net/ssl/server_bound_cert_service.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/ssl/server_bound_cert_service.h"
   6
   7 #include <algorithm>
   8 #include <limits>
   9
  10 #include "base/bind.h"
  11 #include "base/bind_helpers.h"
  12 #include "base/callback_helpers.h"
  13 #include "base/compiler_specific.h"
  14 #include "base/location.h"
  15 #include "base/logging.h"
  16 #include "base/memory/ref_counted.h"
  17 #include "base/memory/scoped_ptr.h"
  18 #include "base/message_loop/message_loop_proxy.h"
  19 #include "base/metrics/histogram.h"
  20 #include "base/rand_util.h"
  21 #include "base/stl_util.h"
  22 #include "base/task_runner.h"
  23 #include "crypto/ec_private_key.h"
  24 #include "net/base/net_errors.h"
  25 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
  26 #include "net/cert/x509_certificate.h"
  27 #include "net/cert/x509_util.h"
  28 #include "url/gurl.h"
  29
  30 #if defined(USE_NSS)
  31 #include <private/pprthred.h>  // PR_DetachThread
  32 #endif
  33
  34 namespace net {
  35
  36 namespace {
  37
  38 const int kValidityPeriodInDays = 365;
  39 // When we check the system time, we add this many days to the end of the check
  40 // so the result will still hold even after chrome has been running for a
  41 // while.
  42 const int kSystemTimeValidityBufferInDays = 90;
  43
  44 // Used by the GetDomainBoundCertResult histogram to record the final
  45 // outcome of each GetDomainBoundCert or GetOrCreateDomainBoundCert call.
  46 // Do not re-use values.
  47 enum GetCertResult {
  48   // Synchronously found and returned an existing domain bound cert.
  49   SYNC_SUCCESS = 0,
  50   // Retrieved or generated and returned a domain bound cert asynchronously.
  51   ASYNC_SUCCESS = 1,
  52   // Retrieval/generation request was cancelled before the cert generation
  53   // completed.
  54   ASYNC_CANCELLED = 2,
  55   // Cert generation failed.
  56   ASYNC_FAILURE_KEYGEN = 3,
  57   ASYNC_FAILURE_CREATE_CERT = 4,
  58   ASYNC_FAILURE_EXPORT_KEY = 5,
  59   ASYNC_FAILURE_UNKNOWN = 6,
  60   // GetDomainBoundCert or GetOrCreateDomainBoundCert was called with
  61   // invalid arguments.
  62   INVALID_ARGUMENT = 7,
  63   // We don't support any of the cert types the server requested.
  64   UNSUPPORTED_TYPE = 8,
  65   // Server asked for a different type of certs while we were generating one.
  66   TYPE_MISMATCH = 9,
  67   // Couldn't start a worker to generate a cert.
  68   WORKER_FAILURE = 10,
  69   GET_CERT_RESULT_MAX
  70 };
  71
  72 void RecordGetDomainBoundCertResult(GetCertResult result) {
  73   UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.GetDomainBoundCertResult", result,
  74                             GET_CERT_RESULT_MAX);
  75 }
  76
  77 void RecordGetCertTime(base::TimeDelta request_time) {
  78   UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTime",
  79                              request_time,
  80                              base::TimeDelta::FromMilliseconds(1),
  81                              base::TimeDelta::FromMinutes(5),
  82                              50);
  83 }
  84
  85 // On success, returns a ServerBoundCert object and sets |*error| to OK.
  86 // Otherwise, returns NULL, and |*error| will be set to a net error code.
  87 // |serial_number| is passed in because base::RandInt cannot be called from an
  88 // unjoined thread, due to relying on a non-leaked LazyInstance
  89 scoped_ptr<ServerBoundCertStore::ServerBoundCert> GenerateCert(
  90     const std::string& server_identifier,
  91     uint32 serial_number,
  92     int* error) {
  93   scoped_ptr<ServerBoundCertStore::ServerBoundCert> result;
  94
  95   base::TimeTicks start = base::TimeTicks::Now();
  96   base::Time not_valid_before = base::Time::Now();
  97   base::Time not_valid_after =
  98       not_valid_before + base::TimeDelta::FromDays(kValidityPeriodInDays);
  99   std::string der_cert;
 100   std::vector<uint8> private_key_info;
 101   scoped_ptr<crypto::ECPrivateKey> key;
 102   if (!x509_util::CreateKeyAndDomainBoundCertEC(server_identifier,
 103                                                 serial_number,
 104                                                 not_valid_before,
 105                                                 not_valid_after,
 106                                                 &key,
 107                                                 &der_cert)) {
 108     DLOG(ERROR) << "Unable to create x509 cert for client";
 109     *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED;
 110     return result.Pass();
 111   }
 112
 113   if (!key->ExportEncryptedPrivateKey(ServerBoundCertService::kEPKIPassword,
 114                                       1, &private_key_info)) {
 115     DLOG(ERROR) << "Unable to export private key";
 116     *error = ERR_PRIVATE_KEY_EXPORT_FAILED;
 117     return result.Pass();
 118   }
 119
 120   // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a
 121   // std::string* to prevent this copying.
