chrome/browser/ui/android/ssl_client_certificate_request.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ui/android/ssl_client_certificate_request.h"
   6
   7 #include "base/android/jni_array.h"
   8 #include "base/android/jni_string.h"
   9 #include "base/android/scoped_java_ref.h"
  10 #include "base/basictypes.h"
  11 #include "base/bind.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/logging.h"
  14 #include "chrome/browser/ssl/ssl_client_certificate_selector.h"
  15 #include "chrome/browser/ui/android/window_android_helper.h"
  16 #include "content/public/browser/browser_thread.h"
  17 #include "content/public/browser/client_certificate_delegate.h"
  18 #include "crypto/scoped_openssl_types.h"
  19 #include "jni/SSLClientCertificateRequest_jni.h"
  20 #include "net/android/keystore_openssl.h"
  21 #include "net/base/host_port_pair.h"
  22 #include "net/cert/cert_database.h"
  23 #include "net/cert/x509_certificate.h"
  24 #include "net/ssl/openssl_client_key_store.h"
  25 #include "net/ssl/ssl_cert_request_info.h"
  26 #include "net/ssl/ssl_client_cert_type.h"
  27 #include "ui/android/window_android.h"
  28
  29 namespace chrome {
  30
  31 namespace {
  32
  33 // Must be called on the I/O thread to record a client certificate
  34 // and its private key in the OpenSSLClientKeyStore.
  35 void RecordClientCertificateKey(
  36     const scoped_refptr<net::X509Certificate>& client_cert,
  37     crypto::ScopedEVP_PKEY private_key) {
  38   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
  39   net::OpenSSLClientKeyStore::GetInstance()->RecordClientCertPrivateKey(
  40       client_cert.get(), private_key.get());
  41 }
  42
  43 void StartClientCertificateRequest(
  44     const net::SSLCertRequestInfo* cert_request_info,
  45     ui::WindowAndroid* window,
  46     scoped_ptr<content::ClientCertificateDelegate> delegate) {
  47   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
  48
  49   // Build the |key_types| JNI parameter, as a String[]
  50   std::vector<std::string> key_types;
  51   for (size_t n = 0; n < cert_request_info->cert_key_types.size(); ++n) {
  52     switch (cert_request_info->cert_key_types[n]) {
  53       case net::CLIENT_CERT_RSA_SIGN:
  54         key_types.push_back("RSA");
  55         break;
  56       case net::CLIENT_CERT_ECDSA_SIGN:
  57         key_types.push_back("ECDSA");
  58         break;
  59       default:
  60         // Ignore unknown types.
  61         break;
  62     }
  63   }
  64
  65   JNIEnv* env = base::android::AttachCurrentThread();
  66   ScopedJavaLocalRef<jobjectArray> key_types_ref =
  67       base::android::ToJavaArrayOfStrings(env, key_types);
  68   if (key_types_ref.is_null()) {
  69     LOG(ERROR) << "Could not create key types array (String[])";
  70     return;
  71   }
  72
  73   // Build the |encoded_principals| JNI parameter, as a byte[][]
  74   ScopedJavaLocalRef<jobjectArray> principals_ref =
  75       base::android::ToJavaArrayOfByteArray(
  76           env, cert_request_info->cert_authorities);
  77   if (principals_ref.is_null()) {
  78     LOG(ERROR) << "Could not create principals array (byte[][])";
  79     return;
  80   }
  81
  82   // Build the |host_name| and |port| JNI parameters, as a String and
  83   // a jint.
  84   ScopedJavaLocalRef<jstring> host_name_ref =
  85       base::android::ConvertUTF8ToJavaString(
  86           env, cert_request_info->host_and_port.host());
  87
  88   // Pass the address of the delegate through to Java.
  89   jlong request_id = reinterpret_cast<intptr_t>(delegate.get());
  90
  91   if (!chrome::android::
  92       Java_SSLClientCertificateRequest_selectClientCertificate(
  93           env,
  94           request_id,
  95           window->GetJavaObject().obj(),
  96           key_types_ref.obj(),
  97           principals_ref.obj(),
  98           host_name_ref.obj(),
  99           cert_request_info->host_and_port.port())) {
 100     return;
 101   }
 102
 103   // Ownership was transferred to Java.
 104   ignore_result(delegate.release());
 105 }
 106
 107 }  // namespace
 108
 109 namespace android {
 110
 111 // Called from JNI on request completion/result.
 112 // |env| is the current thread's JNIEnv.
 113 // |clazz| is the SSLClientCertificateRequest JNI class reference.
