1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_
6 #define CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_
8 #include <Security/Security.h>
13 #include "components/autofill/core/common/password_form.h"
14 #include "crypto/apple_keychain.h"
16 using crypto::AppleKeychain
;
18 // Adapter that wraps a AppleKeychain and provides interaction in terms of
19 // PasswordForms instead of Keychain items.
20 class MacKeychainPasswordFormAdapter
{
22 // Creates an adapter for |keychain|. This class does not take ownership of
23 // |keychain|, so the caller must make sure that the keychain outlives the
25 explicit MacKeychainPasswordFormAdapter(const AppleKeychain
* keychain
);
27 // Returns PasswordForms for each keychain entry that could be used to fill
28 // |form|. Caller is responsible for deleting the returned forms.
29 std::vector
<autofill::PasswordForm
*> PasswordsFillingForm(
30 const autofill::PasswordForm
& query_form
);
32 // Returns the PasswordForm for the Keychain entry that matches |form| on all
33 // of the fields that uniquely identify a Keychain item, or NULL if there is
35 // Caller is responsible for deleting the returned form.
36 autofill::PasswordForm
* PasswordExactlyMatchingForm(
37 const autofill::PasswordForm
& query_form
);
39 // Returns true if the keychain contains any items that are mergeable with
40 // |query_form|. This is different from actually extracting the passwords
41 // and checking the return count, since doing that would require reading the
42 // passwords from the keychain, thus potentially triggering authorizaiton UI,
43 // whereas this won't.
44 bool HasPasswordsMergeableWithForm(
45 const autofill::PasswordForm
& query_form
);
47 // Returns all keychain items of types corresponding to password forms.
48 std::vector
<SecKeychainItemRef
> GetAllPasswordFormKeychainItems();
50 // Returns password data from all keychain items of types corresponding to
51 // password forms. Caller is responsible for deleting the returned forms.
52 std::vector
<autofill::PasswordForm
*> GetAllPasswordFormPasswords();
54 // Creates a new keychain entry from |form|, or updates the password of an
55 // existing keychain entry if there is a collision. Returns true if a keychain
56 // entry was successfully added/updated.
57 bool AddPassword(const autofill::PasswordForm
& form
);
59 // Removes the keychain password matching |form| if any. Returns true if a
60 // keychain item was found and successfully removed.
61 bool RemovePassword(const autofill::PasswordForm
& form
);
63 // Controls whether or not Chrome will restrict Keychain searches to items
64 // that it created. Defaults to false.
65 void SetFindsOnlyOwnedItems(bool finds_only_owned
);
68 // Returns PasswordForms constructed from the given Keychain items, calling
69 // AppleKeychain::Free on all of the keychain items and clearing the vector.
70 // Caller is responsible for deleting the returned forms.
71 std::vector
<autofill::PasswordForm
*> ConvertKeychainItemsToForms(
72 std::vector
<SecKeychainItemRef
>* items
);
74 // Searches |keychain| for the specific keychain entry that corresponds to the
75 // given form, and returns it (or NULL if no match is found). The caller is
76 // responsible for calling AppleKeychain::Free on on the returned item.
77 SecKeychainItemRef
KeychainItemForForm(
78 const autofill::PasswordForm
& form
);
80 // Returns the Keychain items matching the given signon_realm, scheme, and
81 // optionally path and username (either of both can be NULL).
82 // The caller is responsible for calling AppleKeychain::Free on the
84 std::vector
<SecKeychainItemRef
> MatchingKeychainItems(
85 const std::string
& signon_realm
,
86 autofill::PasswordForm::Scheme scheme
,
88 const char* username
);
90 // Returns the Keychain SecAuthenticationType type corresponding to |scheme|.
91 SecAuthenticationType
AuthTypeForScheme(
92 autofill::PasswordForm::Scheme scheme
);
94 // Changes the password for keychain_item to |password|; returns true if the
95 // password was successfully changed.
96 bool SetKeychainItemPassword(const SecKeychainItemRef
& keychain_item
,
97 const std::string
& password
);
99 // Sets the creator code of keychain_item to creator_code; returns true if the
100 // creator code was successfully set.
101 bool SetKeychainItemCreatorCode(const SecKeychainItemRef
& keychain_item
,
102 OSType creator_code
);
104 // Returns the creator code to be used for a Keychain search, depending on
105 // whether this object was instructed to search only for items it created.
106 // If searches should be restricted in this way, the application-specific
107 // creator code will be returned. Otherwise, 0 will be returned, indicating
108 // a search of all items, regardless of creator.
109 OSType
CreatorCodeForSearch();
111 const AppleKeychain
* keychain_
;
113 // If true, Keychain searches are restricted to items created by Chrome.
