OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/net/client_cert_store_chromeos.h" | 5 #include "chrome/browser/chromeos/net/client_cert_store_chromeos.h" |
6 | 6 |
7 #include <cert.h> | 7 #include <cert.h> |
8 #include <algorithm> | 8 #include <algorithm> |
| 9 #include <iterator> |
9 #include <utility> | 10 #include <utility> |
10 | 11 |
11 #include "base/bind.h" | 12 #include "base/bind.h" |
12 #include "base/bind_helpers.h" | 13 #include "base/bind_helpers.h" |
13 #include "base/callback.h" | 14 #include "base/callback.h" |
14 #include "base/location.h" | 15 #include "base/location.h" |
| 16 #include "base/memory/ptr_util.h" |
15 #include "base/task_runner_util.h" | 17 #include "base/task_runner_util.h" |
16 #include "base/threading/worker_pool.h" | 18 #include "base/threading/worker_pool.h" |
17 #include "chrome/browser/chromeos/certificate_provider/certificate_provider.h" | 19 #include "chrome/browser/chromeos/certificate_provider/certificate_provider.h" |
18 #include "crypto/nss_crypto_module_delegate.h" | 20 #include "crypto/nss_crypto_module_delegate.h" |
| 21 #include "net/ssl/client_key_store.h" |
19 #include "net/ssl/ssl_cert_request_info.h" | 22 #include "net/ssl/ssl_cert_request_info.h" |
| 23 #include "net/ssl/ssl_private_key.h" |
20 | 24 |
21 namespace chromeos { | 25 namespace chromeos { |
22 | 26 |
23 namespace { | 27 namespace { |
24 | 28 |
| 29 class ClientCertIdentityCros : public net::ClientCertIdentity { |
| 30 public: |
| 31 explicit ClientCertIdentityCros(scoped_refptr<net::X509Certificate> cert) |
| 32 : net::ClientCertIdentity(std::move(cert)) {} |
| 33 ~ClientCertIdentityCros() override = default; |
| 34 |
| 35 void AcquirePrivateKey( |
| 36 const base::Callback<void(scoped_refptr<net::SSLPrivateKey>)>& |
| 37 private_key_callback) override { |
| 38 // There is only one implementation of ClientKeyStore and it doesn't do |
| 39 // anything blocking, so this doesn't need to run on a worker thread. |
| 40 private_key_callback.Run( |
| 41 net::ClientKeyStore::GetInstance()->FetchClientCertPrivateKey( |
| 42 *certificate())); |
| 43 } |
| 44 }; |
| 45 |
25 class CertNotAllowedPredicate { | 46 class CertNotAllowedPredicate { |
26 public: | 47 public: |
27 explicit CertNotAllowedPredicate( | 48 explicit CertNotAllowedPredicate( |
28 const ClientCertStoreChromeOS::CertFilter* filter) | 49 const ClientCertStoreChromeOS::CertFilter* filter) |
29 : filter_(filter) {} | 50 : filter_(filter) {} |
30 bool operator()(const scoped_refptr<net::X509Certificate>& cert) const { | 51 bool operator()( |
31 return !filter_->IsCertAllowed(cert); | 52 const std::unique_ptr<net::ClientCertIdentity>& identity) const { |
| 53 return !filter_->IsCertAllowed(identity->certificate()); |
32 } | 54 } |
33 | 55 |
34 private: | 56 private: |
35 const ClientCertStoreChromeOS::CertFilter* const filter_; | 57 const ClientCertStoreChromeOS::CertFilter* const filter_; |
36 }; | 58 }; |
37 | 59 |
38 } // namespace | 60 } // namespace |
39 | 61 |
40 ClientCertStoreChromeOS::ClientCertStoreChromeOS( | 62 ClientCertStoreChromeOS::ClientCertStoreChromeOS( |
41 std::unique_ptr<CertificateProvider> cert_provider, | 63 std::unique_ptr<CertificateProvider> cert_provider, |
(...skipping 25 matching lines...) Expand all Loading... |
67 } | 89 } |
68 | 90 |
69 if (cert_filter_->Init(get_additional_certs_and_continue)) | 91 if (cert_filter_->Init(get_additional_certs_and_continue)) |
70 get_additional_certs_and_continue.Run(); | 92 get_additional_certs_and_continue.Run(); |
71 } | 93 } |
72 | 94 |
73 void ClientCertStoreChromeOS::GotAdditionalCerts( | 95 void ClientCertStoreChromeOS::GotAdditionalCerts( |