 122   std::string key_out(private_key_info.begin(), private_key_info.end());
 123
 124   result.reset(new ServerBoundCertStore::ServerBoundCert(
 125       server_identifier,
 126       not_valid_before,
 127       not_valid_after,
 128       key_out,
 129       der_cert));
 130   UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime",
 131                              base::TimeTicks::Now() - start,
 132                              base::TimeDelta::FromMilliseconds(1),
 133                              base::TimeDelta::FromMinutes(5),
 134                              50);
 135   *error = OK;
 136   return result.Pass();
 137 }
 138
 139 }  // namespace
 140
 141 // Represents the output and result callback of a request.
 142 class ServerBoundCertServiceRequest {
 143  public:
 144   ServerBoundCertServiceRequest(base::TimeTicks request_start,
 145                                 const CompletionCallback& callback,
 146                                 std::string* private_key,
 147                                 std::string* cert)
 148       : request_start_(request_start),
 149         callback_(callback),
 150         private_key_(private_key),
 151         cert_(cert) {
 152   }
 153
 154   // Ensures that the result callback will never be made.
 155   void Cancel() {
 156     RecordGetDomainBoundCertResult(ASYNC_CANCELLED);
 157     callback_.Reset();
 158     private_key_ = NULL;
 159     cert_ = NULL;
 160   }
 161
 162   // Copies the contents of |private_key| and |cert| to the caller's output
 163   // arguments and calls the callback.
 164   void Post(int error,
 165             const std::string& private_key,
 166             const std::string& cert) {
 167     switch (error) {
 168       case OK: {
 169         base::TimeDelta request_time = base::TimeTicks::Now() - request_start_;
 170         UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTimeAsync",
 171                                    request_time,
 172                                    base::TimeDelta::FromMilliseconds(1),
 173                                    base::TimeDelta::FromMinutes(5),
 174                                    50);
 175         RecordGetCertTime(request_time);
 176         RecordGetDomainBoundCertResult(ASYNC_SUCCESS);
 177         break;
 178       }
 179       case ERR_KEY_GENERATION_FAILED:
 180         RecordGetDomainBoundCertResult(ASYNC_FAILURE_KEYGEN);
 181         break;
 182       case ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED:
 183         RecordGetDomainBoundCertResult(ASYNC_FAILURE_CREATE_CERT);
 184         break;
 185       case ERR_PRIVATE_KEY_EXPORT_FAILED:
 186         RecordGetDomainBoundCertResult(ASYNC_FAILURE_EXPORT_KEY);
 187         break;
 188       case ERR_INSUFFICIENT_RESOURCES:
 189         RecordGetDomainBoundCertResult(WORKER_FAILURE);
 190         break;
 191       default:
 192         RecordGetDomainBoundCertResult(ASYNC_FAILURE_UNKNOWN);
 193         break;
 194     }
 195     if (!callback_.is_null()) {
 196       *private_key_ = private_key;
 197       *cert_ = cert;
 198       callback_.Run(error);
 199     }
 200     delete this;
 201   }
 202
 203   bool canceled() const { return callback_.is_null(); }
 204
 205  private:
 206   base::TimeTicks request_start_;
 207   CompletionCallback callback_;
 208   std::string* private_key_;
 209   std::string* cert_;
 210 };
 211
 212 // ServerBoundCertServiceWorker runs on a worker thread and takes care of the
 213 // blocking process of performing key generation. Will take care of deleting
 214 // itself once Start() is called.
