1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "chrome/browser/net/sqlite_server_bound_cert_store.h" 6 7#include <list> 8#include <set> 9 10#include "base/basictypes.h" 11#include "base/bind.h" 12#include "base/file_util.h" 13#include "base/files/file_path.h" 14#include "base/logging.h" 15#include "base/memory/scoped_ptr.h" 16#include "base/metrics/histogram.h" 17#include "base/strings/string_util.h" 18#include "base/threading/thread.h" 19#include "base/threading/thread_restrictions.h" 20#include "net/cert/x509_certificate.h" 21#include "net/cookies/cookie_util.h" 22#include "net/ssl/ssl_client_cert_type.h" 23#include "sql/error_delegate_util.h" 24#include "sql/meta_table.h" 25#include "sql/statement.h" 26#include "sql/transaction.h" 27#include "third_party/sqlite/sqlite3.h" 28#include "url/gurl.h" 29#include "webkit/browser/quota/special_storage_policy.h" 30 31// This class is designed to be shared between any calling threads and the 32// background task runner. It batches operations and commits them on a timer. 33class SQLiteServerBoundCertStore::Backend 34 : public base::RefCountedThreadSafe<SQLiteServerBoundCertStore::Backend> { 35 public: 36 Backend( 37 const base::FilePath& path, 38 const scoped_refptr<base::SequencedTaskRunner>& background_task_runner, 39 quota::SpecialStoragePolicy* special_storage_policy) 40 : path_(path), 41 num_pending_(0), 42 force_keep_session_state_(false), 43 background_task_runner_(background_task_runner), 44 special_storage_policy_(special_storage_policy), 45 corruption_detected_(false) {} 46 47 // Creates or loads the SQLite database. 48 void Load(const LoadedCallback& loaded_callback); 49 50 // Batch a server bound cert addition. 51 void AddServerBoundCert( 52 const net::DefaultServerBoundCertStore::ServerBoundCert& cert); 53 54 // Batch a server bound cert deletion. 55 void DeleteServerBoundCert( 56 const net::DefaultServerBoundCertStore::ServerBoundCert& cert); 57 58 // Commit any pending operations and close the database. This must be called 59 // before the object is destructed. 60 void Close(); 61 62 void SetForceKeepSessionState(); 63 64 private: 65 void LoadOnDBThread( 66 ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert>* certs); 67 68 friend class base::RefCountedThreadSafe<SQLiteServerBoundCertStore::Backend>; 69 70 // You should call Close() before destructing this object. 71 ~Backend() { 72 DCHECK(!db_.get()) << "Close should have already been called."; 73 DCHECK(num_pending_ == 0 && pending_.empty()); 74 } 75 76 // Database upgrade statements. 77 bool EnsureDatabaseVersion(); 78 79 class PendingOperation { 80 public: 81 typedef enum { 82 CERT_ADD, 83 CERT_DELETE 84 } OperationType; 85 86 PendingOperation( 87 OperationType op, 88 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) 89 : op_(op), cert_(cert) {} 90 91 OperationType op() const { return op_; } 92 const net::DefaultServerBoundCertStore::ServerBoundCert& cert() const { 93 return cert_; 94 } 95 96 private: 97 OperationType op_; 98 net::DefaultServerBoundCertStore::ServerBoundCert cert_; 99 }; 100 101 private: 102 // Batch a server bound cert operation (add or delete). 103 void BatchOperation( 104 PendingOperation::OperationType op, 105 const net::DefaultServerBoundCertStore::ServerBoundCert& cert); 106 // Commit our pending operations to the database. 107 void Commit(); 108 // Close() executed on the background thread. 