chromeos/cert_loader.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/cert_loader.h"
   6
   7 #include <algorithm>
   8
   9 #include "base/bind.h"
  10 #include "base/location.h"
  11 #include "base/strings/string_number_conversions.h"
  12 #include "base/task_runner_util.h"
  13 #include "base/threading/worker_pool.h"
  14 #include "crypto/nss_util.h"
  15 #include "net/cert/nss_cert_database.h"
  16 #include "net/cert/x509_certificate.h"
  17
  18 namespace chromeos {
  19
  20 namespace {
  21
  22 // Loads certificates from |cert_database| into |cert_list|.
  23 void LoadNSSCertificates(net::NSSCertDatabase* cert_database,
  24                          net::CertificateList* cert_list) {
  25   cert_database->ListCerts(cert_list);
  26 }
  27
  28 }  // namespace
  29
  30 static CertLoader* g_cert_loader = NULL;
  31
  32 // static
  33 void CertLoader::Initialize() {
  34   CHECK(!g_cert_loader);
  35   g_cert_loader = new CertLoader();
  36 }
  37
  38 // static
  39 void CertLoader::Shutdown() {
  40   CHECK(g_cert_loader);
  41   delete g_cert_loader;
  42   g_cert_loader = NULL;
  43 }
  44
  45 // static
  46 CertLoader* CertLoader::Get() {
  47   CHECK(g_cert_loader) << "CertLoader::Get() called before Initialize()";
  48   return g_cert_loader;
  49 }
  50
  51 // static
  52 bool CertLoader::IsInitialized() {
  53   return g_cert_loader;
  54 }
  55
  56 CertLoader::CertLoader()
  57     : certificates_requested_(false),
  58       certificates_loaded_(false),
  59       certificates_update_required_(false),
  60       certificates_update_running_(false),
  61       tpm_token_slot_id_(-1),
  62       weak_factory_(this) {
  63   if (TPMTokenLoader::IsInitialized())
  64     TPMTokenLoader::Get()->AddObserver(this);
  65 }
  66
  67 void CertLoader::SetSlowTaskRunnerForTest(
  68     const scoped_refptr<base::TaskRunner>& task_runner) {
  69   slow_task_runner_for_test_ = task_runner;
  70 }
  71
  72 CertLoader::~CertLoader() {
  73   net::CertDatabase::GetInstance()->RemoveObserver(this);
  74   if (TPMTokenLoader::IsInitialized())
  75     TPMTokenLoader::Get()->RemoveObserver(this);
  76 }
  77
  78 void CertLoader::AddObserver(CertLoader::Observer* observer) {
  79   observers_.AddObserver(observer);
  80 }
  81
  82 void CertLoader::RemoveObserver(CertLoader::Observer* observer) {
  83   observers_.RemoveObserver(observer);
  84 }
  85
  86 bool CertLoader::IsHardwareBacked() const {
  87   return !tpm_token_name_.empty();
  88 }
  89
  90 bool CertLoader::CertificatesLoading() const {
  91   return certificates_requested_ && !certificates_loaded_;
  92 }
  93
  94 // This is copied from chrome/common/net/x509_certificate_model_nss.cc.
  95 // For background see this discussion on dev-tech-crypto.lists.mozilla.org:
  96 // http://web.archiveorange.com/archive/v/6JJW7E40sypfZGtbkzxX
  97 //
  98 // NOTE: This function relies on the convention that the same PKCS#11 ID
  99 // is shared between a certificate and its associated private and public
 100 // keys.  I tried to implement this with PK11_GetLowLevelKeyIDForCert(),
 101 // but that always returns NULL on Chrome OS for me.
 102
 103 // static
 104 std::string CertLoader::GetPkcs11IdForCert(const net::X509Certificate& cert) {
 105   CERTCertificateStr* cert_handle = cert.os_cert_handle();
 106   SECKEYPrivateKey *priv_key =
 107       PK11_FindKeyByAnyCert(cert_handle, NULL /* wincx */);
 108   if (!priv_key)
 109     return std::string();
 110
 111   // Get the CKA_ID attribute for a key.