 215 class ServerBoundCertServiceWorker {
 216  public:
 217   typedef base::Callback<void(
 218       const std::string&,
 219       int,
 220       scoped_ptr<ServerBoundCertStore::ServerBoundCert>)> WorkerDoneCallback;
 221
 222   ServerBoundCertServiceWorker(
 223       const std::string& server_identifier,
 224       const WorkerDoneCallback& callback)
 225       : server_identifier_(server_identifier),
 226         serial_number_(base::RandInt(0, std::numeric_limits<int>::max())),
 227         origin_loop_(base::MessageLoopProxy::current()),
 228         callback_(callback) {
 229   }
 230
 231   // Starts the worker on |task_runner|. If the worker fails to start, such as
 232   // if the task runner is shutting down, then it will take care of deleting
 233   // itself.
 234   bool Start(const scoped_refptr<base::TaskRunner>& task_runner) {
 235     DCHECK(origin_loop_->RunsTasksOnCurrentThread());
 236
 237     return task_runner->PostTask(
 238         FROM_HERE,
 239         base::Bind(&ServerBoundCertServiceWorker::Run, base::Owned(this)));
 240   }
 241
 242  private:
 243   void Run() {
 244     // Runs on a worker thread.
 245     int error = ERR_FAILED;
 246     scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert =
 247         GenerateCert(server_identifier_, serial_number_, &error);
 248     DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error;
 249 #if defined(USE_NSS)
 250     // Detach the thread from NSPR.
 251     // Calling NSS functions attaches the thread to NSPR, which stores
 252     // the NSPR thread ID in thread-specific data.
 253     // The threads in our thread pool terminate after we have called
 254     // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets
 255     // segfaults on shutdown when the threads' thread-specific data
 256     // destructors run.
 257     PR_DetachThread();
 258 #endif
 259     origin_loop_->PostTask(FROM_HERE,
 260                            base::Bind(callback_, server_identifier_, error,
 261                                       base::Passed(&cert)));
 262   }
 263
 264   const std::string server_identifier_;
 265   // Note that serial_number_ must be initialized on a non-worker thread
 266   // (see documentation for GenerateCert).
 267   uint32 serial_number_;
 268   scoped_refptr<base::SequencedTaskRunner> origin_loop_;
 269   WorkerDoneCallback callback_;
 270
 271   DISALLOW_COPY_AND_ASSIGN(ServerBoundCertServiceWorker);
 272 };
 273
 274 // A ServerBoundCertServiceJob is a one-to-one counterpart of an
 275 // ServerBoundCertServiceWorker. It lives only on the ServerBoundCertService's
 276 // origin message loop.
 277 class ServerBoundCertServiceJob {
 278  public:
 279   ServerBoundCertServiceJob(bool create_if_missing)
 280       : create_if_missing_(create_if_missing) {
 281   }
 282
 283   ~ServerBoundCertServiceJob() {
 284     if (!requests_.empty())
 285       DeleteAllCanceled();
 286   }
 287
 288   void AddRequest(ServerBoundCertServiceRequest* request,
 289                   bool create_if_missing = false) {
 290     create_if_missing_ |= create_if_missing;
 291     requests_.push_back(request);
 292   }
 293
 294   void HandleResult(int error,
 295                     const std::string& private_key,
 296                     const std::string& cert) {
 297     PostAll(error, private_key, cert);
 298   }
 299
 300   bool CreateIfMissing() const { return create_if_missing_; }
 301
 302  private:
 303   void PostAll(int error,
 304                const std::string& private_key,
 305                const std::string& cert) {
 306     std::vector<ServerBoundCertServiceRequest*> requests;
 307     requests_.swap(requests);
 308
 309     for (std::vector<ServerBoundCertServiceRequest*>::iterator
 310          i = requests.begin(); i != requests.end(); i++) {
 311       (*i)->Post(error, private_key, cert);
 312       // Post() causes the ServerBoundCertServiceRequest to delete itself.