74 const net::SSLCertRequestInfo* request, | 96 const net::SSLCertRequestInfo* request, |
75 const ClientCertListCallback& callback, | 97 const ClientCertListCallback& callback, |
76 const net::CertificateList& additional_certs) { | 98 const net::CertificateList& additional_certs) { |
77 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 99 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate; |
78 password_delegate; | 100 if (!password_delegate_factory_.is_null()) |
79 if (!password_delegate_factory_.is_null()) { | 101 password_delegate = password_delegate_factory_.Run(request->host_and_port); |
80 password_delegate.reset( | |
81 password_delegate_factory_.Run(request->host_and_port)); | |
82 } | |
83 if (base::PostTaskAndReplyWithResult( | 102 if (base::PostTaskAndReplyWithResult( |
84 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), | 103 base::WorkerPool::GetTaskRunner(true /* task_is_slow */).get(), |
85 FROM_HERE, | 104 FROM_HERE, |
86 base::Bind(&ClientCertStoreChromeOS::GetAndFilterCertsOnWorkerThread, | 105 base::Bind(&ClientCertStoreChromeOS::GetAndFilterCertsOnWorkerThread, |
87 base::Unretained(this), base::Passed(&password_delegate), | 106 base::Unretained(this), password_delegate, request, |
88 request, additional_certs), | 107 additional_certs), |
89 callback)) { | 108 callback)) { |
90 return; | 109 return; |
91 } | 110 } |
92 // If the task could not be posted, behave as if there were no certificates. | 111 // If the task could not be posted, behave as if there were no certificates. |
93 callback.Run(net::CertificateList()); | 112 callback.Run(net::ClientCertIdentityList()); |
94 } | 113 } |
95 | 114 |
96 net::CertificateList ClientCertStoreChromeOS::GetAndFilterCertsOnWorkerThread( | 115 net::ClientCertIdentityList |
97 std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate> | 116 ClientCertStoreChromeOS::GetAndFilterCertsOnWorkerThread( |
| 117 scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> |
98 password_delegate, | 118 password_delegate, |
99 const net::SSLCertRequestInfo* request, | 119 const net::SSLCertRequestInfo* request, |
100 const net::CertificateList& additional_certs) { | 120 const net::CertificateList& additional_certs) { |
101 net::CertificateList unfiltered_certs; | 121 net::ClientCertIdentityList client_certs; |
102 net::ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( | 122 net::ClientCertStoreNSS::GetPlatformCertsOnWorkerThread( |
103 std::move(password_delegate), &unfiltered_certs); | 123 std::move(password_delegate), &client_certs); |
104 | 124 |
105 unfiltered_certs.erase( | 125 client_certs.erase( |
106 std::remove_if(unfiltered_certs.begin(), unfiltered_certs.end(), | 126 std::remove_if(client_certs.begin(), client_certs.end(), |
107 CertNotAllowedPredicate(cert_filter_.get())), | 127 CertNotAllowedPredicate(cert_filter_.get())), |
108 unfiltered_certs.end()); | 128 client_certs.end()); |
109 | 129 |
110 unfiltered_certs.insert(unfiltered_certs.end(), additional_certs.begin(), | 130 for (const scoped_refptr<net::X509Certificate>& cert : additional_certs) |
111 additional_certs.end()); | 131 client_certs.push_back(base::MakeUnique<ClientCertIdentityCros>(cert)); |
112 | 132 net::ClientCertStoreNSS::FilterCertsOnWorkerThread(&client_certs, *request); |
113 net::CertificateList selected_certs; | 133 return client_certs; |
114 net::ClientCertStoreNSS::FilterCertsOnWorkerThread(unfiltered_certs, *request, | |
115 &selected_certs); | |
116 return selected_certs; | |
117 } | 134 } |
118 | 135 |
119 } // namespace chromeos | 136 } // namespace chromeos |
OLD | NEW |