1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_CERT_DATABASE_H_ 6 #define NET_CERT_CERT_DATABASE_H_ 7 8 #include "base/basictypes.h" 9 #include "base/memory/ref_counted.h" 10 #include "base/memory/scoped_ptr.h" 11 #include "net/base/net_export.h" 12 #include "net/cert/x509_certificate.h" 13 14 template <typename T> struct DefaultSingletonTraits; 15 template <class ObserverType> class ObserverListThreadSafe; 16 17 namespace net { 18 19 class NSSCertDatabase; 20 21 // This class provides cross-platform functions to verify and add user 22 // certificates, and to observe changes to the underlying certificate stores. 23 24 // TODO(gauravsh): This class could be augmented with methods 25 // for all operations that manipulate the underlying system 26 // certificate store. 27 28 class NET_EXPORT CertDatabase { 29 public: 30 // A CertDatabase::Observer will be notified on certificate database changes. 31 // The change could be either a new user certificate is added or trust on 32 // a certificate is changed. Observers can register themselves 33 // via CertDatabase::AddObserver, and can un-register with 34 // CertDatabase::RemoveObserver. 35 class NET_EXPORT Observer { 36 public: ~Observer()37 virtual ~Observer() {} 38 39 // Will be called when a new certificate is added. OnCertAdded(const X509Certificate * cert)40 virtual void OnCertAdded(const X509Certificate* cert) {} 41 42 // Will be called when a certificate is removed. OnCertRemoved(const X509Certificate * cert)43 virtual void OnCertRemoved(const X509Certificate* cert) {} 44 45 // Will be called when a CA certificate was added, removed, or its trust 46 // changed. This can also mean that a client certificate's trust changed. OnCACertChanged(const X509Certificate * cert)47 virtual void OnCACertChanged(const X509Certificate* cert) {} 48 49 protected: Observer()50 Observer() {} 51 52 private: 53 DISALLOW_COPY_AND_ASSIGN(Observer); 54 }; 55 56 // Returns the CertDatabase singleton. 57 static CertDatabase* GetInstance(); 58 59 // Check whether this is a valid user cert that we have the private key for. 60 // Returns OK or a network error code such as ERR_CERT_CONTAINS_ERRORS. 61 int CheckUserCert(X509Certificate* cert); 62 63 // Store user (client) certificate. Assumes CheckUserCert has already passed. 64 // Returns OK, or ERR_ADD_USER_CERT_FAILED if there was a problem saving to 65 // the platform cert database, or possibly other network error codes. 66 int AddUserCert(X509Certificate* cert); 67 68 // Registers |observer| to receive notifications of certificate changes. The 69 // thread on which this is called is the thread on which |observer| will be 70 // called back with notifications. 71 void AddObserver(Observer* observer); 72 73 // Unregisters |observer| from receiving notifications. This must be called 74 // on the same thread on which AddObserver() was called. 75 void RemoveObserver(Observer* observer); 76 77 #if defined(OS_MACOSX) && !defined(OS_IOS) 78 // Configures the current message loop to observe and forward events from 79 // Keychain services. The MessageLoop must have an associated CFRunLoop, 80 // which means that this must be called from a MessageLoop of TYPE_UI. 81 void SetMessageLoopForKeychainEvents(); 82 #endif 83 84 #if defined(OS_ANDROID) 85 // On Android, the system key store may be replaced with a device-specific 86 // KeyStore used for storing client certificates. When the Java side replaces 87 // the KeyStore used for client certificates, notifies the observers as if a 88 // new client certificate was added. 89 void OnAndroidKeyStoreChanged(); 90 91 // On Android, the system database is used. When the system notifies the 92 // application that the certificates changed, the observers must be notified. 93 void OnAndroidKeyChainChanged(); 94 #endif 95 96 #if defined(USE_NSS) 97 // Observe events from the |source| and forward them to observers of this 98 // CertDatabase. 99 void ObserveNSSCertDatabase(NSSCertDatabase* source); 100 #endif 101 102 private: 103 friend struct DefaultSingletonTraits<CertDatabase>; 104 105 CertDatabase(); 106 ~CertDatabase(); 107 108 // Broadcasts notifications to all registered observers. 109 void NotifyObserversOfCertAdded(const X509Certificate* cert); 110 void NotifyObserversOfCertRemoved(const X509Certificate* cert); 111 void NotifyObserversOfCACertChanged(const X509Certificate* cert); 112 113 const scoped_refptr<ObserverListThreadSafe<Observer> > observer_list_; 114 115 #if defined(USE_NSS) || (defined(OS_MACOSX) && !defined(OS_IOS)) 116 class Notifier; 117 friend class Notifier; 118 scoped_ptr<Notifier> notifier_; 119 #endif 120 121 DISALLOW_COPY_AND_ASSIGN(CertDatabase); 122 }; 123 124 } // namespace net 125 126 #endif // NET_CERT_CERT_DATABASE_H_ 127