | 148 |
112 CertificateList ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( | 149 ClientCertIdentityList ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread( |
113 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 150 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> |
114 password_delegate, | 151 password_delegate, |
115 const SSLCertRequestInfo* request) { | 152 const SSLCertRequestInfo* request) { |
116 CertificateList platform_certs; | 153 ClientCertIdentityList selected_identities; |
117 GetPlatformCertsOnWorkerThread(std::move(password_delegate), &platform_certs); | 154 GetPlatformCertsOnWorkerThread(std::move(password_delegate), |
118 CertificateList selected_certs; | 155 &selected_identities); |
119 FilterCertsOnWorkerThread(platform_certs, *request, &selected_certs); | 156 FilterCertsOnWorkerThread(&selected_identities, *request); |
120 return selected_certs; | 157 return selected_identities; |
121 } | 158 } |
122 | 159 |
123 // static | 160 // static |
124 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( | 161 void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( |
125 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 162 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> |
126 password_delegate, | 163 password_delegate, |
127 net::CertificateList* certs) { | 164 ClientCertIdentityList* identities) { |
128 CERTCertList* found_certs = | 165 CERTCertList* found_certs = |
129 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, | 166 CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient, |
130 PR_FALSE, PR_FALSE, password_delegate.get()); | 167 PR_FALSE, PR_FALSE, password_delegate.get()); |
131 if (!found_certs) { | 168 if (!found_certs) { |
132 DVLOG(2) << "No client certs found."; | 169 DVLOG(2) << "No client certs found."; |
133 return; | 170 return; |
134 } | 171 } |
135 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); | 172 for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); |
136 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { | 173 !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { |
137 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( | 174 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( |
138 node->cert, X509Certificate::OSCertHandles()); | 175 node->cert, X509Certificate::OSCertHandles()); |
139 if (!cert) { | 176 if (!cert) { |
140 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; | 177 DVLOG(2) << "X509Certificate::CreateFromHandle failed"; |
141 continue; | 178 continue; |
142 } | 179 } |
143 certs->push_back(std::move(cert)); | 180 identities->push_back( |
| 181 base::MakeUnique<ClientCertIdentityNSS>(cert, password_delegate)); |
144 } | 182 } |
145 CERT_DestroyCertList(found_certs); | 183 CERT_DestroyCertList(found_certs); |
146 } | 184 } |
147 | 185 |
148 } // namespace net | 186 } // namespace net |
OLD | NEW |