Index: net/ssl/server_bound_cert_service.h |
diff --git a/net/ssl/server_bound_cert_service.h b/net/ssl/server_bound_cert_service.h |
deleted file mode 100644 |
index 45472102ff6d55c1054ba056144cc6780fdc161b..0000000000000000000000000000000000000000 |
--- a/net/ssl/server_bound_cert_service.h |
+++ /dev/null |
@@ -1,215 +0,0 @@ |
-// Copyright (c) 2012 The Chromium Authors. All rights reserved. |
-// Use of this source code is governed by a BSD-style license that can be |
-// found in the LICENSE file. |
- |
-#ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
-#define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |
- |
-#include <map> |
-#include <string> |
-#include <vector> |
- |
-#include "base/basictypes.h" |
-#include "base/memory/scoped_ptr.h" |
-#include "base/memory/weak_ptr.h" |
-#include "base/threading/non_thread_safe.h" |
-#include "base/time/time.h" |
-#include "net/base/completion_callback.h" |
-#include "net/base/net_export.h" |
-#include "net/ssl/server_bound_cert_store.h" |
- |
-namespace base { |
-class TaskRunner; |
-} |
- |
-namespace net { |
- |
-class ServerBoundCertServiceJob; |
-class ServerBoundCertServiceRequest; |
-class ServerBoundCertServiceWorker; |
- |
-// A class for creating and fetching server bound certs. These certs are used |
-// to identify users' machines; their public keys are used as channel IDs in |
-// http://tools.ietf.org/html/draft-balfanz-tls-channelid-00. |
-// As a result although certs are set to be invalid after one year, we don't |
-// actually expire them. Once generated, certs are valid as long as the users |
-// want. Users can delete existing certs, and new certs will be generated |
-// automatically. |
- |
-// Inherits from NonThreadSafe in order to use the function |
-// |CalledOnValidThread|. |
-class NET_EXPORT ServerBoundCertService |
- : NON_EXPORTED_BASE(public base::NonThreadSafe) { |
- public: |
- class NET_EXPORT RequestHandle { |
- public: |
- RequestHandle(); |
- ~RequestHandle(); |
- |
- // Cancel the request. Does nothing if the request finished or was already |
- // cancelled. |
- void Cancel(); |
- |
- bool is_active() const { return request_ != NULL; } |
- |
- private: |
- friend class ServerBoundCertService; |
- |
- void RequestStarted(ServerBoundCertService* service, |
- ServerBoundCertServiceRequest* request, |
- const CompletionCallback& callback); |
- |
- void OnRequestComplete(int result); |
- |
- ServerBoundCertService* service_; |
- ServerBoundCertServiceRequest* request_; |
- CompletionCallback callback_; |
- }; |
- |
- // Password used on EncryptedPrivateKeyInfo data stored in EC private_key |
- // values. (This is not used to provide any security, but to workaround NSS |
- // being unable to import unencrypted PrivateKeyInfo for EC keys.) |
- static const char kEPKIPassword[]; |
- |
- // This object owns |server_bound_cert_store|. |task_runner| will |
- // be used to post certificate generation worker tasks. The tasks are |
- // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN. |
- ServerBoundCertService( |
- ServerBoundCertStore* server_bound_cert_store, |
- const scoped_refptr<base::TaskRunner>& task_runner); |
- |
- ~ServerBoundCertService(); |
- |
- // Returns the domain to be used for |host|. The domain is the |
- // "registry controlled domain", or the "ETLD + 1" where one exists, or |
- // the origin otherwise. |
- static std::string GetDomainForHost(const std::string& host); |
- |
- // Tests whether the system time is within the supported range for |
- // certificate generation. This value is cached when ServerBoundCertService |
- // is created, so if the system time is changed by a huge amount, this may no |
- // longer hold. |
- bool IsSystemTimeValid() const { return is_system_time_valid_; } |
- |
- // Fetches the domain bound cert for the specified host if one exists and |
- // creates one otherwise. Returns OK if successful or an error code upon |
- // failure. |
- // |
- // On successful completion, |private_key| stores a DER-encoded |
- // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
- // The PrivateKeyInfo is always an ECDSA private key. |
- // |
- // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
- // could not be completed immediately, in which case the result code will |
- // be passed to the callback when available. |
- // |
