chromeos/network/cert_loader.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/cert_loader.h"
   6
   7 #include <algorithm>
   8
   9 #include "base/chromeos/chromeos_version.h"
  10 #include "base/observer_list.h"
  11 #include "base/task_runner_util.h"
  12 #include "base/threading/worker_pool.h"
  13 #include "chromeos/dbus/cryptohome_client.h"
  14 #include "chromeos/dbus/dbus_thread_manager.h"
  15 #include "crypto/encryptor.h"
  16 #include "crypto/nss_util.h"
  17 #include "crypto/sha2.h"
  18 #include "crypto/symmetric_key.h"
  19 #include "net/cert/nss_cert_database.h"
  20
  21 namespace chromeos {
  22
  23 namespace {
  24
  25 // Delay between certificate requests while waiting for TPM/PKCS#11 init.
  26 const int kRequestDelayMs = 500;
  27
  28 net::CertificateList* LoadNSSCertificates() {
  29   net::CertificateList* cert_list(new net::CertificateList());
  30   net::NSSCertDatabase::GetInstance()->ListCerts(cert_list);
  31   return cert_list;
  32 }
  33
  34 }  // namespace
  35
  36 static CertLoader* g_cert_loader = NULL;
  37
  38 // static
  39 void CertLoader::Initialize() {
  40   CHECK(!g_cert_loader);
  41   g_cert_loader = new CertLoader();
  42 }
  43
  44 // static
  45 void CertLoader::Shutdown() {
  46   CHECK(g_cert_loader);
  47   delete g_cert_loader;
  48   g_cert_loader = NULL;
  49 }
  50
  51 // static
  52 CertLoader* CertLoader::Get() {
  53   CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()";
  54   return g_cert_loader;
  55 }
  56
  57 // static
  58 bool CertLoader::IsInitialized() {
  59   return g_cert_loader;
  60 }
  61
  62 CertLoader::CertLoader()
  63     : tpm_token_ready_(false),
  64       certificates_requested_(false),
  65       certificates_loaded_(false),
  66       key_store_loaded_(false),
  67       weak_ptr_factory_(this) {
  68   net::CertDatabase::GetInstance()->AddObserver(this);
  69   LoginState::Get()->AddObserver(this);
  70   if (LoginState::Get()->IsUserLoggedIn())
  71     RequestCertificates();
  72 }
  73
  74 CertLoader::~CertLoader() {
  75   request_task_.Reset();
  76   net::CertDatabase::GetInstance()->RemoveObserver(this);
  77   LoginState::Get()->RemoveObserver(this);
  78 }
  79
  80 void CertLoader::AddObserver(CertLoader::Observer* observer) {
  81   observers_.AddObserver(observer);
  82 }
  83
  84 void CertLoader::RemoveObserver(CertLoader::Observer* observer) {
  85   observers_.RemoveObserver(observer);
  86 }
  87
  88 bool CertLoader::CertificatesLoading() const {
  89   return certificates_requested_ && !certificates_loaded_;
  90 }
  91
  92 bool CertLoader::IsHardwareBacked() const {
  93   return !tpm_token_name_.empty();
  94 }
  95
  96 void CertLoader::RequestCertificates() {
  97   CHECK(thread_checker_.CalledOnValidThread());
  98   VLOG(1) << "RequestCertificates: " << LoginState::Get()->IsUserLoggedIn();
  99   if (!LoginState::Get()->IsUserLoggedIn())
 100     return;  // Certificates will be requested on login.
 101
 102   if (!key_store_loaded_) {
 103     // Ensure we've opened the real user's key/certificate database.
 104     crypto::OpenPersistentNSSDB();
 105
 106     if (base::chromeos::IsRunningOnChromeOS())
 107       crypto::EnableTPMTokenForNSS();
 108
 109     key_store_loaded_ = true;
 110   }
 111
 112   certificates_requested_ = true;
 113
 114   VLOG(1) << "Requesting Certificates.";
 115   DBusThreadManager::Get()->GetCryptohomeClient()->TpmIsEnabled(
 116       base::Bind(&CertLoader::OnTpmIsEnabled,
 117                  weak_ptr_factory_.GetWeakPtr()));
 118
 119   return;
 120 }
 121
 122 void CertLoader::OnTpmIsEnabled(DBusMethodCallStatus call_status,
 123                                 bool tpm_is_enabled) {
 124   VLOG(1) << "OnTpmIsEnabled: " << tpm_is_enabled;
 125   if (call_status != DBUS_METHOD_CALL_SUCCESS || !tpm_is_enabled) {
 126     // TPM is not enabled, so proceed with empty tpm token name.
 127     VLOG(1) << "TPM not available.";
 128     StartLoadCertificates();
 129   } else if (tpm_token_ready_) {
 130     // Once the TPM token is ready, initialize it.
