chrome/browser/certificate_manager_model.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/certificate_manager_model.h"
   6
   7 #include "base/bind.h"
   8 #include "base/i18n/time_formatting.h"
   9 #include "base/logging.h"
  10 #include "base/strings/utf_string_conversions.h"
  11 #include "chrome/browser/net/nss_context.h"
  12 #include "chrome/browser/ui/crypto_module_password_dialog_nss.h"
  13 #include "chrome/common/net/x509_certificate_model.h"
  14 #include "chrome/grit/generated_resources.h"
  15 #include "content/public/browser/browser_context.h"
  16 #include "content/public/browser/browser_thread.h"
  17 #include "content/public/browser/resource_context.h"
  18 #include "crypto/nss_util.h"
  19 #include "net/base/crypto_module.h"
  20 #include "net/base/net_errors.h"
  21 #include "net/cert/x509_certificate.h"
  22 #include "ui/base/l10n/l10n_util.h"
  23
  24 using content::BrowserThread;
  25
  26 // CertificateManagerModel is created on the UI thread. It needs a
  27 // NSSCertDatabase handle (and on ChromeOS it needs to get the TPM status) which
  28 // needs to be done on the IO thread.
  29 //
  30 // The initialization flow is roughly:
  31 //
  32 //               UI thread                              IO Thread
  33 //
  34 //   CertificateManagerModel::Create
  35 //                  \--------------------------------------v
  36 //                                CertificateManagerModel::GetCertDBOnIOThread
  37 //                                                         |
  38 //                                     GetNSSCertDatabaseForResourceContext
  39 //                                                         |
  40 //                               CertificateManagerModel::DidGetCertDBOnIOThread
  41 //                                                         |
  42 //                                       crypto::IsTPMTokenEnabledForNSS
  43 //                  v--------------------------------------/
  44 // CertificateManagerModel::DidGetCertDBOnUIThread
  45 //                  |
  46 //     new CertificateManagerModel
  47 //                  |
  48 //               callback
  49
  50 // static
  51 void CertificateManagerModel::Create(
  52     content::BrowserContext* browser_context,
  53     CertificateManagerModel::Observer* observer,
  54     const CreationCallback& callback) {
  55   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  56   BrowserThread::PostTask(
  57       BrowserThread::IO,
  58       FROM_HERE,
  59       base::Bind(&CertificateManagerModel::GetCertDBOnIOThread,
  60                  browser_context->GetResourceContext(),
  61                  observer,
  62                  callback));
  63 }
  64
  65 CertificateManagerModel::CertificateManagerModel(
  66     net::NSSCertDatabase* nss_cert_database,
  67     bool is_user_db_available,
  68     bool is_tpm_available,
  69     Observer* observer)
  70     : cert_db_(nss_cert_database),
  71       is_user_db_available_(is_user_db_available),
  72       is_tpm_available_(is_tpm_available),
  73       observer_(observer) {
  74   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  75 }
  76
  77 CertificateManagerModel::~CertificateManagerModel() {
  78 }
  79
  80 void CertificateManagerModel::Refresh() {
  81   DVLOG(1) << "refresh started";
  82   net::CryptoModuleList modules;
  83   cert_db_->ListModules(&modules, false);
  84   DVLOG(1) << "refresh waiting for unlocking...";
  85   chrome::UnlockSlotsIfNecessary(
  86       modules,
  87       chrome::kCryptoModulePasswordListCerts,
  88       net::HostPortPair(),  // unused.
  89       NULL, // TODO(mattm): supply parent window.
  90       base::Bind(&CertificateManagerModel::RefreshSlotsUnlocked,
  91                  base::Unretained(this)));
  92 }
  93
  94 void CertificateManagerModel::RefreshSlotsUnlocked() {
  95   DVLOG(1) << "refresh listing certs...";
  96   // TODO(tbarzic): Use async |ListCerts|.
  97   cert_db_->ListCertsSync(&cert_list_);
  98   observer_->CertificatesRefreshed();
  99   DVLOG(1) << "refresh finished";
 100 }
 101
 102 void CertificateManagerModel::FilterAndBuildOrgGroupingMap(
 103     net::CertType filter_type,
 104     CertificateManagerModel::OrgGroupingMap* map) const {
 105   for (net::CertificateList::const_iterator i = cert_list_.begin();
 106        i != cert_list_.end(); ++i) {
 107     net::X509Certificate* cert = i->get();
 108     net::CertType type =
 109         x509_certificate_model::GetType(cert->os_cert_handle());
 110     if (type != filter_type)
 111       continue;
 112
 113     std::string org;
 114     if (!cert->subject().organization_names.empty())
 115       org = cert->subject().organization_names[0];
 116     if (org.empty())
 117       org = cert->subject().GetDisplayName();
 118
 119     (*map)[org].push_back(cert);
 120   }
 121 }
 122
 123 base::string16 CertificateManagerModel::GetColumnText(
 124     const net::X509Certificate& cert,
 125     Column column) const {
 126   base::string16 rv;
 127   switch (column) {
 128     case COL_SUBJECT_NAME:
 129       rv = base::UTF8ToUTF16(
 130           x509_certificate_model::GetCertNameOrNickname(cert.os_cert_handle()));
 131
 132       // TODO(xiyuan): Put this into a column when we have js tree-table.
