chromeos/cert_loader.h

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROMEOS_CERT_LOADER_H_
   6 #define CHROMEOS_CERT_LOADER_H_
   7
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/basictypes.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/memory/ref_counted.h"
  14 #include "base/memory/weak_ptr.h"
  15 #include "base/observer_list.h"
  16 #include "base/threading/thread_checker.h"
  17 #include "chromeos/chromeos_export.h"
  18 #include "net/cert/cert_database.h"
  19
  20 namespace net {
  21 class NSSCertDatabase;
  22 class X509Certificate;
  23 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
  24 }
  25
  26 namespace chromeos {
  27
  28 // This class is responsible for loading certificates once the TPM is
  29 // initialized. It is expected to be constructed on the UI thread and public
  30 // methods should all be called from the UI thread.
  31 // When certificates have been loaded (after login completes and tpm token is
  32 // initialized), or the cert database changes, observers are called with
  33 // OnCertificatesLoaded().
  34 class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
  35  public:
  36   class Observer {
  37    public:
  38     // Called when the certificates, passed for convenience as |cert_list|,
  39     // have completed loading. |initial_load| is true the first time this
  40     // is called.
  41     virtual void OnCertificatesLoaded(const net::CertificateList& cert_list,
  42                                       bool initial_load) = 0;
  43
  44    protected:
  45     virtual ~Observer() {}
  46   };
  47
  48   // Sets the global instance. Must be called before any calls to Get().
  49   static void Initialize();
  50
  51   // Destroys the global instance.
  52   static void Shutdown();
  53
  54   // Gets the global instance. Initialize() must be called first.
  55   static CertLoader* Get();
  56
  57   // Returns true if the global instance has been initialized.
  58   static bool IsInitialized();
  59
  60   // Returns the PKCS#11 attribute CKA_ID for a certificate as an upper-case
  61   // hex string, or the empty string if none is found. Note that the returned ID
  62   // should be used only to identify the cert in its slot.
  63   // This should be used only for user certificates, assuming that only one
  64   // private slot is loaded for a user.
  65   // TODO(tbarzic): Make this check cert slot id if we start loading
  66   // certificates for secondary users.
  67   static std::string GetPkcs11IdForCert(const net::X509Certificate& cert);
  68
  69   // Starts the CertLoader with the NSS cert database.
  70   // The CertLoader will _not_ take the ownership of the database, but it
  71   // expects it to stay alive at least until the shutdown starts on the main
  72   // thread. This assumes that |StartWithNSSDB| and other methods directly
  73   // using |database_| are not called during shutdown.
  74   void StartWithNSSDB(net::NSSCertDatabase* database);
  75
  76   void AddObserver(CertLoader::Observer* observer);
  77   void RemoveObserver(CertLoader::Observer* observer);
  78
  79   int TPMTokenSlotID() const;
  80   bool IsHardwareBacked() const;
  81
  82   // Whether the certificate is hardware backed. Returns false if the CertLoader
  83   // was not yet started (both |CertificatesLoading()| and
  84   // |certificates_loaded()| are false).
  85   bool IsCertificateHardwareBacked(const net::X509Certificate* cert) const;
  86
  87   // Returns true when the certificate list has been requested but not loaded.
  88   bool CertificatesLoading() const;
  89
  90   bool certificates_loaded() const { return certificates_loaded_; }
  91
  92   // This will be empty until certificates_loaded() is true.
  93   const net::CertificateList& cert_list() const { return *cert_list_; }
  94
  95   void force_hardware_backed_for_test() {
  96     force_hardware_backed_for_test_ = true;
  97   }
  98
  99  private:
 100   CertLoader();
 101   virtual ~CertLoader();
 102
 103   // Trigger a certificate load. If a certificate loading task is already in
 104   // progress, will start a reload once the current task is finished.
 105   void LoadCertificates();
 106
 107   // Called if a certificate load task is finished.
 108   void UpdateCertificates(scoped_ptr<net::CertificateList> cert_list);
 109
 110   void NotifyCertificatesLoaded(bool initial_load);
 111
 112   // net::CertDatabase::Observer
 113   virtual void OnCACertChanged(const net::X509Certificate* cert) OVERRIDE;
 114   virtual void OnCertAdded(const net::X509Certificate* cert) OVERRIDE;
 115   virtual void OnCertRemoved(const net::X509Certificate* cert) OVERRIDE;
 116
 117   ObserverList<Observer> observers_;
 118
 119   // Flags describing current CertLoader state.
 120   bool certificates_loaded_;
 121   bool certificates_update_required_;
 122   bool certificates_update_running_;
 123
 124   // The user-specific NSS certificate database from which the certificates
 125   // should be loaded.
 126   net::NSSCertDatabase* database_;
 127
 128   // Set during tests if |IsHardwareBacked()| should always return true.
 129   bool force_hardware_backed_for_test_;
 130
 131   // Cached Certificates loaded from the database.
 132   scoped_ptr<net::CertificateList> cert_list_;
 133
 134   base::ThreadChecker thread_checker_;
 135
 136   base::WeakPtrFactory<CertLoader> weak_factory_;
 137
 138   DISALLOW_COPY_AND_ASSIGN(CertLoader);
 139 };
 140
 141 }  // namespace chromeos
 142
 143 #endif  // CHROMEOS_CERT_LOADER_H_