 131     InitializeTPMToken();
 132   } else {
 133     DBusThreadManager::Get()->GetCryptohomeClient()->Pkcs11IsTpmTokenReady(
 134         base::Bind(&CertLoader::OnPkcs11IsTpmTokenReady,
 135                    weak_ptr_factory_.GetWeakPtr()));
 136   }
 137 }
 138
 139 void CertLoader::OnPkcs11IsTpmTokenReady(DBusMethodCallStatus call_status,
 140                                          bool is_tpm_token_ready) {
 141   VLOG(1) << "OnPkcs11IsTpmTokenReady: " << is_tpm_token_ready;
 142   if (call_status != DBUS_METHOD_CALL_SUCCESS || !is_tpm_token_ready) {
 143     MaybeRetryRequestCertificates();
 144     return;
 145   }
 146
 147   // Retrieve token_name_ and user_pin_ here since they will never change
 148   // and CryptohomeClient calls are not thread safe.
 149   DBusThreadManager::Get()->GetCryptohomeClient()->Pkcs11GetTpmTokenInfo(
 150       base::Bind(&CertLoader::OnPkcs11GetTpmTokenInfo,
 151                  weak_ptr_factory_.GetWeakPtr()));
 152 }
 153
 154 void CertLoader::OnPkcs11GetTpmTokenInfo(DBusMethodCallStatus call_status,
 155                                          const std::string& token_name,
 156                                          const std::string& user_pin) {
 157   VLOG(1) << "OnPkcs11GetTpmTokenInfo: " << token_name;
 158   if (call_status != DBUS_METHOD_CALL_SUCCESS) {
 159     MaybeRetryRequestCertificates();
 160     return;
 161   }
 162   tpm_token_name_ = token_name;
 163   // TODO(stevenjb): The network code expects a slot ID, not a label. See
 164   // crbug.com/201101. For now, use a hard coded, well known slot instead.
 165   const char kHardcodedTpmSlot[] = "0";
 166   tpm_token_slot_ = kHardcodedTpmSlot;
 167   tpm_user_pin_ = user_pin;
 168   tpm_token_ready_ = true;
 169
 170   InitializeTPMToken();
 171 }
 172
 173 void CertLoader::InitializeTPMToken() {
 174   VLOG(1) << "InitializeTPMToken";
 175   if (!crypto::InitializeTPMToken(tpm_token_name_, tpm_user_pin_)) {
 176     MaybeRetryRequestCertificates();
 177     return;
 178   }
 179   StartLoadCertificates();
 180 }
 181
 182 void CertLoader::StartLoadCertificates() {
 183   VLOG(1) << "Start Load Certificates";
 184   base::PostTaskAndReplyWithResult(
 185       base::WorkerPool::GetTaskRunner(true /* task_is_slow */),
 186       FROM_HERE,
 187       base::Bind(LoadNSSCertificates),
 188       base::Bind(&CertLoader::UpdateCertificates,
 189                  weak_ptr_factory_.GetWeakPtr()));
 190 }
 191
 192 void CertLoader::UpdateCertificates(net::CertificateList* cert_list) {
 193   CHECK(thread_checker_.CalledOnValidThread());
 194   DCHECK(cert_list);
 195   VLOG(1) << "Update Certificates: " << cert_list->size();
 196
 197   // Clear any existing certificates.
 198   cert_list_.swap(*cert_list);
 199
 200   // cert_list is constructed in LoadCertificates.
 201   delete cert_list;
 202
 203   // Set loaded state and notify observers.
 204   if (!certificates_loaded_) {
 205     certificates_loaded_ = true;
 206     NotifyCertificatesLoaded(true);
 207   } else {
 208     NotifyCertificatesLoaded(false);
 209   }
 210 }
 211
 212 void CertLoader::MaybeRetryRequestCertificates() {
 213   if (!request_task_.is_null())
 214     return;
 215
 216   // Cryptohome does not notify us when the token is ready, so call
 217   // this again after a delay.
 218   request_task_ = base::Bind(&CertLoader::RequestCertificatesTask,
 219                              weak_ptr_factory_.GetWeakPtr());
 220   MessageLoop::current()->PostDelayedTask(
 221       FROM_HERE,
 222       request_task_,
 223       base::TimeDelta::FromMilliseconds(kRequestDelayMs));
 224 }
 225
 226 void CertLoader::RequestCertificatesTask() {
 227   // Reset the task to the initial state so is_null() returns true.
 228   request_task_.Reset();
 229   RequestCertificates();
 230 }
 231
 232 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
 233   FOR_EACH_OBSERVER(Observer, observers_,
 234                     OnCertificatesLoaded(cert_list_, initial_load));
 235 }
 236
 237 void CertLoader::OnCertTrustChanged(const net::X509Certificate* cert) {
 238 }
 239
 240 void CertLoader::OnCertAdded(const net::X509Certificate* cert) {
 241   // Only load certificates if we have completed an initial request.
 242   if (!certificates_loaded_)
 243     return;
 244   StartLoadCertificates();
 245 }
 246
 247 void CertLoader::OnCertRemoved(const net::X509Certificate* cert) {
 248   // Only load certificates if we have completed an initial request.
 249   if (!certificates_loaded_)
 250     return;
 251   StartLoadCertificates();
 252 }
 253
 254 void CertLoader::LoggedInStateChanged(LoginState::LoggedInState state) {
 255   VLOG(1) << "LoggedInStateChanged: " << state;
 256   if (LoginState::Get()->IsUserLoggedIn() && !certificates_requested_)
 257     RequestCertificates();
 258 }
 259
 260 }  // namespace chromeos