| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 5 #ifndef CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
| 6 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 6 #define CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| 11 | 11 |
| 12 #include "base/basictypes.h" | 12 #include "base/basictypes.h" |
| 13 #include "base/memory/ref_counted.h" | 13 #include "base/memory/ref_counted.h" |
| 14 #include "base/memory/scoped_ptr.h" | 14 #include "base/memory/scoped_ptr.h" |
| 15 #include "base/memory/weak_ptr.h" | |
| 16 #include "chromeos/chromeos_export.h" | 15 #include "chromeos/chromeos_export.h" |
| 17 #include "chromeos/network/onc/onc_certificate_importer.h" | 16 #include "chromeos/network/onc/onc_certificate_importer.h" |
| 18 #include "components/onc/onc_constants.h" | 17 #include "components/onc/onc_constants.h" |
| 19 | 18 |
| 20 namespace base { | 19 namespace base { |
| 21 class DictionaryValue; | 20 class DictionaryValue; |
| 22 class ListValue; | 21 class ListValue; |
| 23 class SequencedTaskRunner; | |
| 24 class SingleThreadTaskRunner; | |
| 25 } | 22 } |
| 26 | 23 |
| 27 namespace net { | 24 namespace net { |
| 28 class NSSCertDatabase; | 25 class NSSCertDatabase; |
| 29 class X509Certificate; | 26 class X509Certificate; |
| 30 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; | 27 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; |
| 31 } | 28 } |
| 32 | 29 |
| 33 namespace chromeos { | 30 namespace chromeos { |
| 34 namespace onc { | 31 namespace onc { |
| 35 | 32 |
| 36 // This class handles certificate imports from ONC (both policy and user | 33 // This class handles certificate imports from ONC (both policy and user |
| 37 // imports) into a certificate store. The GUID of Client certificates is stored | 34 // imports) into the certificate store. The GUID of Client certificates is |
| 38 // together with the certificate as Nickname. In contrast, Server and CA | 35 // stored together with the certificate as Nickname. In contrast, Server and CA |
| 39 // certificates are identified by their PEM and not by GUID. | 36 // certificates are identified by their PEM and not by GUID. |
| 40 // TODO(pneubeck): Replace Nickname by PEM for Client | 37 // TODO(pneubeck): Replace Nickname by PEM for Client |
| 41 // certificates. http://crbug.com/252119 | 38 // certificates. http://crbug.com/252119 |
| 42 class CHROMEOS_EXPORT CertificateImporterImpl : public CertificateImporter { | 39 class CHROMEOS_EXPORT CertificateImporterImpl : public CertificateImporter { |
| 43 public: | 40 public: |
| 44 // |io_task_runner| will be used for NSSCertDatabase accesses. | 41 typedef std::map<std::string, scoped_refptr<net::X509Certificate> > |
| 45 CertificateImporterImpl( | 42 CertsByGUID; |
| 46 const scoped_refptr<base::SequencedTaskRunner>& io_task_runner, | 43 |
| 47 net::NSSCertDatabase* target_nssdb_); | 44 explicit CertificateImporterImpl(net::NSSCertDatabase* target_nssdb_); |
| 48 virtual ~CertificateImporterImpl(); | |
| 49 | 45 |
| 50 // CertificateImporter overrides | 46 // CertificateImporter overrides |
| 51 virtual void ImportCertificates(const base::ListValue& certificates, | 47 virtual bool ImportCertificates( |
| 52 ::onc::ONCSource source, | 48 const base::ListValue& certificates, |
| 53 const DoneCallback& done_callback) OVERRIDE; | 49 ::onc::ONCSource source, |
| 50 net::CertificateList* onc_trusted_certificates) OVERRIDE; |
| 51 |
| 52 // This implements ImportCertificates. Additionally, if |
| 53 // |imported_server_and_ca_certs| is not NULL, it will be filled with the |
| 54 // (GUID, Certificate) pairs of all succesfully imported Server and CA |
| 55 // certificates. |
| 56 bool ParseAndStoreCertificates(bool allow_trust_imports, |
| 57 const base::ListValue& onc_certificates, |
| 58 net::CertificateList* onc_trusted_certificates, |
| 59 CertsByGUID* imported_server_and_ca_certs); |
| 54 | 60 |
| 55 private: | 61 private: |
| 56 void RunDoneCallback(const CertificateImporter::DoneCallback& callback, | |
| 57 bool success, | |
| 58 const net::CertificateList& onc_trusted_certificates); | |
| 59 | |
| 60 // This is the synchronous implementation of ImportCertificates. It is | |