114 bool finds_only_owned_
;
116 DISALLOW_COPY_AND_ASSIGN(MacKeychainPasswordFormAdapter
);
119 namespace internal_keychain_helpers
{
121 // Pair of pointers to a SecKeychainItemRef and a corresponding PasswordForm.
122 typedef std::pair
<SecKeychainItemRef
*, autofill::PasswordForm
*> ItemFormPair
;
124 // Sets the fields of |form| based on the keychain data from |keychain_item|.
125 // Fields that can't be determined from |keychain_item| will be unchanged. If
126 // |extract_password_data| is true, the password data will be copied from
127 // |keychain_item| in addition to its attributes, and the |blacklisted_by_user|
128 // field will be set to true for empty passwords ("" or " ").
129 // If |extract_password_data| is false, only the password attributes will be
130 // copied, and the |blacklisted_by_user| field will always be false.
132 // IMPORTANT: If |extract_password_data| is true, this function can cause the OS
133 // to trigger UI (to allow access to the keychain item if we aren't trusted for
134 // the item), and block until the UI is dismissed.
136 // If excessive prompting for access to other applications' keychain items
137 // becomes an issue, the password storage API will need to intially call this
138 // function with |extract_password_data| set to false, and retrieve the password
139 // later (accessing other fields doesn't require authorization).
140 bool FillPasswordFormFromKeychainItem(const AppleKeychain
& keychain
,
141 const SecKeychainItemRef
& keychain_item
,
142 autofill::PasswordForm
* form
,
143 bool extract_password_data
);
145 // Returns true if the two given forms match based on signon_reaml, scheme, and
146 // username_value, and are thus suitable for merging (see MergePasswordForms).
147 bool FormsMatchForMerge(const autofill::PasswordForm
& form_a
,
148 const autofill::PasswordForm
& form_b
);
150 // Populates merged_forms by combining the password data from keychain_forms and
151 // the metadata from database_forms, removing used entries from the two source
154 // On return, database_forms and keychain_forms will have only unused
155 // entries; for database_forms that means entries for which no corresponding
156 // password can be found (and which aren't blacklist entries), and for
157 // keychain_forms its entries that weren't merged into at least one database
159 void MergePasswordForms(
160 std::vector
<autofill::PasswordForm
*>* keychain_forms
,
161 std::vector
<autofill::PasswordForm
*>* database_forms
,
162 std::vector
<autofill::PasswordForm
*>* merged_forms
);
164 // Fills in the passwords for as many of the forms in |database_forms| as
165 // possible using entries from |keychain| and returns them. On return,
166 // |database_forms| will contain only the forms for which no password was found.
167 std::vector
<autofill::PasswordForm
*> GetPasswordsForForms(
168 const AppleKeychain
& keychain
,
169 std::vector
<autofill::PasswordForm
*>* database_forms
);
171 // Loads all items in the system keychain into |keychain_items|, creates for
172 // each keychain item a corresponding PasswordForm that doesn't contain any
173 // password data, and returns the two collections as a vector of ItemFormPairs.
174 // Used by GetPasswordsForForms for optimized matching of keychain items with
175 // PasswordForms in the database.
176 // Note: Since no password data is loaded here, the resulting PasswordForms
177 // will include blacklist entries, which will have to be filtered out later.
178 // Caller owns the SecKeychainItemRefs and PasswordForms that are returned.
179 // This operation does not require OS authorization.
180 std::vector
<ItemFormPair
> ExtractAllKeychainItemAttributesIntoPasswordForms(
181 std::vector
<SecKeychainItemRef
>* keychain_items
,
182 const AppleKeychain
& keychain
);
184 // Takes a PasswordForm's signon_realm and parses it into its component parts,
185 // which are returned though the appropriate out parameters.
186 // Returns true if it can be successfully parsed, in which case all out params
187 // that are non-NULL will be set. If there is no port, port will be 0.
188 // If the return value is false, the state of the out params is undefined.
189 bool ExtractSignonRealmComponents(const std::string
& signon_realm
,
190 std::string
* server
, int* port
,
192 std::string
* security_domain
);
194 // Returns true if the signon_realm of |query_form| can be successfully parsed
195 // by ExtractSignonRealmComponents, and if |query_form| matches |other_form|.
196 bool FormIsValidAndMatchesOtherForm(const autofill::PasswordForm
& query_form
,
197 const autofill::PasswordForm
& other_form
);
199 // Returns PasswordForms populated with password data for each keychain entry
200 // in |item_form_pairs| that could be merged with |query_form|.
201 // Caller is responsible for deleting the returned forms.
202 std::vector
<autofill::PasswordForm
*> ExtractPasswordsMergeableWithForm(
203 const AppleKeychain
& keychain
,
204 const std::vector
<ItemFormPair
>& item_form_pairs
,
205 const autofill::PasswordForm
& query_form
);
207 } // namespace internal_keychain_helpers
209 #endif // CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_