 313     }
 314   }
 315
 316   void DeleteAllCanceled() {
 317     for (std::vector<ServerBoundCertServiceRequest*>::iterator
 318          i = requests_.begin(); i != requests_.end(); i++) {
 319       if ((*i)->canceled()) {
 320         delete *i;
 321       } else {
 322         LOG(DFATAL) << "ServerBoundCertServiceRequest leaked!";
 323       }
 324     }
 325   }
 326
 327   std::vector<ServerBoundCertServiceRequest*> requests_;
 328   bool create_if_missing_;
 329 };
 330
 331 // static
 332 const char ServerBoundCertService::kEPKIPassword[] = "";
 333
 334 ServerBoundCertService::RequestHandle::RequestHandle()
 335     : service_(NULL),
 336       request_(NULL) {}
 337
 338 ServerBoundCertService::RequestHandle::~RequestHandle() {
 339   Cancel();
 340 }
 341
 342 void ServerBoundCertService::RequestHandle::Cancel() {
 343   if (request_) {
 344     service_->CancelRequest(request_);
 345     request_ = NULL;
 346     callback_.Reset();
 347   }
 348 }
 349
 350 void ServerBoundCertService::RequestHandle::RequestStarted(
 351     ServerBoundCertService* service,
 352     ServerBoundCertServiceRequest* request,
 353     const CompletionCallback& callback) {
 354   DCHECK(request_ == NULL);
 355   service_ = service;
 356   request_ = request;
 357   callback_ = callback;
 358 }
 359
 360 void ServerBoundCertService::RequestHandle::OnRequestComplete(int result) {
 361   request_ = NULL;
 362   // Running the callback might delete |this|, so we can't touch any of our
 363   // members afterwards. Reset callback_ first.
 364   base::ResetAndReturn(&callback_).Run(result);
 365 }
 366
 367 ServerBoundCertService::ServerBoundCertService(
 368     ServerBoundCertStore* server_bound_cert_store,
 369     const scoped_refptr<base::TaskRunner>& task_runner)
 370     : server_bound_cert_store_(server_bound_cert_store),
 371       task_runner_(task_runner),
 372       requests_(0),
 373       cert_store_hits_(0),
 374       inflight_joins_(0),
 375       workers_created_(0),
 376       weak_ptr_factory_(this) {
 377   base::Time start = base::Time::Now();
 378   base::Time end = start + base::TimeDelta::FromDays(
 379       kValidityPeriodInDays + kSystemTimeValidityBufferInDays);
 380   is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end);
 381 }
 382
 383 ServerBoundCertService::~ServerBoundCertService() {
 384   STLDeleteValues(&inflight_);
 385 }
 386
 387 //static
 388 std::string ServerBoundCertService::GetDomainForHost(const std::string& host) {
 389   std::string domain =
 390       registry_controlled_domains::GetDomainAndRegistry(
 391           host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 392   if (domain.empty())
 393     return host;
 394   return domain;
 395 }
 396
 397 int ServerBoundCertService::GetOrCreateDomainBoundCert(
 398     const std::string& host,
 399     std::string* private_key,
 400     std::string* cert,
 401     const CompletionCallback& callback,
 402     RequestHandle* out_req) {
 403   DVLOG(1) << __FUNCTION__ << " " << host;
 404   DCHECK(CalledOnValidThread());
 405   base::TimeTicks request_start = base::TimeTicks::Now();
 406
 407   if (callback.is_null() || !private_key || !cert || host.empty()) {
 408     RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
 409     return ERR_INVALID_ARGUMENT;
 410   }
 411
 412   std::string domain = GetDomainForHost(host);
 413   if (domain.empty()) {
 414     RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
 415     return ERR_INVALID_ARGUMENT;
 416   }
 417
 418   requests_++;
 419
 420   // See if a request for the same domain is currently in flight.
 421   bool create_if_missing = true;
 422   if (JoinToInFlightRequest(request_start, domain, private_key, cert,
 423                             create_if_missing, callback, out_req)) {
 424     return ERR_IO_PENDING;
 425   }
 426
 427   int err = LookupDomainBoundCert(request_start, domain, private_key, cert,
 428                                   create_if_missing, callback, out_req);
 429   if (err == ERR_FILE_NOT_FOUND) {
 430     // Sync lookup did not find a valid cert.  Start generating a new one.
 431     workers_created_++;
 432     ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker(
 433         domain,
 434         base::Bind(&ServerBoundCertService::GeneratedServerBoundCert,
 435                    weak_ptr_factory_.GetWeakPtr()));
 436     if (!worker->Start(task_runner_)) {
 437       // TODO(rkn): Log to the NetLog.
 438       LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started.";
 439       RecordGetDomainBoundCertResult(WORKER_FAILURE);
 440       return ERR_INSUFFICIENT_RESOURCES;
 441     }
 442     // We are waiting for cert generation.  Create a job & request to track it.
