net/cert/cert_database.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_CERT_DATABASE_H_
   6 #define NET_CERT_CERT_DATABASE_H_
   7
   8 #include "base/macros.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "base/memory/scoped_ptr.h"
  11 #include "net/base/net_export.h"
  12 #include "net/cert/x509_certificate.h"
  13
  14 namespace base {
  15 template <typename T> struct DefaultSingletonTraits;
  16
  17 template <class ObserverType>
  18 class ObserverListThreadSafe;
  19 }
  20
  21 namespace net {
  22
  23 // This class provides cross-platform functions to verify and add user
  24 // certificates, and to observe changes to the underlying certificate stores.
  25
  26 // TODO(gauravsh): This class could be augmented with methods
  27 // for all operations that manipulate the underlying system
  28 // certificate store.
  29
  30 class NET_EXPORT CertDatabase {
  31  public:
  32   // A CertDatabase::Observer will be notified on certificate database changes.
  33   // The change could be either a user certificate is added/removed or trust on
  34   // a certificate is changed. Observers can be registered via
  35   // CertDatabase::AddObserver, and can un-register with
  36   // CertDatabase::RemoveObserver.
  37   class NET_EXPORT Observer {
  38    public:
  39     virtual ~Observer() {}
  40
  41     // Will be called when a new certificate is added. If the imported cert can
  42     // be determined, |cert| will be non-NULL, but if not, or if multiple
  43     // certificates were imported, |cert| may be NULL.
  44     virtual void OnCertAdded(const X509Certificate* cert) {}
  45
  46     // Will be called when a certificate is removed.
  47     virtual void OnCertRemoved(const X509Certificate* cert) {}
  48
  49     // Will be called when a CA certificate was added, removed, or its trust
  50     // changed. This can also mean that a client certificate's trust changed.
  51     virtual void OnCACertChanged(const X509Certificate* cert) {}
  52
  53    protected:
  54     Observer() {}
  55
  56    private:
  57     DISALLOW_COPY_AND_ASSIGN(Observer);
  58   };
  59
  60   // Returns the CertDatabase singleton.
  61   static CertDatabase* GetInstance();
  62
  63   // Check whether this is a valid user cert that we have the private key for.
  64   // Returns OK or a network error code such as ERR_CERT_CONTAINS_ERRORS.
  65   int CheckUserCert(X509Certificate* cert);
  66
  67   // Store user (client) certificate. Assumes CheckUserCert has already passed.
  68   // Returns OK, or ERR_ADD_USER_CERT_FAILED if there was a problem saving to
  69   // the platform cert database, or possibly other network error codes.
  70   int AddUserCert(X509Certificate* cert);
  71
  72   // Registers |observer| to receive notifications of certificate changes.  The
  73   // thread on which this is called is the thread on which |observer| will be
  74   // called back with notifications.
  75   void AddObserver(Observer* observer);
  76
  77   // Unregisters |observer| from receiving notifications.  This must be called
  78   // on the same thread on which AddObserver() was called.
  79   void RemoveObserver(Observer* observer);
  80
  81 #if defined(OS_MACOSX) && !defined(OS_IOS)
  82   // Configures the current message loop to observe and forward events from
  83   // Keychain services. The MessageLoop must have an associated CFRunLoop,
  84   // which means that this must be called from a MessageLoop of TYPE_UI.
  85   void SetMessageLoopForKeychainEvents();
  86 #endif
  87
  88 #if defined(OS_ANDROID)
  89   // On Android, the system key store may be replaced with a device-specific
  90   // KeyStore used for storing client certificates. When the Java side replaces
  91   // the KeyStore used for client certificates, notifies the observers as if a
  92   // new client certificate was added.
  93   void OnAndroidKeyStoreChanged();
  94
  95   // On Android, the system database is used. When the system notifies the
  96   // application that the certificates changed, the observers must be notified.
  97   void OnAndroidKeyChainChanged();
  98 #endif
  99
 100   // Synthetically injects notifications to all observers. In general, this
 101   // should only be called by the creator of the CertDatabase. Used to inject
 102   // notifcations from other DB interfaces.
 103   void NotifyObserversOfCertAdded(const X509Certificate* cert);
 104   void NotifyObserversOfCertRemoved(const X509Certificate* cert);
 105   void NotifyObserversOfCACertChanged(const X509Certificate* cert);
 106
 107  private:
 108   friend struct base::DefaultSingletonTraits<CertDatabase>;
 109
 110   CertDatabase();
 111   ~CertDatabase();
 112
 113   const scoped_refptr<base::ObserverListThreadSafe<Observer>> observer_list_;
 114
 115 #if defined(OS_MACOSX) && !defined(OS_IOS)
 116   class Notifier;
 117   friend class Notifier;
 118   scoped_ptr<Notifier> notifier_;
 119 #endif
 120
 121   DISALLOW_COPY_AND_ASSIGN(CertDatabase);
 122 };
 123
 124 }  // namespace net
 125
 126 #endif  // NET_CERT_CERT_DATABASE_H_