| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 5 #ifndef NET_SSL_CHANNEL_ID_SERVICE_H_ |
| 6 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 6 #define NET_SSL_CHANNEL_ID_SERVICE_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| 11 | 11 |
| 12 #include "base/basictypes.h" | 12 #include "base/basictypes.h" |
| 13 #include "base/memory/scoped_ptr.h" | 13 #include "base/memory/scoped_ptr.h" |
| 14 #include "base/memory/weak_ptr.h" | 14 #include "base/memory/weak_ptr.h" |
| 15 #include "base/threading/non_thread_safe.h" | 15 #include "base/threading/non_thread_safe.h" |
| 16 #include "base/time/time.h" | 16 #include "base/time/time.h" |
| 17 #include "net/base/completion_callback.h" | 17 #include "net/base/completion_callback.h" |
| 18 #include "net/base/net_export.h" | 18 #include "net/base/net_export.h" |
| 19 #include "net/ssl/server_bound_cert_store.h" | 19 #include "net/ssl/channel_id_store.h" |
| 20 | 20 |
| 21 namespace base { | 21 namespace base { |
| 22 class TaskRunner; | 22 class TaskRunner; |
| 23 } | 23 } |
| 24 | 24 |
| 25 namespace net { | 25 namespace net { |
| 26 | 26 |
| 27 class ServerBoundCertServiceJob; | 27 class ChannelIDServiceJob; |
| 28 class ServerBoundCertServiceRequest; | 28 class ChannelIDServiceRequest; |
| 29 class ServerBoundCertServiceWorker; | 29 class ChannelIDServiceWorker; |
| 30 | 30 |
| 31 // A class for creating and fetching server bound certs. These certs are used | 31 // A class for creating and fetching Channel IDs. They are used |
| 32 // to identify users' machines; their public keys are used as channel IDs in | 32 // to identify users' machines; their public keys are used as channel IDs in |
| 33 // http://tools.ietf.org/html/draft-balfanz-tls-channelid-00. | 33 // http://tools.ietf.org/html/draft-balfanz-tls-channelid-00. |
| 34 // As a result although certs are set to be invalid after one year, we don't | 34 // As a result although certs are set to be invalid after one year, we don't |
| 35 // actually expire them. Once generated, certs are valid as long as the users | 35 // actually expire them. Once generated, certs are valid as long as the users |
| 36 // want. Users can delete existing certs, and new certs will be generated | 36 // want. Users can delete existing certs, and new certs will be generated |
| 37 // automatically. | 37 // automatically. |
| 38 | 38 |
| 39 // Inherits from NonThreadSafe in order to use the function | 39 // Inherits from NonThreadSafe in order to use the function |
| 40 // |CalledOnValidThread|. | 40 // |CalledOnValidThread|. |
| 41 class NET_EXPORT ServerBoundCertService | 41 class NET_EXPORT ChannelIDService |
| 42 : NON_EXPORTED_BASE(public base::NonThreadSafe) { | 42 : NON_EXPORTED_BASE(public base::NonThreadSafe) { |
| 43 public: | 43 public: |
| 44 class NET_EXPORT RequestHandle { | 44 class NET_EXPORT RequestHandle { |
| 45 public: | 45 public: |
| 46 RequestHandle(); | 46 RequestHandle(); |
| 47 ~RequestHandle(); | 47 ~RequestHandle(); |
| 48 | 48 |
| 49 // Cancel the request. Does nothing if the request finished or was already | 49 // Cancel the request. Does nothing if the request finished or was already |
| 50 // cancelled. | 50 // cancelled. |
| 51 void Cancel(); | 51 void Cancel(); |
| 52 | 52 |
| 53 bool is_active() const { return request_ != NULL; } | 53 bool is_active() const { return request_ != NULL; } |
| 54 | 54 |
| 55 private: | 55 private: |
| 56 friend class ServerBoundCertService; | 56 friend class ChannelIDService; |
| 57 | 57 |
| 58 void RequestStarted(ServerBoundCertService* service, | 58 void RequestStarted(ChannelIDService* service, |
| 59 ServerBoundCertServiceRequest* request, | 59 ChannelIDServiceRequest* request, |
| 60 const CompletionCallback& callback); | 60 const CompletionCallback& callback); |
| 61 | 61 |
| 62 void OnRequestComplete(int result); | 62 void OnRequestComplete(int result); |
| 63 | 63 |
| 64 ServerBoundCertService* service_; | 64 ChannelIDService* service_; |
| 65 ServerBoundCertServiceRequest* request_; | 65 ChannelIDServiceRequest* request_; |
| 66 CompletionCallback callback_; | 66 CompletionCallback callback_; |
| 67 }; | 67 }; |
| 68 | 68 |