- // |*out_req| will be initialized with a handle to the async request. This |
- // RequestHandle object must be cancelled or destroyed before the |
- // ServerBoundCertService is destroyed. |
- int GetOrCreateDomainBoundCert( |
- const std::string& host, |
- std::string* private_key, |
- std::string* cert, |
- const CompletionCallback& callback, |
- RequestHandle* out_req); |
- |
- // Fetches the domain bound cert for the specified host if one exists. |
- // Returns OK if successful, ERR_FILE_NOT_FOUND if none exists, or an error |
- // code upon failure. |
- // |
- // On successful completion, |private_key| stores a DER-encoded |
- // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate. |
- // The PrivateKeyInfo is always an ECDSA private key. |
- // |
- // |callback| must not be null. ERR_IO_PENDING is returned if the operation |
- // could not be completed immediately, in which case the result code will |
- // be passed to the callback when available. If an in-flight |
- // GetDomainBoundCert is pending, and a new GetOrCreateDomainBoundCert |
- // request arrives for the same domain, the GetDomainBoundCert request will |
- // not complete until a new cert is created. |
- // |
- // |*out_req| will be initialized with a handle to the async request. This |
- // RequestHandle object must be cancelled or destroyed before the |
- // ServerBoundCertService is destroyed. |
- int GetDomainBoundCert( |
- const std::string& host, |
- std::string* private_key, |
- std::string* cert, |
- const CompletionCallback& callback, |
- RequestHandle* out_req); |
- |
- // Returns the backing ServerBoundCertStore. |
- ServerBoundCertStore* GetCertStore(); |
- |
- // Public only for unit testing. |
- int cert_count(); |
- uint64 requests() const { return requests_; } |
- uint64 cert_store_hits() const { return cert_store_hits_; } |
- uint64 inflight_joins() const { return inflight_joins_; } |
- uint64 workers_created() const { return workers_created_; } |
- |
- private: |
- // Cancels the specified request. |req| is the handle stored by |
- // GetDomainBoundCert(). After a request is canceled, its completion |
- // callback will not be called. |
- void CancelRequest(ServerBoundCertServiceRequest* req); |
- |
- void GotServerBoundCert(int err, |
- const std::string& server_identifier, |
- base::Time expiration_time, |
- const std::string& key, |
- const std::string& cert); |
- void GeneratedServerBoundCert( |
- const std::string& server_identifier, |
- int error, |
- scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert); |
- void HandleResult(int error, |
- const std::string& server_identifier, |
- const std::string& private_key, |
- const std::string& cert); |
- |
- // Searches for an in-flight request for the same domain. If found, |
- // attaches to the request and returns true. Returns false if no in-flight |
- // request is found. |
- bool JoinToInFlightRequest(const base::TimeTicks& request_start, |
- const std::string& domain, |
- std::string* private_key, |
- std::string* cert, |
- bool create_if_missing, |
- const CompletionCallback& callback, |
- RequestHandle* out_req); |
- |
- // Looks for the domain bound cert for |domain| in this service's store. |
- // Returns OK if it can be found synchronously, ERR_IO_PENDING if the |
- // result cannot be obtained synchronously, or a network error code on |
- // failure (including failure to find a domain-bound cert of |domain|). |
- int LookupDomainBoundCert(const base::TimeTicks& request_start, |
- const std::string& domain, |
- std::string* private_key, |
- std::string* cert, |
- bool create_if_missing, |
- const CompletionCallback& callback, |
- RequestHandle* out_req); |
- |
- scoped_ptr<ServerBoundCertStore> server_bound_cert_store_; |
- scoped_refptr<base::TaskRunner> task_runner_; |
- |
- // inflight_ maps from a server to an active generation which is taking |
- // place. |
- std::map<std::string, ServerBoundCertServiceJob*> inflight_; |
- |
- uint64 requests_; |
- uint64 cert_store_hits_; |
- uint64 inflight_joins_; |
- uint64 workers_created_; |
- |
- bool is_system_time_valid_; |
- |
- base::WeakPtrFactory<ServerBoundCertService> weak_ptr_factory_; |
- |
- DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService); |
-}; |
- |
-} // namespace net |
- |
-#endif // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_ |