1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CHROMEOS_CERT_LOADER_H_
6#define CHROMEOS_CERT_LOADER_H_
7
8#include <string>
9
10#include "base/basictypes.h"
11#include "base/memory/ref_counted.h"
12#include "base/memory/scoped_ptr.h"
13#include "base/memory/weak_ptr.h"
14#include "base/observer_list_threadsafe.h"
15#include "base/threading/thread_checker.h"
16#include "chromeos/chromeos_export.h"
17#include "chromeos/dbus/dbus_method_call_status.h"
18#include "chromeos/login/login_state.h"
19#include "net/cert/cert_database.h"
20#include "net/cert/x509_certificate.h"
21
22namespace base {
23class SequencedTaskRunner;
24class TaskRunner;
25}
26
27namespace crypto {
28class SymmetricKey;
29}
30
31namespace chromeos {
32
33// This class is responsible for initializing the TPM token and loading
34// certificates once the TPM is initialized. It is expected to be constructed
35// on the UI thread and public methods should all be called from the UI thread.
36// When certificates have been loaded (after login completes), or the cert
37// database changes, observers are called with OnCertificatesLoaded().
38class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
39                                   public LoginState::Observer {
40 public:
41  class Observer {
42   public:
43    virtual ~Observer() {}
44
45    // Called when the certificates, passed for convenience as |cert_list|,
46    // have completed loading. |initial_load| is true the first time this
47    // is called.
48    virtual void OnCertificatesLoaded(const net::CertificateList& cert_list,
49                                      bool initial_load) = 0;
50
51   protected:
52    Observer() {}
53
54   private:
55    DISALLOW_COPY_AND_ASSIGN(Observer);
56  };
57
58  // Sets the global instance. Must be called before any calls to Get().
59  static void Initialize();
60
61  // Destroys the global instance.
62  static void Shutdown();
63
64  // Gets the global instance. Initialize() must be called first.
65  static CertLoader* Get();
66
67  // Returns true if the global instance has been initialized.
68  static bool IsInitialized();
69
70  static std::string GetPkcs11IdForCert(const net::X509Certificate& cert);
71
72  // By default, CertLoader tries to load the TPMToken only if running in a
73  // ChromeOS environment. Tests can call this function after Initialize() and
74  // before SetCryptoTaskRunner() to enable the TPM initialization.
75  void InitializeTPMForTest();
76
77  // |crypto_task_runner| is the task runner that any synchronous crypto calls
78  // should be made from, e.g. in Chrome this is the IO thread. Must be called
79  // after the thread is started. Starts TPM initialization and Certificate
80  // loading.
81  void SetCryptoTaskRunner(
82      const scoped_refptr<base::SequencedTaskRunner>& crypto_task_runner);
83
84  // Sets the task runner that any slow calls will be made from, e.g. calls
85  // to the NSS database. If not set, uses base::WorkerPool.
86  void SetSlowTaskRunnerForTest(
87      const scoped_refptr<base::TaskRunner>& task_runner);
88
89  void AddObserver(CertLoader::Observer* observer);
90  void RemoveObserver(CertLoader::Observer* observer);
91
92  // Returns true when the certificate list has been requested but not loaded.
93  bool CertificatesLoading() const;
94
95  // Returns true if the TPM is available for hardware-backed certificates.
96  bool IsHardwareBacked() const;
97
98  bool certificates_loaded() const { return certificates_loaded_; }
99
100  // TPM info is only valid once the TPM is available (IsHardwareBacked is
101  // true). Otherwise empty strings will be returned.
102  const std::string& tpm_token_name() const { return tpm_token_name_; }
103  int tpm_token_slot_id() const { return tpm_token_slot_id_; }
104  const std::string& tpm_user_pin() const { return tpm_user_pin_; }
105
106  // This will be empty until certificates_loaded() is true.
107  const net::CertificateList& cert_list() const { return cert_list_; }
108
109 private:
110  CertLoader();
111  virtual ~CertLoader();
112
113  void MaybeRequestCertificates();
114
115  // This is the cyclic chain of callbacks to initialize the TPM token and to
116  // kick off the update of the certificate list.
117  void InitializeTokenAndLoadCertificates();
118  void RetryTokenInitializationLater();
119  void OnPersistentNSSDBOpened();
120  void OnTpmIsEnabled(DBusMethodCallStatus call_status,
121                      bool tpm_is_enabled);
122  void OnPkcs11IsTpmTokenReady(DBusMethodCallStatus call_status,
123                               bool is_tpm_token_ready);
124  void OnPkcs11GetTpmTokenInfo(DBusMethodCallStatus call_status,
125                               const std::string& token_name,
126                               const std::string& user_pin,
127                               int token_slot_id);
128  void OnTPMTokenInitialized(bool success);
129
130  // These calls handle the updating of the certificate list after the TPM token
131  // was initialized.
132
133  // Start certificate loading. Must be called at most once.
134  void StartLoadCertificates();
135
136  // Trigger a certificate load. If a certificate loading task is already in
137  // progress, will start a reload once the current task finised.
138  void LoadCertificates();
139
140  // Called if a certificate load task is finished.
141  void UpdateCertificates(net::CertificateList* cert_list);
142
143  void NotifyCertificatesLoaded(bool initial_load);
144
145  // net::CertDatabase::Observer
146  virtual void OnCACertChanged(const net::X509Certificate* cert) OVERRIDE;
147  virtual void OnCertAdded(const net::X509Certificate* cert) OVERRIDE;
148  virtual void OnCertRemoved(const net::X509Certificate* cert) OVERRIDE;
149
150  // LoginState::Observer
151  virtual void LoggedInStateChanged() OVERRIDE;
152
153  bool initialize_tpm_for_test_;
154
155  ObserverList<Observer> observers_;
156
157  bool certificates_requested_;
158  bool certificates_loaded_;
159  bool certificates_update_required_;
160  bool certificates_update_running_;
161
162  // The states are traversed in this order but some might get omitted or never
163  // be left.
164  enum TPMTokenState {
165    TPM_STATE_UNKNOWN,
166    TPM_DB_OPENED,
167    TPM_DISABLED,
168    TPM_ENABLED,
169    TPM_TOKEN_READY,
170    TPM_TOKEN_INFO_RECEIVED,
171    TPM_TOKEN_INITIALIZED,
172  };
173  TPMTokenState tpm_token_state_;
174
175  // The current request delay before the next attempt to initialize the
176  // TPM. Will be adapted after each attempt.
177  base::TimeDelta tpm_request_delay_;
178
179  // Cached TPM token info.
180  std::string tpm_token_name_;
181  int tpm_token_slot_id_;
182  std::string tpm_user_pin_;
183
184  // Cached Certificates.
185  net::CertificateList cert_list_;
186
187  base::ThreadChecker thread_checker_;
188
189  // TaskRunner for crypto calls.
190  scoped_refptr<base::SequencedTaskRunner> crypto_task_runner_;
191
192  // TaskRunner for other slow tasks. May be set in tests.
193  scoped_refptr<base::TaskRunner> slow_task_runner_for_test_;
194
195  // This factory should be used only for callbacks during TPMToken
196  // initialization.
197  base::WeakPtrFactory<CertLoader> initialize_token_factory_;
198
199  // This factory should be used only for callbacks during updating the
200  // certificate list.
201  base::WeakPtrFactory<CertLoader> update_certificates_factory_;
202
203  DISALLOW_COPY_AND_ASSIGN(CertLoader);
204};
205
206}  // namespace chromeos
207
208#endif  // CHROMEOS_CERT_LOADER_H_
209