| 69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key | 69 // Password used on EncryptedPrivateKeyInfo data stored in EC private_key |
| 70 // values. (This is not used to provide any security, but to workaround NSS | 70 // values. (This is not used to provide any security, but to workaround NSS |
| 71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) | 71 // being unable to import unencrypted PrivateKeyInfo for EC keys.) |
| 72 static const char kEPKIPassword[]; | 72 static const char kEPKIPassword[]; |
| 73 | 73 |
| 74 // This object owns |server_bound_cert_store|. |task_runner| will | 74 // This object owns |channel_id_store|. |task_runner| will |
| 75 // be used to post certificate generation worker tasks. The tasks are | 75 // be used to post certificate generation worker tasks. The tasks are |
| 76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. | 76 // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. |
| 77 ServerBoundCertService( | 77 ChannelIDService( |
| 78 ServerBoundCertStore* server_bound_cert_store, | 78 ChannelIDStore* channel_id_store, |
| 79 const scoped_refptr<base::TaskRunner>& task_runner); | 79 const scoped_refptr<base::TaskRunner>& task_runner); |
| 80 | 80 |
| 81 ~ServerBoundCertService(); | 81 ~ChannelIDService(); |
| 82 | 82 |
| 83 // Returns the domain to be used for |host|. The domain is the | 83 // Returns the domain to be used for |host|. The domain is the |
| 84 // "registry controlled domain", or the "ETLD + 1" where one exists, or | 84 // "registry controlled domain", or the "ETLD + 1" where one exists, or |
| 85 // the origin otherwise. | 85 // the origin otherwise. |
| 86 static std::string GetDomainForHost(const std::string& host); | 86 static std::string GetDomainForHost(const std::string& host); |
| 87 | 87 |
| 88 // Tests whether the system time is within the supported range for | 88 // Tests whether the system time is within the supported range for |
| 89 // certificate generation. This value is cached when ServerBoundCertService | 89 // certificate generation. This value is cached when ChannelIDService |
| 90 // is created, so if the system time is changed by a huge amount, this may no | 90 // is created, so if the system time is changed by a huge amount, this may no |
| 91 // longer hold. | 91 // longer hold. |
| 92 bool IsSystemTimeValid() const { return is_system_time_valid_; } | 92 bool IsSystemTimeValid() const { return is_system_time_valid_; } |
| 93 | 93 |
| 94 // Fetches the domain bound cert for the specified host if one exists and | 94 // Fetches the domain bound cert for the specified host if one exists and |
| 95 // creates one otherwise. Returns OK if successful or an error code upon | 95 // creates one otherwise. Returns OK if successful or an error code upon |
| 96 // failure. | 96 // failure. |
| 97 // | 97 // |
| 98 // On successful completion, |private_key| stores a DER-encoded | 98 // On successful completion, |private_key| stores a DER-encoded |
| 99 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 99 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
| 100 // The PrivateKeyInfo is always an ECDSA private key. | 100 // The PrivateKeyInfo is always an ECDSA private key. |
| 101 // | 101 // |
| 102 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 102 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
| 103 // could not be completed immediately, in which case the result code will | 103 // could not be completed immediately, in which case the result code will |
| 104 // be passed to the callback when available. | 104 // be passed to the callback when available. |
| 105 // | 105 // |
| 106 // |*out_req| will be initialized with a handle to the async request. This | 106 // |*out_req| will be initialized with a handle to the async request. This |
| 107 // RequestHandle object must be cancelled or destroyed before the | 107 // RequestHandle object must be cancelled or destroyed before the |
| 108 // ServerBoundCertService is destroyed. | 108 // ChannelIDService is destroyed. |
| 109 int GetOrCreateDomainBoundCert( | 109 int GetOrCreateChannelID( |
| 110 const std::string& host, | 110 const std::string& host, |
| 111 std::string* private_key, | 111 std::string* private_key, |
| 112 std::string* cert, | 112 std::string* cert, |