 114 // |request_id| is the id passed to
 115 // Java_SSLClientCertificateRequest_selectClientCertificate() in Start().
 116 // |encoded_chain_ref| is a JNI reference to a Java array of byte arrays,
 117 // each item holding a DER-encoded X.509 certificate.
 118 // |private_key_ref| is the platform PrivateKey object JNI reference for
 119 // the client certificate.
 120 // Note: both |encoded_chain_ref| and |private_key_ref| will be NULL if
 121 // the user didn't select a certificate.
 122 static void OnSystemRequestCompletion(
 123     JNIEnv* env,
 124     const JavaParamRef<jclass>& clazz,
 125     jlong request_id,
 126     const JavaParamRef<jobjectArray>& encoded_chain_ref,
 127     const JavaParamRef<jobject>& private_key_ref) {
 128   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 129
 130   // Take back ownership of the delegate object.
 131   scoped_ptr<content::ClientCertificateDelegate> delegate(
 132       reinterpret_cast<content::ClientCertificateDelegate*>(request_id));
 133
 134   if (encoded_chain_ref == NULL || private_key_ref == NULL) {
 135     LOG(ERROR) << "No client certificate selected";
 136     delegate->ContinueWithCertificate(nullptr);
 137     return;
 138   }
 139
 140   // Convert the encoded chain to a vector of strings.
 141   std::vector<std::string> encoded_chain_strings;
 142   if (encoded_chain_ref) {
 143     base::android::JavaArrayOfByteArrayToStringVector(
 144         env, encoded_chain_ref, &encoded_chain_strings);
 145   }
 146
 147   std::vector<base::StringPiece> encoded_chain;
 148   for (size_t n = 0; n < encoded_chain_strings.size(); ++n)
 149     encoded_chain.push_back(encoded_chain_strings[n]);
 150
 151   // Create the X509Certificate object from the encoded chain.
 152   scoped_refptr<net::X509Certificate> client_cert(
 153       net::X509Certificate::CreateFromDERCertChain(encoded_chain));
 154   if (!client_cert.get()) {
 155     LOG(ERROR) << "Could not decode client certificate chain";
 156     return;
 157   }
 158
 159   // Create an EVP_PKEY wrapper for the private key JNI reference.
 160   crypto::ScopedEVP_PKEY private_key(
 161       net::android::GetOpenSSLPrivateKeyWrapper(private_key_ref));
 162   if (!private_key.get()) {
 163     LOG(ERROR) << "Could not create OpenSSL wrapper for private key";
 164     return;
 165   }
 166
 167   // RecordClientCertificateKey() must be called on the I/O thread,
 168   // before the callback is called with the selected certificate on
 169   // the UI thread.
 170   content::BrowserThread::PostTaskAndReply(
 171       content::BrowserThread::IO, FROM_HERE,
 172       base::Bind(&RecordClientCertificateKey, client_cert,
 173                  base::Passed(&private_key)),
 174       base::Bind(&content::ClientCertificateDelegate::ContinueWithCertificate,
 175                  base::Owned(delegate.release()), client_cert));
 176 }
 177
 178 static void NotifyClientCertificatesChanged() {
 179   net::CertDatabase::GetInstance()->OnAndroidKeyStoreChanged();
 180 }
 181
 182 static void NotifyClientCertificatesChangedOnIOThread(
 183     JNIEnv* env,
 184     const JavaParamRef<jclass>&) {
 185   if (content::BrowserThread::CurrentlyOn(content::BrowserThread::IO)) {
 186     NotifyClientCertificatesChanged();
 187   } else {
 188     content::BrowserThread::PostTask(
 189          content::BrowserThread::IO,
 190          FROM_HERE,
 191          base::Bind(&NotifyClientCertificatesChanged));
 192   }
 193 }
 194
 195 bool RegisterSSLClientCertificateRequestAndroid(JNIEnv* env) {
 196   return RegisterNativesImpl(env);
 197 }
 198
 199 }  // namespace android
 200
 201 void ShowSSLClientCertificateSelector(
 202     content::WebContents* contents,
 203     net::SSLCertRequestInfo* cert_request_info,
 204     scoped_ptr<content::ClientCertificateDelegate> delegate) {
 205   ui::WindowAndroid* window =
 206       WindowAndroidHelper::FromWebContents(contents)->GetWindowAndroid();
 207   DCHECK(window);
 208   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 209   StartClientCertificateRequest(cert_request_info, window, delegate.Pass());
 210 }
 211
 212 }  // namespace chrome