109 void InternalBackgroundClose(); 110 111 void DeleteCertificatesOnShutdown(); 112 113 void DatabaseErrorCallback(int error, sql::Statement* stmt); 114 void KillDatabase(); 115 116 base::FilePath path_; 117 scoped_ptr<sql::Connection> db_; 118 sql::MetaTable meta_table_; 119 120 typedef std::list<PendingOperation*> PendingOperationsList; 121 PendingOperationsList pending_; 122 PendingOperationsList::size_type num_pending_; 123 // True if the persistent store should skip clear on exit rules. 124 bool force_keep_session_state_; 125 // Guard |pending_|, |num_pending_| and |force_keep_session_state_|. 126 base::Lock lock_; 127 128 // Cache of origins we have certificates stored for. 129 std::set<std::string> cert_origins_; 130 131 scoped_refptr<base::SequencedTaskRunner> background_task_runner_; 132 133 scoped_refptr<quota::SpecialStoragePolicy> special_storage_policy_; 134 135 // Indicates if the kill-database callback has been scheduled. 136 bool corruption_detected_; 137 138 DISALLOW_COPY_AND_ASSIGN(Backend); 139}; 140 141// Version number of the database. 142static const int kCurrentVersionNumber = 4; 143static const int kCompatibleVersionNumber = 1; 144 145namespace { 146 147// Initializes the certs table, returning true on success. 148bool InitTable(sql::Connection* db) { 149 // The table is named "origin_bound_certs" for backwards compatability before 150 // we renamed this class to SQLiteServerBoundCertStore. Likewise, the primary 151 // key is "origin", but now can be other things like a plain domain. 152 if (!db->DoesTableExist("origin_bound_certs")) { 153 if (!db->Execute("CREATE TABLE origin_bound_certs (" 154 "origin TEXT NOT NULL UNIQUE PRIMARY KEY," 155 "private_key BLOB NOT NULL," 156 "cert BLOB NOT NULL," 157 "cert_type INTEGER," 158 "expiration_time INTEGER," 159 "creation_time INTEGER)")) 160 return false; 161 } 162 163 return true; 164} 165 166} // namespace 167 168void SQLiteServerBoundCertStore::Backend::Load( 169 const LoadedCallback& loaded_callback) { 170 // This function should be called only once per instance. 171 DCHECK(!db_.get()); 172 scoped_ptr<ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> > 173 certs(new ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert>( 174 )); 175 ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert>* certs_ptr = 176 certs.get(); 177 178 background_task_runner_->PostTaskAndReply( 179 FROM_HERE, 180 base::Bind(&Backend::LoadOnDBThread, this, certs_ptr), 181 base::Bind(loaded_callback, base::Passed(&certs))); 182} 183 184void SQLiteServerBoundCertStore::Backend::LoadOnDBThread( 185 ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert>* certs) { 186 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 187 188 // This method should be called only once per instance. 189 DCHECK(!db_.get()); 190 191 base::TimeTicks start = base::TimeTicks::Now(); 192 193 // Ensure the parent directory for storing certs is created before reading 194 // from it. 195 const base::FilePath dir = path_.DirName(); 196 if (!base::PathExists(dir) && !base::CreateDirectory(dir)) 197 return; 198 199 int64 db_size = 0; 200 if (base::GetFileSize(path_, &db_size)) 201 UMA_HISTOGRAM_COUNTS("DomainBoundCerts.DBSizeInKB", db_size / 1024 ); 202 203 db_.reset(new sql::Connection); 204 db_->set_histogram_tag("DomainBoundCerts"); 205 206 // Unretained to avoid a ref loop with db_. 207 db_->set_error_callback( 208 base::Bind(&SQLiteServerBoundCertStore::Backend::DatabaseErrorCallback, 209 base::Unretained(this))); 210 211 if (!db_->Open(path_)) { 212 NOTREACHED() << "Unable to open cert DB."; 213 if (corruption_detected_) 214 KillDatabase(); 215 db_.reset(); 216 return; 217 } 218 219 if (!EnsureDatabaseVersion() || !InitTable(db_.get())) { 220 NOTREACHED() << "Unable to open cert DB."; 221 if (corruption_detected_) 222 KillDatabase(); 223 meta_table_.Reset(); 224 db_.reset(); 225 return; 226 } 227 228 db_->Preload(); 229 230 // Slurp all the certs into the out-vector. 