 443     ServerBoundCertServiceJob* job =
 444         new ServerBoundCertServiceJob(create_if_missing);
 445     inflight_[domain] = job;
 446
 447     ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
 448         request_start,
 449         base::Bind(&RequestHandle::OnRequestComplete,
 450                    base::Unretained(out_req)),
 451         private_key,
 452         cert);
 453     job->AddRequest(request);
 454     out_req->RequestStarted(this, request, callback);
 455     return ERR_IO_PENDING;
 456   }
 457
 458   return err;
 459 }
 460
 461 int ServerBoundCertService::GetDomainBoundCert(
 462     const std::string& host,
 463     std::string* private_key,
 464     std::string* cert,
 465     const CompletionCallback& callback,
 466     RequestHandle* out_req) {
 467   DVLOG(1) << __FUNCTION__ << " " << host;
 468   DCHECK(CalledOnValidThread());
 469   base::TimeTicks request_start = base::TimeTicks::Now();
 470
 471   if (callback.is_null() || !private_key || !cert || host.empty()) {
 472     RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
 473     return ERR_INVALID_ARGUMENT;
 474   }
 475
 476   std::string domain = GetDomainForHost(host);
 477   if (domain.empty()) {
 478     RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
 479     return ERR_INVALID_ARGUMENT;
 480   }
 481
 482   requests_++;
 483
 484   // See if a request for the same domain currently in flight.
 485   bool create_if_missing = false;
 486   if (JoinToInFlightRequest(request_start, domain, private_key, cert,
 487                             create_if_missing, callback, out_req)) {
 488     return ERR_IO_PENDING;
 489   }
 490
 491   int err = LookupDomainBoundCert(request_start, domain, private_key, cert,
 492                                   create_if_missing, callback, out_req);
 493   return err;
 494 }
 495
 496 void ServerBoundCertService::GotServerBoundCert(
 497     int err,
 498     const std::string& server_identifier,
 499     base::Time expiration_time,
 500     const std::string& key,
 501     const std::string& cert) {
 502   DCHECK(CalledOnValidThread());
 503
 504   std::map<std::string, ServerBoundCertServiceJob*>::iterator j;
 505   j = inflight_.find(server_identifier);
 506   if (j == inflight_.end()) {
 507     NOTREACHED();
 508     return;
 509   }
 510
 511   if (err == OK) {
 512     // Async DB lookup found a valid cert.
 513     DVLOG(1) << "Cert store had valid cert for " << server_identifier;
 514     cert_store_hits_++;
 515     // ServerBoundCertServiceRequest::Post will do the histograms and stuff.
 516     HandleResult(OK, server_identifier, key, cert);
 517     return;
 518   }
 519   // Async lookup did not find a valid cert. If no request asked to create one,
 520   // return the error directly.
 521   if (!j->second->CreateIfMissing()) {
 522     HandleResult(err, server_identifier, key, cert);
 523     return;
 524   }
 525   // At least one request asked to create a cert => start generating a new one.
 526   workers_created_++;
 527   ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker(
 528       server_identifier,
 529       base::Bind(&ServerBoundCertService::GeneratedServerBoundCert,
 530                  weak_ptr_factory_.GetWeakPtr()));
 531   if (!worker->Start(task_runner_)) {
 532     // TODO(rkn): Log to the NetLog.
 533     LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started.";
 534     HandleResult(ERR_INSUFFICIENT_RESOURCES,
 535                  server_identifier,
 536                  std::string(),
 537                  std::string());
 538   }
 539 }
 540
 541 ServerBoundCertStore* ServerBoundCertService::GetCertStore() {
 542   return server_bound_cert_store_.get();
 543 }
 544
 545 void ServerBoundCertService::CancelRequest(ServerBoundCertServiceRequest* req) {
 546   DCHECK(CalledOnValidThread());
 547   req->Cancel();
 548 }
 549
 550 void ServerBoundCertService::GeneratedServerBoundCert(
 551     const std::string& server_identifier,
 552     int error,
 553     scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert) {
 554   DCHECK(CalledOnValidThread());
 555
 556   if (error == OK) {
 557     // TODO(mattm): we should just Pass() the cert object to
 558     // SetServerBoundCert().
