OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 5 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
6 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 6 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/basictypes.h" | 12 #include "base/basictypes.h" |
13 #include "base/memory/ref_counted.h" | 13 #include "base/memory/ref_counted.h" |
14 #include "base/memory/scoped_ptr.h" | 14 #include "base/memory/scoped_ptr.h" |
15 #include "base/memory/weak_ptr.h" | |
16 #include "chromeos/chromeos_export.h" | 15 #include "chromeos/chromeos_export.h" |
17 #include "chromeos/network/onc/onc_certificate_importer.h" | 16 #include "chromeos/network/onc/onc_certificate_importer.h" |
18 #include "components/onc/onc_constants.h" | 17 #include "components/onc/onc_constants.h" |
19 | 18 |
20 namespace base { | 19 namespace base { |
21 class DictionaryValue; | 20 class DictionaryValue; |
22 class ListValue; | 21 class ListValue; |
23 class SequencedTaskRunner; | |
24 class SingleThreadTaskRunner; | |
25 } | 22 } |
26 | 23 |
27 namespace net { | 24 namespace net { |
28 class NSSCertDatabase; | 25 class NSSCertDatabase; |
29 class X509Certificate; | 26 class X509Certificate; |
30 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; | 27 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; |
31 } | 28 } |
32 | 29 |
33 namespace chromeos { | 30 namespace chromeos { |
34 namespace onc { | 31 namespace onc { |
35 | 32 |
36 // This class handles certificate imports from ONC (both policy and user | 33 // This class handles certificate imports from ONC (both policy and user |
37 // imports) into a certificate store. The GUID of Client certificates is stored | 34 // imports) into the certificate store. The GUID of Client certificates is |
38 // together with the certificate as Nickname. In contrast, Server and CA | 35 // stored together with the certificate as Nickname. In contrast, Server and CA |
39 // certificates are identified by their PEM and not by GUID. | 36 // certificates are identified by their PEM and not by GUID. |
40 // TODO(pneubeck): Replace Nickname by PEM for Client | 37 // TODO(pneubeck): Replace Nickname by PEM for Client |
41 // certificates. http://crbug.com/252119 | 38 // certificates. http://crbug.com/252119 |
42 class CHROMEOS_EXPORT CertificateImporterImpl : public CertificateImporter { | 39 class CHROMEOS_EXPORT CertificateImporterImpl : public CertificateImporter { |
43 public: | 40 public: |
44 // |io_task_runner| will be used for NSSCertDatabase accesses. | 41 typedef std::map<std::string, scoped_refptr<net::X509Certificate> > |
45 CertificateImporterImpl( | 42 CertsByGUID; |
46 const scoped_refptr<base::SequencedTaskRunner>& io_task_runner, | 43 |
47 net::NSSCertDatabase* target_nssdb_); | 44 explicit CertificateImporterImpl(net::NSSCertDatabase* target_nssdb_); |
48 virtual ~CertificateImporterImpl(); | |
49 | 45 |
50 // CertificateImporter overrides | 46 // CertificateImporter overrides |
51 virtual void ImportCertificates(const base::ListValue& certificates, | 47 virtual bool ImportCertificates( |
52 ::onc::ONCSource source, | 48 const base::ListValue& certificates, |
53 const DoneCallback& done_callback) OVERRIDE; | 49 ::onc::ONCSource source, |
| 50 net::CertificateList* onc_trusted_certificates) OVERRIDE; |
| 51 |
| 52 // This implements ImportCertificates. Additionally, if |
| 53 // |imported_server_and_ca_certs| is not NULL, it will be filled with the |
| 54 // (GUID, Certificate) pairs of all succesfully imported Server and CA |
| 55 // certificates. |
| 56 bool ParseAndStoreCertificates(bool allow_trust_imports, |
| 57 const base::ListValue& onc_certificates, |
| 58 net::CertificateList* onc_trusted_certificates, |
| 59 CertsByGUID* imported_server_and_ca_certs); |
54 | 60 |
55 private: | 61 private: |
56 void RunDoneCallback(const CertificateImporter::DoneCallback& callback, | |
57 bool success, | |
58 const net::CertificateList& onc_trusted_certificates); | |
59 | |
60 // This is the synchronous implementation of ImportCertificates. It is | |
61 // executed on the given |io_task_runner_|. | |