231 sql::Statement smt(db_->GetUniqueStatement( 232 "SELECT origin, private_key, cert, cert_type, expiration_time, " 233 "creation_time FROM origin_bound_certs")); 234 if (!smt.is_valid()) { 235 if (corruption_detected_) 236 KillDatabase(); 237 meta_table_.Reset(); 238 db_.reset(); 239 return; 240 } 241 242 while (smt.Step()) { 243 net::SSLClientCertType type = 244 static_cast<net::SSLClientCertType>(smt.ColumnInt(3)); 245 if (type != net::CLIENT_CERT_ECDSA_SIGN) 246 continue; 247 std::string private_key_from_db, cert_from_db; 248 smt.ColumnBlobAsString(1, &private_key_from_db); 249 smt.ColumnBlobAsString(2, &cert_from_db); 250 scoped_ptr<net::DefaultServerBoundCertStore::ServerBoundCert> cert( 251 new net::DefaultServerBoundCertStore::ServerBoundCert( 252 smt.ColumnString(0), // origin 253 base::Time::FromInternalValue(smt.ColumnInt64(5)), 254 base::Time::FromInternalValue(smt.ColumnInt64(4)), 255 private_key_from_db, 256 cert_from_db)); 257 cert_origins_.insert(cert->server_identifier()); 258 certs->push_back(cert.release()); 259 } 260 261 UMA_HISTOGRAM_COUNTS_10000("DomainBoundCerts.DBLoadedCount", certs->size()); 262 base::TimeDelta load_time = base::TimeTicks::Now() - start; 263 UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.DBLoadTime", 264 load_time, 265 base::TimeDelta::FromMilliseconds(1), 266 base::TimeDelta::FromMinutes(1), 267 50); 268 DVLOG(1) << "loaded " << certs->size() << " in " << load_time.InMilliseconds() 269 << " ms"; 270} 271 272bool SQLiteServerBoundCertStore::Backend::EnsureDatabaseVersion() { 273 // Version check. 274 if (!meta_table_.Init( 275 db_.get(), kCurrentVersionNumber, kCompatibleVersionNumber)) { 276 return false; 277 } 278 279 if (meta_table_.GetCompatibleVersionNumber() > kCurrentVersionNumber) { 280 LOG(WARNING) << "Server bound cert database is too new."; 281 return false; 282 } 283 284 int cur_version = meta_table_.GetVersionNumber(); 285 if (cur_version == 1) { 286 sql::Transaction transaction(db_.get()); 287 if (!transaction.Begin()) 288 return false; 289 if (!db_->Execute("ALTER TABLE origin_bound_certs ADD COLUMN cert_type " 290 "INTEGER")) { 291 LOG(WARNING) << "Unable to update server bound cert database to " 292 << "version 2."; 293 return false; 294 } 295 // All certs in version 1 database are rsa_sign, which are unsupported. 296 // Just discard them all. 297 if (!db_->Execute("DELETE from origin_bound_certs")) { 298 LOG(WARNING) << "Unable to update server bound cert database to " 299 << "version 2."; 300 return false; 301 } 302 ++cur_version; 303 meta_table_.SetVersionNumber(cur_version); 304 meta_table_.SetCompatibleVersionNumber( 305 std::min(cur_version, kCompatibleVersionNumber)); 306 transaction.Commit(); 307 } 308 309 if (cur_version <= 3) { 310 sql::Transaction transaction(db_.get()); 311 if (!transaction.Begin()) 312 return false; 313 314 if (cur_version == 2) { 315 if (!db_->Execute("ALTER TABLE origin_bound_certs ADD COLUMN " 316 "expiration_time INTEGER")) { 317 LOG(WARNING) << "Unable to update server bound cert database to " 318 << "version 4."; 319 return false; 320 } 321 } 322 323 if (!db_->Execute("ALTER TABLE origin_bound_certs ADD COLUMN " 324 "creation_time INTEGER")) { 325 LOG(WARNING) << "Unable to update server bound cert database to " 326 << "version 4."; 327 return false; 328 } 329 330 sql::Statement