| 61 // executed on the given |io_task_runner_|. | |
| 62 static void ParseAndStoreCertificates(::onc::ONCSource source, | |
| 63 const DoneCallback& done_callback, | |
| 64 base::ListValue* certificates, | |
| 65 net::NSSCertDatabase* nssdb); | |
| 66 | |
| 67 // Lists the certificates that have the string |label| as their certificate | 62 // Lists the certificates that have the string |label| as their certificate |
| 68 // nickname (exact match). | 63 // nickname (exact match). |
| 69 static void ListCertsWithNickname(const std::string& label, | 64 static void ListCertsWithNickname(const std::string& label, |
| 70 net::CertificateList* result, | 65 net::CertificateList* result, |
| 71 net::NSSCertDatabase* target_nssdb); | 66 net::NSSCertDatabase* target_nssdb); |
| 72 | 67 |
| 73 // Deletes any certificate that has the string |label| as its nickname (exact | 68 // Deletes any certificate that has the string |label| as its nickname (exact |
| 74 // match). | 69 // match). |
| 75 static bool DeleteCertAndKeyByNickname(const std::string& label, | 70 static bool DeleteCertAndKeyByNickname(const std::string& label, |
| 76 net::NSSCertDatabase* target_nssdb); | 71 net::NSSCertDatabase* target_nssdb); |
| 77 | 72 |
| 78 // Parses and stores/removes |certificate| in/from the certificate | 73 // Parses and stores/removes |certificate| in/from the certificate |
| 79 // store. Returns true if the operation succeeded. | 74 // store. Returns true if the operation succeeded. |
| 80 static bool ParseAndStoreCertificate( | 75 bool ParseAndStoreCertificate( |
| 81 bool allow_trust_imports, | 76 bool allow_trust_imports, |
| 82 const base::DictionaryValue& certificate, | 77 const base::DictionaryValue& certificate, |
| 83 net::NSSCertDatabase* nssdb, | 78 net::CertificateList* onc_trusted_certificates, |
| 84 net::CertificateList* onc_trusted_certificates); | 79 CertsByGUID* imported_server_and_ca_certs); |
| 85 | 80 |
| 86 // Imports the Server or CA certificate |certificate|. Web trust is only | 81 // Imports the Server or CA certificate |certificate|. Web trust is only |
| 87 // applied if the certificate requests the TrustBits attribute "Web" and if | 82 // applied if the certificate requests the TrustBits attribute "Web" and if |
| 88 // the |allow_trust_imports| permission is granted, otherwise the attribute is | 83 // the |allow_trust_imports| permission is granted, otherwise the attribute is |
| 89 // ignored. | 84 // ignored. |
| 90 static bool ParseServerOrCaCertificate( | 85 bool ParseServerOrCaCertificate( |
| 91 bool allow_trust_imports, | 86 bool allow_trust_imports, |
| 92 const std::string& cert_type, | 87 const std::string& cert_type, |
| 93 const std::string& guid, | 88 const std::string& guid, |
| 94 const base::DictionaryValue& certificate, | 89 const base::DictionaryValue& certificate, |
| 95 net::NSSCertDatabase* nssdb, | 90 net::CertificateList* onc_trusted_certificates, |
| 96 net::CertificateList* onc_trusted_certificates); | 91 CertsByGUID* imported_server_and_ca_certs); |
| 97 | 92 |
| 98 static bool ParseClientCertificate(const std::string& guid, | 93 bool ParseClientCertificate(const std::string& guid, |
| 99 const base::DictionaryValue& certificate, | 94 const base::DictionaryValue& certificate); |
| 100 net::NSSCertDatabase* nssdb); | |
| 101 | |
| 102 // The task runner to use for NSSCertDatabase accesses. | |
| 103 scoped_refptr<base::SequencedTaskRunner> io_task_runner_; | |
| 104 | 95 |
| 105 // The certificate database to which certificates are imported. | 96 // The certificate database to which certificates are imported. |
| 106 net::NSSCertDatabase* target_nssdb_; | 97 net::NSSCertDatabase* target_nssdb_; |
| 107 | 98 |
| 108 base::WeakPtrFactory<CertificateImporterImpl> weak_factory_; | |
| 109 | |
| 110 DISALLOW_COPY_AND_ASSIGN(CertificateImporterImpl); | 99 DISALLOW_COPY_AND_ASSIGN(CertificateImporterImpl); |
| 111 }; | 100 }; |
| 112 | 101 |
| 113 } // namespace onc | 102 } // namespace onc |
| 114 } // namespace chromeos | 103 } // namespace chromeos |
| 115 | 104 |
| 116 #endif // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ | 105 #endif // CHROMEOS_NETWORK_ONC_ONC_CERTIFICATE_IMPORTER_IMPL_H_ |
| OLD | NEW |