62 static void ParseAndStoreCertificates(::onc::ONCSource source, | |
63 const DoneCallback& done_callback, | |
64 base::ListValue* certificates, | |
65 net::NSSCertDatabase* nssdb); | |
66 | |
67 // Lists the certificates that have the string |label| as their certificate | 62 // Lists the certificates that have the string |label| as their certificate |
68 // nickname (exact match). | 63 // nickname (exact match). |
69 static void ListCertsWithNickname(const std::string& label, | 64 static void ListCertsWithNickname(const std::string& label, |
70 net::CertificateList* result, | 65 net::CertificateList* result, |
71 net::NSSCertDatabase* target_nssdb); | 66 net::NSSCertDatabase* target_nssdb); |
72 | 67 |
73 // Deletes any certificate that has the string |label| as its nickname (exact | 68 // Deletes any certificate that has the string |label| as its nickname (exact |
74 // match). | 69 // match). |
75 static bool DeleteCertAndKeyByNickname(const std::string& label, | 70 static bool DeleteCertAndKeyByNickname(const std::string& label, |
76 net::NSSCertDatabase* target_nssdb); | 71 net::NSSCertDatabase* target_nssdb); |
77 | 72 |
78 // Parses and stores/removes |certificate| in/from the certificate | 73 // Parses and stores/removes |certificate| in/from the certificate |
79 // store. Returns true if the operation succeeded. | 74 // store. Returns true if the operation succeeded. |
80 static bool ParseAndStoreCertificate( | 75 bool ParseAndStoreCertificate( |
81 bool allow_trust_imports, | 76 bool allow_trust_imports, |
82 const base::DictionaryValue& certificate, | 77 const base::DictionaryValue& certificate, |
83 net::NSSCertDatabase* nssdb, | 78 net::CertificateList* onc_trusted_certificates, |
84 net::CertificateList* onc_trusted_certificates); | 79 CertsByGUID* imported_server_and_ca_certs); |
85 | 80 |
86 // Imports the Server or CA certificate |certificate|. Web trust is only | 81 // Imports the Server or CA certificate |certificate|. Web trust is only |
87 // applied if the certificate requests the TrustBits attribute "Web" and if | 82 // applied if the certificate requests the TrustBits attribute "Web" and if |
88 // the |allow_trust_imports| permission is granted, otherwise the attribute is | 83 // the |allow_trust_imports| permission is granted, otherwise the attribute is |
89 // ignored. | 84 // ignored. |
90 static bool ParseServerOrCaCertificate( | 85 bool ParseServerOrCaCertificate( |
91 bool allow_trust_imports, | 86 bool allow_trust_imports, |
92 const std::string& cert_type, | 87 const std::string& cert_type, |
93 const std::string& guid, | 88 const std::string& guid, |
94 const base::DictionaryValue& certificate, | 89 const base::DictionaryValue& certificate, |
95 net::NSSCertDatabase* nssdb, | 90 net::CertificateList* onc_trusted_certificates, |
96 net::CertificateList* onc_trusted_certificates); | 91 CertsByGUID* imported_server_and_ca_certs); |
97 | 92 |
98 static bool ParseClientCertificate(const std::string& guid, | 93 bool ParseClientCertificate(const std::string& guid, |
99 const base::DictionaryValue& certificate, | 94 const base::DictionaryValue& certificate); |
100 net::NSSCertDatabase* nssdb); | |
101 | |
102 // The task runner to use for NSSCertDatabase accesses. | |
103 scoped_refptr<base::SequencedTaskRunner> io_task_runner_; | |
104 | 95 |
105 // The certificate database to which certificates are imported. | 96 // The certificate database to which certificates are imported. |
106 net::NSSCertDatabase* target_nssdb_; | 97 net::NSSCertDatabase* target_nssdb_; |
107 | 98 |
108 base::WeakPtrFactory<CertificateImporterImpl> weak_factory_; | |
109 | |
110 DISALLOW_COPY_AND_ASSIGN(CertificateImporterImpl); | 99 DISALLOW_COPY_AND_ASSIGN(CertificateImporterImpl); |
111 }; | 100 }; |
112 | 101 |
113 } // namespace onc | 102 } // namespace onc |
114 } // namespace chromeos | 103 } // namespace chromeos |
115 | 104 |
116 #endif // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 105 #endif // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
OLD | NEW |