smt(db_->GetUniqueStatement( 331 "SELECT origin, cert FROM origin_bound_certs")); 332 sql::Statement update_expires_smt(db_->GetUniqueStatement( 333 "UPDATE origin_bound_certs SET expiration_time = ? WHERE origin = ?")); 334 sql::Statement update_creation_smt(db_->GetUniqueStatement( 335 "UPDATE origin_bound_certs SET creation_time = ? WHERE origin = ?")); 336 if (!smt.is_valid() || 337 !update_expires_smt.is_valid() || 338 !update_creation_smt.is_valid()) { 339 LOG(WARNING) << "Unable to update server bound cert database to " 340 << "version 4."; 341 return false; 342 } 343 344 while (smt.Step()) { 345 std::string origin = smt.ColumnString(0); 346 std::string cert_from_db; 347 smt.ColumnBlobAsString(1, &cert_from_db); 348 // Parse the cert and extract the real value and then update the DB. 349 scoped_refptr<net::X509Certificate> cert( 350 net::X509Certificate::CreateFromBytes( 351 cert_from_db.data(), cert_from_db.size())); 352 if (cert.get()) { 353 if (cur_version == 2) { 354 update_expires_smt.Reset(true); 355 update_expires_smt.BindInt64(0, 356 cert->valid_expiry().ToInternalValue()); 357 update_expires_smt.BindString(1, origin); 358 if (!update_expires_smt.Run()) { 359 LOG(WARNING) << "Unable to update server bound cert database to " 360 << "version 4."; 361 return false; 362 } 363 } 364 365 update_creation_smt.Reset(true); 366 update_creation_smt.BindInt64(0, cert->valid_start().ToInternalValue()); 367 update_creation_smt.BindString(1, origin); 368 if (!update_creation_smt.Run()) { 369 LOG(WARNING) << "Unable to update server bound cert database to " 370 << "version 4."; 371 return false; 372 } 373 } else { 374 // If there's a cert we can't parse, just leave it. It'll get replaced 375 // with a new one if we ever try to use it. 376 LOG(WARNING) << "Error parsing cert for database upgrade for origin " 377 << smt.ColumnString(0); 378 } 379 } 380 381 cur_version = 4; 382 meta_table_.SetVersionNumber(cur_version); 383 meta_table_.SetCompatibleVersionNumber( 384 std::min(cur_version, kCompatibleVersionNumber)); 385 transaction.Commit(); 386 } 387 388 // Put future migration cases here. 389 390 // When the version is too old, we just try to continue anyway, there should 391 // not be a released product that makes a database too old for us to handle. 392 LOG_IF(WARNING, cur_version < kCurrentVersionNumber) << 393 "Server bound cert database version " << cur_version << 394 " is too old to handle."; 395 396 return true; 397} 398 399void SQLiteServerBoundCertStore::Backend::DatabaseErrorCallback( 400 int error, 401 sql::Statement* stmt) { 402 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 403 404 if (!sql::IsErrorCatastrophic(error)) 405 return; 406 407 // TODO(shess): Running KillDatabase() multiple times should be 408 // safe. 409 if (corruption_detected_) 410 return; 411 412 corruption_detected_ = true; 413 414 // TODO(shess): Consider just calling RazeAndClose() immediately. 415 // db_ may not be safe to reset at this point, but RazeAndClose() 416 // would cause the stack to unwind safely with errors. 