 559     server_bound_cert_store_->SetServerBoundCert(
 560         cert->server_identifier(),
 561         cert->creation_time(),
 562         cert->expiration_time(),
 563         cert->private_key(),
 564         cert->cert());
 565
 566     HandleResult(error, server_identifier, cert->private_key(), cert->cert());
 567   } else {
 568     HandleResult(error, server_identifier, std::string(), std::string());
 569   }
 570 }
 571
 572 void ServerBoundCertService::HandleResult(
 573     int error,
 574     const std::string& server_identifier,
 575     const std::string& private_key,
 576     const std::string& cert) {
 577   DCHECK(CalledOnValidThread());
 578
 579   std::map<std::string, ServerBoundCertServiceJob*>::iterator j;
 580   j = inflight_.find(server_identifier);
 581   if (j == inflight_.end()) {
 582     NOTREACHED();
 583     return;
 584   }
 585   ServerBoundCertServiceJob* job = j->second;
 586   inflight_.erase(j);
 587
 588   job->HandleResult(error, private_key, cert);
 589   delete job;
 590 }
 591
 592 bool ServerBoundCertService::JoinToInFlightRequest(
 593     const base::TimeTicks& request_start,
 594     const std::string& domain,
 595     std::string* private_key,
 596     std::string* cert,
 597     bool create_if_missing,
 598     const CompletionCallback& callback,
 599     RequestHandle* out_req) {
 600   ServerBoundCertServiceJob* job = NULL;
 601   std::map<std::string, ServerBoundCertServiceJob*>::const_iterator j =
 602       inflight_.find(domain);
 603   if (j != inflight_.end()) {
 604     // A request for the same domain is in flight already. We'll attach our
 605     // callback, but we'll also mark it as requiring a cert if one's mising.
 606     job = j->second;
 607     inflight_joins_++;
 608
 609     ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
 610         request_start,
 611         base::Bind(&RequestHandle::OnRequestComplete,
 612                    base::Unretained(out_req)),
 613         private_key,
 614         cert);
 615     job->AddRequest(request, create_if_missing);
 616     out_req->RequestStarted(this, request, callback);
 617     return true;
 618   }
 619   return false;
 620 }
 621
 622 int ServerBoundCertService::LookupDomainBoundCert(
 623     const base::TimeTicks& request_start,
 624     const std::string& domain,
 625     std::string* private_key,
 626     std::string* cert,
 627     bool create_if_missing,
 628     const CompletionCallback& callback,
 629     RequestHandle* out_req) {
 630   // Check if a domain bound cert already exists for this domain. Note that
 631   // |expiration_time| is ignored, and expired certs are considered valid.
 632   base::Time expiration_time;
 633   int err = server_bound_cert_store_->GetServerBoundCert(
 634       domain,
 635       &expiration_time  /* ignored */,
 636       private_key,
 637       cert,
 638       base::Bind(&ServerBoundCertService::GotServerBoundCert,
 639                  weak_ptr_factory_.GetWeakPtr()));
 640
 641   if (err == OK) {
 642     // Sync lookup found a valid cert.
 643     DVLOG(1) << "Cert store had valid cert for " << domain;
 644     cert_store_hits_++;
 645     RecordGetDomainBoundCertResult(SYNC_SUCCESS);
 646     base::TimeDelta request_time = base::TimeTicks::Now() - request_start;
 647     UMA_HISTOGRAM_TIMES("DomainBoundCerts.GetCertTimeSync", request_time);
 648     RecordGetCertTime(request_time);
 649     return OK;
 650   }
 651
 652   if (err == ERR_IO_PENDING) {
 653     // We are waiting for async DB lookup.  Create a job & request to track it.
 654     ServerBoundCertServiceJob* job =
 655         new ServerBoundCertServiceJob(create_if_missing);
 656     inflight_[domain] = job;
 657
 658     ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
 659         request_start,
 660         base::Bind(&RequestHandle::OnRequestComplete,
 661                    base::Unretained(out_req)),
 662         private_key,
 663         cert);
 664     job->AddRequest(request);
 665     out_req->RequestStarted(this, request, callback);
 666     return ERR_IO_PENDING;
 667   }
 668
 669   return err;
 670 }
 671
 672 int ServerBoundCertService::cert_count() {
 673   return server_bound_cert_store_->GetCertCount();
 674 }
 675
 676 }  // namespace net