1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CHROMEOS_CERT_LOADER_H_ 6 #define CHROMEOS_CERT_LOADER_H_ 7 8 #include <string> 9 #include <vector> 10 11 #include "base/basictypes.h" 12 #include "base/compiler_specific.h" 13 #include "base/memory/ref_counted.h" 14 #include "base/memory/weak_ptr.h" 15 #include "base/observer_list.h" 16 #include "base/threading/thread_checker.h" 17 #include "chromeos/chromeos_export.h" 18 #include "net/cert/cert_database.h" 19 20 namespace net { 21 class NSSCertDatabase; 22 class X509Certificate; 23 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; 24 } 25 26 namespace chromeos { 27 28 // This class is responsible for loading certificates once the TPM is 29 // initialized. It is expected to be constructed on the UI thread and public 30 // methods should all be called from the UI thread. 31 // When certificates have been loaded (after login completes and tpm token is 32 // initialized), or the cert database changes, observers are called with 33 // OnCertificatesLoaded(). 34 class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer { 35 public: 36 class Observer { 37 public: 38 // Called when the certificates, passed for convenience as |cert_list|, 39 // have completed loading. |initial_load| is true the first time this 40 // is called. 41 virtual void OnCertificatesLoaded(const net::CertificateList& cert_list, 42 bool initial_load) = 0; 43 44 protected: ~Observer()45 virtual ~Observer() {} 46 }; 47 48 // Sets the global instance. Must be called before any calls to Get(). 49 static void Initialize(); 50 51 // Destroys the global instance. 52 static void Shutdown(); 53 54 // Gets the global instance. Initialize() must be called first. 55 static CertLoader* Get(); 56 57 // Returns true if the global instance has been initialized. 58 static bool IsInitialized(); 59 60 // Returns the PKCS#11 attribute CKA_ID for a certificate as an upper-case 61 // hex string, or the empty string if none is found. Note that the returned ID 62 // should be used only to identify the cert in its slot. 63 // This should be used only for user certificates, assuming that only one 64 // private slot is loaded for a user. 65 // TODO(tbarzic): Make this check cert slot id if we start loading 66 // certificates for secondary users. 67 static std::string GetPkcs11IdForCert(const net::X509Certificate& cert); 68 69 // Starts the CertLoader with the NSS cert database. 70 // The CertLoader will _not_ take the ownership of the database, but it 71 // expects it to stay alive at least until the shutdown starts on the main 72 // thread. This assumes that |StartWithNSSDB| and other methods directly 73 // using |database_| are not called during shutdown. 74 void StartWithNSSDB(net::NSSCertDatabase* database); 75 76 void AddObserver(CertLoader::Observer* observer); 77 void RemoveObserver(CertLoader::Observer* observer); 78 79 int TPMTokenSlotID() const; 80 bool IsHardwareBacked() const; 81 82 // Whether the certificate is hardware backed. Returns false if the CertLoader 83 // was not yet started (both |CertificatesLoading()| and 84 // |certificates_loaded()| are false). 85 bool IsCertificateHardwareBacked(const net::X509Certificate* cert) const; 86 87 // Returns true when the certificate list has been requested but not loaded. 88 bool CertificatesLoading() const; 89 certificates_loaded()90 bool certificates_loaded() const { return certificates_loaded_; } 91 92 // This will be empty until certificates_loaded() is true. cert_list()93 const net::CertificateList& cert_list() const { return *cert_list_; } 94 force_hardware_backed_for_test()95 void force_hardware_backed_for_test() { 96 force_hardware_backed_for_test_ = true; 97 } 98 99 private: 100 CertLoader(); 101 virtual ~CertLoader(); 102 103 // Trigger a certificate load. If a certificate loading task is already in 104 // progress, will start a reload once the current task is finished. 105 void LoadCertificates(); 106 107 // Called if a certificate load task is finished. 108 void UpdateCertificates(scoped_ptr<net::CertificateList> cert_list); 109 110 void NotifyCertificatesLoaded(bool initial_load); 111 112 // net::CertDatabase::Observer 113 virtual void OnCACertChanged(const net::X509Certificate* cert) OVERRIDE; 114 virtual void OnCertAdded(const net::X509Certificate* cert) OVERRIDE; 115 virtual void OnCertRemoved(const net::X509Certificate* cert) OVERRIDE; 116 117 ObserverList<Observer> observers_; 118 119 // Flags describing current CertLoader state. 120 bool certificates_loaded_; 121 bool certificates_update_required_; 122 bool certificates_update_running_; 123 124 // The user-specific NSS certificate database from which the certificates 125 // should be loaded. 126 net::NSSCertDatabase* database_; 127 128 // Set during tests if |IsHardwareBacked()| should always return true. 129 bool force_hardware_backed_for_test_; 130 131 // Cached Certificates loaded from the database. 132 scoped_ptr<net::CertificateList> cert_list_; 133 134 base::ThreadChecker thread_checker_; 135 136 base::WeakPtrFactory<CertLoader> weak_factory_; 137 138 DISALLOW_COPY_AND_ASSIGN(CertLoader); 139 }; 140 141 } // namespace chromeos 142 143 #endif // CHROMEOS_CERT_LOADER_H_ 144