417 background_task_runner_->PostTask(FROM_HERE, 418 base::Bind(&Backend::KillDatabase, this)); 419} 420 421void SQLiteServerBoundCertStore::Backend::KillDatabase() { 422 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 423 424 if (db_) { 425 // This Backend will now be in-memory only. In a future run the database 426 // will be recreated. Hopefully things go better then! 427 bool success = db_->RazeAndClose(); 428 UMA_HISTOGRAM_BOOLEAN("DomainBoundCerts.KillDatabaseResult", success); 429 meta_table_.Reset(); 430 db_.reset(); 431 } 432} 433 434void SQLiteServerBoundCertStore::Backend::AddServerBoundCert( 435 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) { 436 BatchOperation(PendingOperation::CERT_ADD, cert); 437} 438 439void SQLiteServerBoundCertStore::Backend::DeleteServerBoundCert( 440 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) { 441 BatchOperation(PendingOperation::CERT_DELETE, cert); 442} 443 444void SQLiteServerBoundCertStore::Backend::BatchOperation( 445 PendingOperation::OperationType op, 446 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) { 447 // Commit every 30 seconds. 448 static const int kCommitIntervalMs = 30 * 1000; 449 // Commit right away if we have more than 512 outstanding operations. 450 static const size_t kCommitAfterBatchSize = 512; 451 452 // We do a full copy of the cert here, and hopefully just here. 453 scoped_ptr<PendingOperation> po(new PendingOperation(op, cert)); 454 455 PendingOperationsList::size_type num_pending; 456 { 457 base::AutoLock locked(lock_); 458 pending_.push_back(po.release()); 459 num_pending = ++num_pending_; 460 } 461 462 if (num_pending == 1) { 463 // We've gotten our first entry for this batch, fire off the timer. 464 background_task_runner_->PostDelayedTask( 465 FROM_HERE, 466 base::Bind(&Backend::Commit, this), 467 base::TimeDelta::FromMilliseconds(kCommitIntervalMs)); 468 } else if (num_pending == kCommitAfterBatchSize) { 469 // We've reached a big enough batch, fire off a commit now. 470 background_task_runner_->PostTask(FROM_HERE, 471 base::Bind(&Backend::Commit, this)); 472 } 473} 474 475void SQLiteServerBoundCertStore::Backend::Commit() { 476 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 477 478 PendingOperationsList ops; 479 { 480 base::AutoLock locked(lock_); 481 pending_.swap(ops); 482 num_pending_ = 0; 483 } 484 485 // Maybe an old timer fired or we are already Close()'ed. 486 if (!db_.get() || ops.empty()) 487 return; 488 489 sql::Statement add_smt(db_->GetCachedStatement(SQL_FROM_HERE, 490 "INSERT INTO origin_bound_certs (origin, private_key, cert, cert_type, " 491 "expiration_time, creation_time) VALUES (?,?,?,?,?,?)")); 492 if (!add_smt.is_valid()) 493 return; 494 495 sql::Statement del_smt(db_->GetCachedStatement(SQL_FROM_HERE, 496 "DELETE FROM origin_bound_certs WHERE origin=?")); 497 if (!del_smt.is_valid()) 498 return; 499 500 sql::Transaction transaction(db_.get()); 501 if (!transaction.Begin()) 502 return; 503 504 for (PendingOperationsList::iterator it = ops.begin(); 505 it != ops.end(); ++it) { 506 // Free the certs as we commit them to the database. 507 scoped_ptr<PendingOperation> po(*it); 508 switch (po->op()) { 509 case PendingOperation::CERT_ADD: { 510 cert_origins_.insert(po->cert().server_identifier()); 511 add_smt.Reset(true); 512 add_smt.BindString(0, po->cert().server_identifier()); 513 const std::string& private_key = po->cert().private_key(); 514 add_smt.BindBlob(1, private_key.data(), private_key.size()); 515 const std::string& cert = po->cert().cert(); 516 add_smt.BindBlob(2, cert.data(), cert.size()); 517 add_smt.BindInt(3, net::CLIENT_CERT_ECDSA_SIGN); 518 add_smt.BindInt64(4, po->cert().expiration_time().ToInternalValue()); 519 add_smt.BindInt64(5, po->cert().creation_time().ToInternalValue()); 520 if (!add_smt.Run()) 521 NOTREACHED() << "Could not add a server bound cert to the DB."; 522 break; 523 } 524 case PendingOperation::CERT_DELETE: 525 cert_origins_.erase(po->cert().server_identifier()); 526 del_smt.Reset(true); 527 del_smt.BindString(0, po->cert().server_identifier()); 528 if (!del_smt.Run()) 529 NOTREACHED() << "Could not delete a server bound cert from the DB."; 530 break; 531 532 default: 533 NOTREACHED(); 534 break; 535 } 536 } 537 transaction.Commit(); 538} 539 540// Fire off a close message to the background thread. We could still have a 541// pending commit timer that will be holding a reference on us, but if/when 542// this fires we will already have been cleaned up and it will be ignored. 