cert_loader.h revision 558790d6acca3451cf3a6b497803a5f07d0bec58 
1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CHROMEOS_CERT_LOADER_H_
6#define CHROMEOS_CERT_LOADER_H_
7
8#include <string>
9
10#include "base/memory/ref_counted.h"
11#include "base/memory/scoped_ptr.h"
12#include "base/memory/weak_ptr.h"
13#include "base/observer_list_threadsafe.h"
14#include "base/threading/thread_checker.h"
15#include "chromeos/chromeos_export.h"
16#include "chromeos/dbus/dbus_method_call_status.h"
17#include "chromeos/login/login_state.h"
18#include "net/cert/cert_database.h"
19#include "net/cert/x509_certificate.h"
20
21namespace base {
22class SequencedTaskRunner;
23}
24
25namespace crypto {
26class SymmetricKey;
27}
28
29namespace chromeos {
30
31// This class is responsible for initializing the TPM token and loading
32// certificates once the TPM is initialized. It is expected to be constructed
33// on the UI thread and public methods should all be called from the UI thread.
34// When certificates have been loaded (after login completes), or the cert
35// database changes, observers are called with OnCertificatesLoaded().
36class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
37                                   public LoginState::Observer {
38 public:
39  class Observer {
40   public:
41    virtual ~Observer() {}
42
43    // Called when the certificates, passed for convenience as |cert_list|,
44    // have completed loading. |initial_load| is true the first time this
45    // is called.
46    virtual void OnCertificatesLoaded(const net::CertificateList& cert_list,
47                                      bool initial_load) = 0;
48
49   protected:
50    Observer() {}
51
52   private:
53    DISALLOW_COPY_AND_ASSIGN(Observer);
54  };
55
56  // Sets the global instance. Must be called before any calls to Get().
57  static void Initialize();
58
59  // Destroys the global instance.
60  static void Shutdown();
61
62  // Gets the global instance. Initialize() must be called first.
63  static CertLoader* Get();
64
65  // Returns true if the global instance has been initialized.
66  static bool IsInitialized();
67
68  // |crypto_task_runner| is the task runner that any synchronous crypto calls
69  // should be made from. e.g. in Chrome this is the IO thread. Must be called
70  // after the thread is started. Certificate loading will not happen unless
71  // this is set.
72  void SetCryptoTaskRunner(
73      const scoped_refptr<base::SequencedTaskRunner>& crypto_task_runner);
74
75  void AddObserver(CertLoader::Observer* observer);
76  void RemoveObserver(CertLoader::Observer* observer);
77
78  // Returns true when the certificate list has been requested but not loaded.
79  bool CertificatesLoading() const;
80
81  // Returns true if the TPM is available for hardware-backed certificates.
82  bool IsHardwareBacked() const;
83
84  std::string GetPkcs11IdForCert(const net::X509Certificate& cert) const;
85
86  bool certificates_loaded() const { return certificates_loaded_; }
87
88  // TPM info is only valid once the TPM is available (IsHardwareBacked is
89  // true). Otherwise empty strings will be returned.
90  const std::string& tpm_token_name() const { return tpm_token_name_; }
91  const std::string& tpm_token_slot() const { return tpm_token_slot_; }
92  const std::string& tpm_user_pin() const { return tpm_user_pin_; }
93
94  // This will be empty until certificates_loaded() is true.
95  const net::CertificateList& cert_list() const { return cert_list_; }
96
97 private:
98  CertLoader();
99  virtual ~CertLoader();
100
101  void Init();
102  void MaybeRequestCertificates();
103
104  // This is the cyclic chain of callbacks to initialize the TPM token and to
105  // kick off the update of the certificate list.
106  void InitializeTokenAndLoadCertificates();
107  void RetryTokenInitializationLater();
108  void OnPersistentNSSDBOpened();
109  void OnTpmIsEnabled(DBusMethodCallStatus call_status,
110                      bool tpm_is_enabled);
111  void OnPkcs11IsTpmTokenReady(DBusMethodCallStatus call_status,
112                               bool is_tpm_token_ready);
113  void OnPkcs11GetTpmTokenInfo(DBusMethodCallStatus call_status,
114                               const std::string& token_name,
115                               const std::string& user_pin);
116  void OnTPMTokenInitialized(bool success);
117
118  // These calls handle the updating of the certificate list after the TPM token
119  // was initialized.
120  void StartLoadCertificates();
121  void UpdateCertificates(net::CertificateList* cert_list);
122
123  void NotifyCertificatesLoaded(bool initial_load);
124
125  // net::CertDatabase::Observer
126  virtual void OnCertTrustChanged(const net::X509Certificate* cert) OVERRIDE;
127  virtual void OnCertAdded(const net::X509Certificate* cert) OVERRIDE;
128  virtual void OnCertRemoved(const net::X509Certificate* cert) OVERRIDE;
129
130  // LoginState::Observer
131  virtual void LoggedInStateChanged(LoginState::LoggedInState state) OVERRIDE;
132
133  ObserverList<Observer> observers_;
134
135  bool certificates_requested_;
136  bool certificates_loaded_;
137  bool certificates_update_required_;
138  bool certificates_update_running_;
139
140  // The states are traversed in this order but some might get omitted or never
141  // be left.
142  enum TPMTokenState {
143    TPM_STATE_UNKNOWN,
144    TPM_DB_OPENED,
145    TPM_DISABLED,
146    TPM_ENABLED,
147    TPM_TOKEN_READY,
148    TPM_TOKEN_INFO_RECEIVED,
149    TPM_TOKEN_INITIALIZED,
150  };
151  TPMTokenState tpm_token_state_;
152
153  // The current request delay before the next attempt to initialize the
154  // TPM. Will be adapted after each attempt.
155  base::TimeDelta tpm_request_delay_;
156
157  // Cached TPM token info.
158  std::string tpm_token_name_;
159  std::string tpm_token_slot_;
160  std::string tpm_user_pin_;
161
162  // Cached Certificates.
163  net::CertificateList cert_list_;
164
165  base::ThreadChecker thread_checker_;
166
167  // TaskRunner for crypto calls.
168  scoped_refptr<base::SequencedTaskRunner> crypto_task_runner_;
169
170  // This factory should be used only for callbacks during TPMToken
171  // initialization.
172  base::WeakPtrFactory<CertLoader> initialize_token_factory_;
173
174  // This factory should be used only for callbacks during updating the
175  // certificate list.
176  base::WeakPtrFactory<CertLoader> update_certificates_factory_;
177
178  DISALLOW_COPY_AND_ASSIGN(CertLoader);
179};
180
181}  // namespace chromeos
182
183#endif  // CHROMEOS_CERT_LOADER_H_
184