 112   SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(priv_key);
 113   std::string pkcs11_id;
 114   if (sec_item) {
 115     pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
 116     SECITEM_FreeItem(sec_item, PR_TRUE);
 117   }
 118   SECKEY_DestroyPrivateKey(priv_key);
 119
 120   return pkcs11_id;
 121 }
 122
 123 void CertLoader::RequestCertificates() {
 124   if (certificates_requested_)
 125     return;
 126   certificates_requested_ = true;
 127
 128   DCHECK(!certificates_loaded_ && !certificates_update_running_);
 129   net::CertDatabase::GetInstance()->AddObserver(this);
 130   LoadCertificates();
 131 }
 132
 133 void CertLoader::LoadCertificates() {
 134   CHECK(thread_checker_.CalledOnValidThread());
 135   VLOG(1) << "LoadCertificates: " << certificates_update_running_;
 136
 137   if (certificates_update_running_) {
 138     certificates_update_required_ = true;
 139     return;
 140   }
 141
 142   net::CertificateList* cert_list = new net::CertificateList;
 143   certificates_update_running_ = true;
 144   certificates_update_required_ = false;
 145
 146   base::TaskRunner* task_runner = slow_task_runner_for_test_.get();
 147   if (!task_runner)
 148     task_runner = base::WorkerPool::GetTaskRunner(true /* task is slow */);
 149   task_runner->PostTaskAndReply(
 150       FROM_HERE,
 151       base::Bind(LoadNSSCertificates,
 152                  net::NSSCertDatabase::GetInstance(),
 153                  cert_list),
 154       base::Bind(&CertLoader::UpdateCertificates,
 155                  weak_factory_.GetWeakPtr(),
 156                  base::Owned(cert_list)));
 157 }
 158
 159 void CertLoader::UpdateCertificates(net::CertificateList* cert_list) {
 160   CHECK(thread_checker_.CalledOnValidThread());
 161   DCHECK(certificates_update_running_);
 162   VLOG(1) << "UpdateCertificates: " << cert_list->size();
 163
 164   // Ignore any existing certificates.
 165   cert_list_.swap(*cert_list);
 166
 167   bool initial_load = !certificates_loaded_;
 168   certificates_loaded_ = true;
 169   NotifyCertificatesLoaded(initial_load);
 170
 171   certificates_update_running_ = false;
 172   if (certificates_update_required_)
 173     LoadCertificates();
 174 }
 175
 176 void CertLoader::NotifyCertificatesLoaded(bool initial_load) {
 177   FOR_EACH_OBSERVER(Observer, observers_,
 178                     OnCertificatesLoaded(cert_list_, initial_load));
 179 }
 180
 181 void CertLoader::OnCACertChanged(const net::X509Certificate* cert) {
 182   // This is triggered when a CA certificate is modified.
 183   VLOG(1) << "OnCACertChanged";
 184   LoadCertificates();
 185 }
 186
 187 void CertLoader::OnCertAdded(const net::X509Certificate* cert) {
 188   // This is triggered when a client certificate is added.
 189   VLOG(1) << "OnCertAdded";
 190   LoadCertificates();
 191 }
 192
 193 void CertLoader::OnCertRemoved(const net::X509Certificate* cert) {
 194   VLOG(1) << "OnCertRemoved";
 195   LoadCertificates();
 196 }
 197
 198 void CertLoader::OnTPMTokenReady(const std::string& tpm_user_pin,
 199                                  const std::string& tpm_token_name,
 200                                  int tpm_token_slot_id) {
 201   tpm_user_pin_ = tpm_user_pin;
 202   tpm_token_name_ = tpm_token_name;
 203   tpm_token_slot_id_ = tpm_token_slot_id;
 204
 205   VLOG(1) << "TPM token ready.";
 206   RequestCertificates();
 207 }
 208
 209 }  // namespace chromeos