| 113 const CompletionCallback& callback, | 113 const CompletionCallback& callback, |
| 114 RequestHandle* out_req); | 114 RequestHandle* out_req); |
| 115 | 115 |
| 116 // Fetches the domain bound cert for the specified host if one exists. | 116 // Fetches the domain bound cert for the specified host if one exists. |
| 117 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error | 117 // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error |
| 118 // code upon failure. | 118 // code upon failure. |
| 119 // | 119 // |
| 120 // On successful completion, |private_key| stores a DER-encoded | 120 // On successful completion, |private_key| stores a DER-encoded |
| 121 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. | 121 // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
| 122 // The PrivateKeyInfo is always an ECDSA private key. | 122 // The PrivateKeyInfo is always an ECDSA private key. |
| 123 // | 123 // |
| 124 // |callback| must not be null. ERR_IO_PENDING is returned if the operation | 124 // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
| 125 // could not be completed immediately, in which case the result code will | 125 // could not be completed immediately, in which case the result code will |
| 126 // be passed to the callback when available. If an in-flight | 126 // be passed to the callback when available. If an in-flight |
| 127 // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert | 127 // GetChannelID is pending, and a new GetOrCreateDomainBoundCert |
| 128 // request arrives for the same domain, the GetDomainBoundCert request will | 128 // request arrives for the same domain, the GetChannelID request will |
| 129 // not complete until a new cert is created. | 129 // not complete until a new cert is created. |
| 130 // | 130 // |
| 131 // |*out_req| will be initialized with a handle to the async request. This | 131 // |*out_req| will be initialized with a handle to the async request. This |
| 132 // RequestHandle object must be cancelled or destroyed before the | 132 // RequestHandle object must be cancelled or destroyed before the |
| 133 // ServerBoundCertService is destroyed. | 133 // ChannelIDService is destroyed. |
| 134 int GetDomainBoundCert( | 134 int GetChannelID( |
| 135 const std::string& host, | 135 const std::string& host, |
| 136 std::string* private_key, | 136 std::string* private_key, |
| 137 std::string* cert, | 137 std::string* cert, |
| 138 const CompletionCallback& callback, | 138 const CompletionCallback& callback, |
| 139 RequestHandle* out_req); | 139 RequestHandle* out_req); |
| 140 | 140 |
| 141 // Returns the backing ServerBoundCertStore. | 141 // Returns the backing ChannelIDStore. |
| 142 ServerBoundCertStore* GetCertStore(); | 142 ChannelIDStore* GetChannelIDStore(); |
| 143 | 143 |
| 144 // Public only for unit testing. | 144 // Public only for unit testing. |
| 145 int cert_count(); | 145 int cert_count(); |
| 146 uint64 requests() const { return requests_; } | 146 uint64 requests() const { return requests_; } |
| 147 uint64 cert_store_hits() const { return cert_store_hits_; } | 147 uint64 cert_store_hits() const { return cert_store_hits_; } |
| 148 uint64 inflight_joins() const { return inflight_joins_; } | 148 uint64 inflight_joins() const { return inflight_joins_; } |
| 149 uint64 workers_created() const { return workers_created_; } | 149 uint64 workers_created() const { return workers_created_; } |
| 150 | 150 |
| 151 private: | 151 private: |
| 152 // Cancels the specified request. |req| is the handle stored by | 152 // Cancels the specified request. |req| is the handle stored by |
| 153 // GetDomainBoundCert(). After a request is canceled, its completion | 153 // GetChannelID(). After a request is canceled, its completion |
| 154 // callback will not be called. | 154 // callback will not be called. |
| 155 void CancelRequest(ServerBoundCertServiceRequest* req); | 155 void CancelRequest(ChannelIDServiceRequest* req); |
| 156 | 156 |
| 157 void GotServerBoundCert(int err, | 157 void GotChannelID(int err, |
| 158 const std::string& server_identifier, | 158 const std::string& server_identifier, |
| 159 base::Time expiration_time, | 159 base::Time expiration_time, |
| 160 const std::string& key, | 160 const std::string& key, |
