chromeos/cert_loader.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/cert_loader.h"
   6
   7 #include <algorithm>
   8
   9 #include "base/bind.h"
  10 #include "base/location.h"
  11 #include "base/message_loop/message_loop_proxy.h"
  12 #include "base/strings/string_number_conversions.h"
  13 #include "base/task_runner_util.h"
  14 #include "base/threading/worker_pool.h"
  15 #include "crypto/nss_util.h"
  16 #include "net/cert/nss_cert_database.h"
  17 #include "net/cert/nss_cert_database_chromeos.h"
  18 #include "net/cert/x509_certificate.h"
  19
  20 namespace chromeos {
  21
  22 static CertLoader* g_cert_loader = NULL;
  23
  24 // static
  25 void CertLoader::Initialize() {
  26   CHECK(!g_cert_loader);
  27   g_cert_loader = new CertLoader();
  28 }
  29
  30 // static
  31 void CertLoader::Shutdown() {
  32   CHECK(g_cert_loader);
  33   delete g_cert_loader;
  34   g_cert_loader = NULL;
  35 }
  36
  37 // static
  38 CertLoader* CertLoader::Get() {
  39   CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()";
  40   return g_cert_loader;
  41 }
  42
  43 // static
  44 bool CertLoader::IsInitialized() {
  45   return g_cert_loader;
  46 }
  47
  48 CertLoader::CertLoader()
  49     : certificates_loaded_(false),
  50       certificates_update_required_(false),
  51       certificates_update_running_(false),
  52       database_(NULL),
  53       force_hardware_backed_for_test_(false),
  54       cert_list_(new net::CertificateList),
  55       weak_factory_(this) {
  56 }
  57
  58 CertLoader::~CertLoader() {
  59   net::CertDatabase::GetInstance()->RemoveObserver(this);
  60 }
  61
  62 void CertLoader::StartWithNSSDB(net::NSSCertDatabase* database) {
  63   CHECK(!database_);
  64   database_ = database;
  65
  66   // Start observing cert database for changes.
  67   // Observing net::CertDatabase is preferred over observing |database_|
  68   // directly, as |database_| observers receive only events generated directly
  69   // by |database_|, so they may miss a few relevant ones.
  70   // TODO(tbarzic): Once singleton NSSCertDatabase is removed, investigate if
  71   // it would be OK to observe |database_| directly; or change NSSCertDatabase
  72   // to send notification on all relevant changes.
  73   net::CertDatabase::GetInstance()->AddObserver(this);
  74
  75   LoadCertificates();
  76 }
  77
  78 void CertLoader::AddObserver(CertLoader::Observer* observer) {
  79   observers_.AddObserver(observer);
  80 }
  81
  82 void CertLoader::RemoveObserver(CertLoader::Observer* observer) {
  83   observers_.RemoveObserver(observer);
  84 }
  85
  86 int CertLoader::TPMTokenSlotID() const {
  87   if (!database_)
  88     return -1;
  89   return static_cast<int>(PK11_GetSlotID(database_->GetPrivateSlot().get()));
  90 }
  91
  92 bool CertLoader::IsHardwareBacked() const {
  93   return force_hardware_backed_for_test_ ||
  94       (database_ && PK11_IsHW(database_->GetPrivateSlot().get()));
  95 }
  96
  97 bool CertLoader::IsCertificateHardwareBacked(
  98     const net::X509Certificate* cert) const {
  99   if (!database_)
 100     return false;
 101   return database_->IsHardwareBacked(cert);
 102 }
 103
 104 bool CertLoader::CertificatesLoading() const {
 105   return database_ && !certificates_loaded_;
 106 }
 107
 108 // This is copied from chrome/common/net/x509_certificate_model_nss.cc.
 109 // For background see this discussion on dev-tech-crypto.lists.mozilla.org:
 110 // http://web.archiveorange.com/archive/v/6JJW7E40sypfZGtbkzxX
 111 //
 112 // NOTE: This function relies on the convention that the same PKCS#11 ID
 113 // is shared between a certificate and its associated private and public
 114 // keys.  I tried to implement this with PK11_GetLowLevelKeyIDForCert(),
 115 // but that always returns NULL on Chrome OS for me.
 116
 117 // static
 118 std::string CertLoader::GetPkcs11IdForCert(const net::X509Certificate& cert) {
 119   CERTCertificateStr* cert_handle = cert.os_cert_handle();
 120   SECKEYPrivateKey *priv_key =
 121       PK11_FindKeyByAnyCert(cert_handle, NULL /* wincx */);
 122   if (!priv_key)
 123     return std::string();
 124
 125   // Get the CKA_ID attribute for a key.
 126   SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(priv_key);
 127   std::string pkcs11_id;
 128   if (sec_item) {
 129     pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
 130     SECITEM_FreeItem(sec_item, PR_TRUE);
 131   }
 132   SECKEY_DestroyPrivateKey(priv_key);
 133
 134   return pkcs11_id;
 135 }
 136
 137 void CertLoader::LoadCertificates() {
 138   CHECK(thread_checker_.CalledOnValidThread());
 139   VLOG(1) << "LoadCertificates: " << certificates_update_running_;
 140
 141   if (certificates_update_running_) {
 142     certificates_update_required_ = true;
 143     return;
 144   }
 145
 146   certificates_update_running_ = true;
 147   certificates_update_required_ = false;
 148
 149   database_->ListCerts(
 150       base::Bind(&CertLoader::UpdateCertificates, weak_factory_.GetWeakPtr()));
 151 }
 152
 153 void CertLoader::UpdateCertificates(
 154     scoped_ptr<net::CertificateList> cert_list) {
 155   CHECK(thread_checker_.CalledOnValidThread());
 156   DCHECK(certificates_update_running_);
 157   VLOG(1) << "UpdateCertificates: " << cert_list->size();
 158
 159   // Ignore any existing certificates.
 160   cert_list_ = cert_list.Pass();
 161
 162   bool initial_load = !certificates_loaded_;
 163   certificates_loaded_ = true;
 164   NotifyCertificatesLoaded(initial_load);
 165
 166   certificates_update_running_ = false;
 167   if (certificates_update_required_)
 168     LoadCertificates();
 169 }
 170
 171 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
 172   FOR_EACH_OBSERVER(Observer, observers_,
 173                     OnCertificatesLoaded(*cert_list_, initial_load));
 174 }
 175
 176 void CertLoader::OnCACertChanged(const net::X509Certificate* cert) {
 177   // This is triggered when a CA certificate is modified.
 178   VLOG(1) << "OnCACertChanged";
 179   LoadCertificates();
 180 }
 181
 182 void CertLoader::OnCertAdded(const net::X509Certificate* cert) {
 183   // This is triggered when a client certificate is added.
 184   VLOG(1) << "OnCertAdded";
 185   LoadCertificates();
 186 }
 187
 188 void CertLoader::OnCertRemoved(const net::X509Certificate* cert) {
 189   VLOG(1) << "OnCertRemoved";
 190   LoadCertificates();
 191 }
 192
 193 }  // namespace chromeos