 133       if (IsHardwareBacked(&cert)) {
 134         rv = l10n_util::GetStringFUTF16(
 135             IDS_CERT_MANAGER_HARDWARE_BACKED_KEY_FORMAT,
 136             rv,
 137             l10n_util::GetStringUTF16(IDS_CERT_MANAGER_HARDWARE_BACKED));
 138       }
 139       break;
 140     case COL_CERTIFICATE_STORE:
 141       rv = base::UTF8ToUTF16(
 142           x509_certificate_model::GetTokenName(cert.os_cert_handle()));
 143       break;
 144     case COL_SERIAL_NUMBER:
 145       rv = base::ASCIIToUTF16(x509_certificate_model::GetSerialNumberHexified(
 146           cert.os_cert_handle(), std::string()));
 147       break;
 148     case COL_EXPIRES_ON:
 149       if (!cert.valid_expiry().is_null())
 150         rv = base::TimeFormatShortDateNumeric(cert.valid_expiry());
 151       break;
 152     default:
 153       NOTREACHED();
 154   }
 155   return rv;
 156 }
 157
 158 int CertificateManagerModel::ImportFromPKCS12(net::CryptoModule* module,
 159                                               const std::string& data,
 160                                               const base::string16& password,
 161                                               bool is_extractable) {
 162   int result = cert_db_->ImportFromPKCS12(module, data, password,
 163                                           is_extractable, NULL);
 164   if (result == net::OK)
 165     Refresh();
 166   return result;
 167 }
 168
 169 bool CertificateManagerModel::ImportCACerts(
 170     const net::CertificateList& certificates,
 171     net::NSSCertDatabase::TrustBits trust_bits,
 172     net::NSSCertDatabase::ImportCertFailureList* not_imported) {
 173   bool result = cert_db_->ImportCACerts(certificates, trust_bits, not_imported);
 174   if (result && not_imported->size() != certificates.size())
 175     Refresh();
 176   return result;
 177 }
 178
 179 bool CertificateManagerModel::ImportServerCert(
 180     const net::CertificateList& certificates,
 181     net::NSSCertDatabase::TrustBits trust_bits,
 182     net::NSSCertDatabase::ImportCertFailureList* not_imported) {
 183   bool result = cert_db_->ImportServerCert(certificates, trust_bits,
 184                                            not_imported);
 185   if (result && not_imported->size() != certificates.size())
 186     Refresh();
 187   return result;
 188 }
 189
 190 bool CertificateManagerModel::SetCertTrust(
 191     const net::X509Certificate* cert,
 192     net::CertType type,
 193     net::NSSCertDatabase::TrustBits trust_bits) {
 194   return cert_db_->SetCertTrust(cert, type, trust_bits);
 195 }
 196
 197 bool CertificateManagerModel::Delete(net::X509Certificate* cert) {
 198   bool result = cert_db_->DeleteCertAndKey(cert);
 199   if (result)
 200     Refresh();
 201   return result;
 202 }
 203
 204 bool CertificateManagerModel::IsHardwareBacked(
 205     const net::X509Certificate* cert) const {
 206   return cert_db_->IsHardwareBacked(cert);
 207 }
 208
 209 // static
 210 void CertificateManagerModel::DidGetCertDBOnUIThread(
 211     net::NSSCertDatabase* cert_db,
 212     bool is_user_db_available,
 213     bool is_tpm_available,
 214     CertificateManagerModel::Observer* observer,
 215     const CreationCallback& callback) {
 216   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 217
 218   scoped_ptr<CertificateManagerModel> model(new CertificateManagerModel(
 219       cert_db, is_user_db_available, is_tpm_available, observer));
 220   callback.Run(model.Pass());
 221 }
 222
 223 // static
 224 void CertificateManagerModel::DidGetCertDBOnIOThread(
 225     CertificateManagerModel::Observer* observer,
 226     const CreationCallback& callback,
 227     net::NSSCertDatabase* cert_db) {
 228   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 229
 230   bool is_user_db_available = cert_db->GetPublicSlot();
 231   bool is_tpm_available = false;
 232 #if defined(OS_CHROMEOS)
 233   is_tpm_available = crypto::IsTPMTokenEnabledForNSS();
 234 #endif
 235   BrowserThread::PostTask(
 236       BrowserThread::UI,
 237       FROM_HERE,
 238       base::Bind(&CertificateManagerModel::DidGetCertDBOnUIThread,
 239                  cert_db,
 240                  is_user_db_available,
 241                  is_tpm_available,
 242                  observer,
 243                  callback));
 244 }
 245
 246 // static
 247 void CertificateManagerModel::GetCertDBOnIOThread(
 248     content::ResourceContext* context,
 249     CertificateManagerModel::Observer* observer,
 250     const CreationCallback& callback) {
 251   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 252   net::NSSCertDatabase* cert_db = GetNSSCertDatabaseForResourceContext(
 253       context,
 254       base::Bind(&CertificateManagerModel::DidGetCertDBOnIOThread,
 255                  observer,
 256                  callback));
 257   if (cert_db)
 258     DidGetCertDBOnIOThread(observer, callback, cert_db);
 259 }