| 161 const std::string& cert); | 161 const std::string& cert); |
| 162 void GeneratedServerBoundCert( | 162 void GeneratedChannelID( |
| 163 const std::string& server_identifier, | 163 const std::string& server_identifier, |
| 164 int error, | 164 int error, |
| 165 scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert); | 165 scoped_ptr<ChannelIDStore::ChannelID> channel_id); |
| 166 void HandleResult(int error, | 166 void HandleResult(int error, |
| 167 const std::string& server_identifier, | 167 const std::string& server_identifier, |
| 168 const std::string& private_key, | 168 const std::string& private_key, |
| 169 const std::string& cert); | 169 const std::string& cert); |
| 170 | 170 |
| 171 // Searches for an in-flight request for the same domain. If found, | 171 // Searches for an in-flight request for the same domain. If found, |
| 172 // attaches to the request and returns true. Returns false if no in-flight | 172 // attaches to the request and returns true. Returns false if no in-flight |
| 173 // request is found. | 173 // request is found. |
| 174 bool JoinToInFlightRequest(const base::TimeTicks& request_start, | 174 bool JoinToInFlightRequest(const base::TimeTicks& request_start, |
| 175 const std::string& domain, | 175 const std::string& domain, |
| 176 std::string* private_key, | 176 std::string* private_key, |
| 177 std::string* cert, | 177 std::string* cert, |
| 178 bool create_if_missing, | 178 bool create_if_missing, |
| 179 const CompletionCallback& callback, | 179 const CompletionCallback& callback, |
| 180 RequestHandle* out_req); | 180 RequestHandle* out_req); |
| 181 | 181 |
| 182 // Looks for the domain bound cert for |domain| in this service's store. | 182 // Looks for the domain bound cert for |domain| in this service's store. |
| 183 // Returns OK if it can be found synchronously, ERR_IO_PENDING if the | 183 // Returns OK if it can be found synchronously, ERR_IO_PENDING if the |
| 184 // result cannot be obtained synchronously, or a network error code on | 184 // result cannot be obtained synchronously, or a network error code on |
| 185 // failure (including failure to find a domain-bound cert of |domain|). | 185 // failure (including failure to find a domain-bound cert of |domain|). |
| 186 int LookupDomainBoundCert(const base::TimeTicks& request_start, | 186 int LookupChannelID(const base::TimeTicks& request_start, |
| 187 const std::string& domain, | 187 const std::string& domain, |
| 188 std::string* private_key, | 188 std::string* private_key, |
| 189 std::string* cert, | 189 std::string* cert, |
| 190 bool create_if_missing, | 190 bool create_if_missing, |
| 191 const CompletionCallback& callback, | 191 const CompletionCallback& callback, |
| 192 RequestHandle* out_req); | 192 RequestHandle* out_req); |
| 193 | 193 |
| 194 scoped_ptr<ServerBoundCertStore> server_bound_cert_store_; | 194 scoped_ptr<ChannelIDStore> channel_id_store_; |
| 195 scoped_refptr<base::TaskRunner> task_runner_; | 195 scoped_refptr<base::TaskRunner> task_runner_; |
| 196 | 196 |
| 197 // inflight_ maps from a server to an active generation which is taking | 197 // inflight_ maps from a server to an active generation which is taking |
| 198 // place. | 198 // place. |
| 199 std::map<std::string, ServerBoundCertServiceJob*> inflight_; | 199 std::map<std::string, ChannelIDServiceJob*> inflight_; |
| 200 | 200 |
| 201 uint64 requests_; | 201 uint64 requests_; |
| 202 uint64 cert_store_hits_; | 202 uint64 cert_store_hits_; |
| 203 uint64 inflight_joins_; | 203 uint64 inflight_joins_; |
| 204 uint64 workers_created_; | 204 uint64 workers_created_; |
| 205 | 205 |
| 206 bool is_system_time_valid_; | 206 bool is_system_time_valid_; |
| 207 | 207 |
| 208 base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; | 208 base::WeakPtrFactory<ChannelIDService> weak_ptr_factory_; |
| 209 | 209 |
| 210 DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); | 210 DISALLOW_COPY_AND_ASSIGN(ChannelIDService); |
| 211 }; | 211 }; |
| 212 | 212 |
| 213 } // namespace net | 213 } // namespace net |
| 214 | 214 |
| 215 #endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ | 215 #endif // NET_SSL_CHANNEL_ID_SERVICE_H_ |
| OLD | NEW |