543void SQLiteServerBoundCertStore::Backend::Close() { 544 // Must close the backend on the background thread. 545 background_task_runner_->PostTask( 546 FROM_HERE, base::Bind(&Backend::InternalBackgroundClose, this)); 547} 548 549void SQLiteServerBoundCertStore::Backend::InternalBackgroundClose() { 550 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 551 // Commit any pending operations 552 Commit(); 553 554 if (!force_keep_session_state_ && 555 special_storage_policy_.get() && 556 special_storage_policy_->HasSessionOnlyOrigins()) { 557 DeleteCertificatesOnShutdown(); 558 } 559 560 db_.reset(); 561} 562 563void SQLiteServerBoundCertStore::Backend::DeleteCertificatesOnShutdown() { 564 DCHECK(background_task_runner_->RunsTasksOnCurrentThread()); 565 566 if (!db_.get()) 567 return; 568 569 if (cert_origins_.empty()) 570 return; 571 572 if (!special_storage_policy_.get()) 573 return; 574 575 sql::Statement del_smt(db_->GetCachedStatement( 576 SQL_FROM_HERE, "DELETE FROM origin_bound_certs WHERE origin=?")); 577 if (!del_smt.is_valid()) { 578 LOG(WARNING) << "Unable to delete certificates on shutdown."; 579 return; 580 } 581 582 sql::Transaction transaction(db_.get()); 583 if (!transaction.Begin()) { 584 LOG(WARNING) << "Unable to delete certificates on shutdown."; 585 return; 586 } 587 588 for (std::set<std::string>::iterator it = cert_origins_.begin(); 589 it != cert_origins_.end(); ++it) { 590 const GURL url(net::cookie_util::CookieOriginToURL(*it, true)); 591 if (!url.is_valid() || !special_storage_policy_->IsStorageSessionOnly(url)) 592 continue; 593 del_smt.Reset(true); 594 del_smt.BindString(0, *it); 595 if (!del_smt.Run()) 596 NOTREACHED() << "Could not delete a certificate from the DB."; 597 } 598 599 if (!transaction.Commit()) 600 LOG(WARNING) << "Unable to delete certificates on shutdown."; 601} 602 603void SQLiteServerBoundCertStore::Backend::SetForceKeepSessionState() { 604 base::AutoLock locked(lock_); 605 force_keep_session_state_ = true; 606} 607 608SQLiteServerBoundCertStore::SQLiteServerBoundCertStore( 609 const base::FilePath& path, 610 const scoped_refptr<base::SequencedTaskRunner>& background_task_runner, 611 quota::SpecialStoragePolicy* special_storage_policy) 612 : backend_(new Backend(path, 613 background_task_runner, 614 special_storage_policy)) {} 615 616void SQLiteServerBoundCertStore::Load( 617 const LoadedCallback& loaded_callback) { 618 backend_->Load(loaded_callback); 619} 620 621void SQLiteServerBoundCertStore::AddServerBoundCert( 622 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) { 623 backend_->AddServerBoundCert(cert); 624} 625 626void SQLiteServerBoundCertStore::DeleteServerBoundCert( 627 const net::DefaultServerBoundCertStore::ServerBoundCert& cert) { 628 backend_->DeleteServerBoundCert(cert); 629} 630 631void SQLiteServerBoundCertStore::SetForceKeepSessionState() { 632 backend_->SetForceKeepSessionState(); 633} 634 635SQLiteServerBoundCertStore::~SQLiteServerBoundCertStore() { 636 backend_->Close(); 637 // We release our reference to the Backend, though it will probably still have 638 // a reference if the background thread has not run Close() yet. 639} 640