net/base/server_bound_cert_service.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_BASE_SERVER_BOUND_CERT_SERVICE_H_
   6 #define NET_BASE_SERVER_BOUND_CERT_SERVICE_H_
   7 #pragma once
   8
   9 #include <map>
  10 #include <string>
  11 #include <vector>
  12
  13 #include "base/basictypes.h"
  14 #include "base/memory/scoped_ptr.h"
  15 #include "base/threading/non_thread_safe.h"
  16 #include "base/time.h"
  17 #include "net/base/completion_callback.h"
  18 #include "net/base/net_export.h"
  19 #include "net/base/ssl_client_cert_type.h"
  20
  21 namespace base {
  22 class TaskRunner;
  23 }
  24
  25 namespace net {
  26
  27 class ServerBoundCertServiceJob;
  28 class ServerBoundCertServiceWorker;
  29 class ServerBoundCertStore;
  30
  31 // A class for creating and fetching server bound certs.
  32 // Inherits from NonThreadSafe in order to use the function
  33 // |CalledOnValidThread|.
  34 class NET_EXPORT ServerBoundCertService
  35     : NON_EXPORTED_BASE(public base::NonThreadSafe) {
  36  public:
  37   // Opaque type used to cancel a request.
  38   typedef void* RequestHandle;
  39
  40   // Password used on EncryptedPrivateKeyInfo data stored in EC private_key
  41   // values.  (This is not used to provide any security, but to workaround NSS
  42   // being unable to import unencrypted PrivateKeyInfo for EC keys.)
  43   static const char kEPKIPassword[];
  44
  45   // This object owns |server_bound_cert_store|.  |task_runner| will
  46   // be used to post certificate generation worker tasks.  The tasks are
  47   // safe for use with WorkerPool and SequencedWorkerPool::CONTINUE_ON_SHUTDOWN.
  48   ServerBoundCertService(
  49       ServerBoundCertStore* server_bound_cert_store,
  50       const scoped_refptr<base::TaskRunner>& task_runner);
  51
  52   ~ServerBoundCertService();
  53
  54   // Returns the domain to be used for |host|.  The domain is the
  55   // "registry controlled domain", or the "ETLD + 1" where one exists, or
  56   // the origin otherwise.
  57   static std::string GetDomainForHost(const std::string& host);
  58
  59   // Fetches the domain bound cert for the specified origin of the specified
  60   // type if one exists and creates one otherwise. Returns OK if successful or
  61   // an error code upon failure.
  62   //
  63   // |requested_types| is a list of the TLS ClientCertificateTypes the site will
  64   // accept, ordered from most preferred to least preferred.  Types we don't
  65   // support will be ignored. See ssl_client_cert_type.h.
  66   //
  67   // On successful completion, |private_key| stores a DER-encoded
  68   // PrivateKeyInfo struct, and |cert| stores a DER-encoded certificate, and
  69   // |type| specifies the type of certificate that was returned.
  70   //
  71   // |callback| must not be null. ERR_IO_PENDING is returned if the operation
  72   // could not be completed immediately, in which case the result code will
  73   // be passed to the callback when available.
  74   //
  75   // |*out_req| will be filled with a handle to the async request. This handle
  76   // is not valid after the request has completed.
  77   int GetDomainBoundCert(
  78       const std::string& origin,
  79       const std::vector<uint8>& requested_types,
  80       SSLClientCertType* type,
  81       std::string* private_key,
  82       std::string* cert,
  83       const CompletionCallback& callback,
  84       RequestHandle* out_req);
  85
  86   // Cancels the specified request. |req| is the handle returned by
  87   // GetDomainBoundCert(). After a request is canceled, its completion
  88   // callback will not be called.
  89   void CancelRequest(RequestHandle req);
  90
  91   // Returns the backing ServerBoundCertStore.
  92   ServerBoundCertStore* GetCertStore();
  93
  94   // Public only for unit testing.
  95   int cert_count();
  96   uint64 requests() const { return requests_; }
  97   uint64 cert_store_hits() const { return cert_store_hits_; }
  98   uint64 inflight_joins() const { return inflight_joins_; }
  99
 100  private:
 101   friend class ServerBoundCertServiceWorker;  // Calls HandleResult.
 102
 103   // On success, |private_key| stores a DER-encoded PrivateKeyInfo
 104   // struct, |cert| stores a DER-encoded certificate, |creation_time| stores the
 105   // start of the validity period of the certificate and |expiration_time|
 106   // stores the expiration time of the certificate. Returns OK if successful and
 107   // an error code otherwise.
 108   // |serial_number| is passed in because it is created with the function
 109   // base::RandInt, which opens the file /dev/urandom. /dev/urandom is opened
 110   // with a LazyInstance, which is not allowed on a worker thread.
 111   static int GenerateCert(const std::string& server_identifier,
 112                           SSLClientCertType type,
 113                           uint32 serial_number,
 114                           base::Time* creation_time,
 115                           base::Time* expiration_time,
 116                           std::string* private_key,
 117                           std::string* cert);
 118
 119   void HandleResult(const std::string& server_identifier,
 120                     int error,
 121                     SSLClientCertType type,
 122                     base::Time creation_time,
 123                     base::Time expiration_time,
 124                     const std::string& private_key,
 125                     const std::string& cert);
 126
 127   scoped_ptr<ServerBoundCertStore> server_bound_cert_store_;
 128   scoped_refptr<base::TaskRunner> task_runner_;
 129
 130   // inflight_ maps from a server to an active generation which is taking
 131   // place.
 132   std::map<std::string, ServerBoundCertServiceJob*> inflight_;
 133
 134   uint64 requests_;
 135   uint64 cert_store_hits_;
 136   uint64 inflight_joins_;
 137
 138   DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService);
 139 };
 140
 141 }  // namespace net
 142
 143 #endif  // NET_BASE_SERVER_BOUND_CERT_SERVICE_H_