refactor: move certificate_manager_model to shell (#31631)
This commit is contained in:
Milan Burda
GitHub
parent
95a867b795
commit
97eb424450
6 changed files with 8 additions and 13 deletions
|
|
@ -30,7 +30,7 @@
|
|||
#include "shell/common/gin_helper/promise.h"
|
||||
|
||||
#if defined(USE_NSS_CERTS)
|
||||
#include "chrome/browser/certificate_manager_model.h"
|
||||
#include "shell/browser/certificate_manager_model.h"
|
||||
#endif
|
||||
|
||||
namespace base {
|
||||
|
|
|
|||
170
shell/browser/certificate_manager_model.cc
Normal file
170
shell/browser/certificate_manager_model.cc
Normal file
|
|
@ -0,0 +1,170 @@
|
|||
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
#include "shell/browser/certificate_manager_model.h"
|
||||
|
||||
#include <utility>
|
||||
|
||||
#include "base/bind.h"
|
||||
#include "base/logging.h"
|
||||
#include "base/strings/utf_string_conversions.h"
|
||||
#include "base/task/post_task.h"
|
||||
#include "content/public/browser/browser_context.h"
|
||||
#include "content/public/browser/browser_task_traits.h"
|
||||
#include "content/public/browser/browser_thread.h"
|
||||
#include "content/public/browser/resource_context.h"
|
||||
#include "crypto/nss_util.h"
|
||||
#include "crypto/nss_util_internal.h"
|
||||
#include "net/base/net_errors.h"
|
||||
#include "net/cert/nss_cert_database.h"
|
||||
#include "net/cert/x509_certificate.h"
|
||||
|
||||
using content::BrowserThread;
|
||||
|
||||
namespace {
|
||||
|
||||
net::NSSCertDatabase* g_nss_cert_database = nullptr;
|
||||
|
||||
net::NSSCertDatabase* GetNSSCertDatabaseForResourceContext(
|
||||
content::ResourceContext* context,
|
||||
base::OnceCallback<void(net::NSSCertDatabase*)> callback) {
|
||||
// This initialization is not thread safe. This CHECK ensures that this code
|
||||
// is only run on a single thread.
|
||||
CHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
|
||||
if (!g_nss_cert_database) {
|
||||
// Linux has only a single persistent slot compared to ChromeOS's separate
|
||||
// public and private slot.
|
||||
// Redirect any slot usage to this persistent slot on Linux.
|
||||
crypto::EnsureNSSInit();
|
||||
g_nss_cert_database = new net::NSSCertDatabase(
|
||||
crypto::ScopedPK11Slot(PK11_GetInternalKeySlot()) /* public slot */,
|
||||
crypto::ScopedPK11Slot(PK11_GetInternalKeySlot()) /* private slot */);
|
||||
}
|
||||
return g_nss_cert_database;
|
||||
}
|
||||
|
||||
} // namespace
|
||||
|
||||
// CertificateManagerModel is created on the UI thread. It needs a
|
||||
// NSSCertDatabase handle (and on ChromeOS it needs to get the TPM status) which
|
||||
// needs to be done on the IO thread.
|
||||
//
|
||||
// The initialization flow is roughly:
|
||||
//
|
||||
// UI thread IO Thread
|
||||
//
|
||||
// CertificateManagerModel::Create
|
||||
// \--------------------------------------v
|
||||
// CertificateManagerModel::GetCertDBOnIOThread
|
||||
// |
|
||||
// GetNSSCertDatabaseForResourceContext
|
||||
// |
|
||||
// CertificateManagerModel::DidGetCertDBOnIOThread
|
||||
// v--------------------------------------/
|
||||
// CertificateManagerModel::DidGetCertDBOnUIThread
|
||||
// |
|
||||
// new CertificateManagerModel
|
||||
// |
|
||||
// callback
|
||||
|
||||
// static
|
||||
void CertificateManagerModel::Create(content::BrowserContext* browser_context,
|
||||
CreationCallback callback) {
|
||||
DCHECK_CURRENTLY_ON(BrowserThread::UI);
|
||||
base::PostTask(FROM_HERE, {BrowserThread::IO},
|
||||
base::BindOnce(&CertificateManagerModel::GetCertDBOnIOThread,
|
||||
browser_context->GetResourceContext(),
|
||||
std::move(callback)));
|
||||
}
|
||||
|
||||
CertificateManagerModel::CertificateManagerModel(
|
||||
net::NSSCertDatabase* nss_cert_database,
|
||||
bool is_user_db_available)
|
||||
: cert_db_(nss_cert_database), is_user_db_available_(is_user_db_available) {
|
||||
DCHECK_CURRENTLY_ON(BrowserThread::UI);
|
||||
}
|
||||
|
||||
CertificateManagerModel::~CertificateManagerModel() = default;
|
||||
|
||||
int CertificateManagerModel::ImportFromPKCS12(
|
||||
PK11SlotInfo* slot_info,
|
||||
const std::string& data,
|
||||
const std::u16string& password,
|
||||
bool is_extractable,
|
||||
net::ScopedCERTCertificateList* imported_certs) {
|
||||
return cert_db_->ImportFromPKCS12(slot_info, data, password, is_extractable,
|
||||
imported_certs);
|
||||
}
|
||||
|
||||
int CertificateManagerModel::ImportUserCert(const std::string& data) {
|
||||
return cert_db_->ImportUserCert(data);
|
||||
}
|
||||
|
||||
bool CertificateManagerModel::ImportCACerts(
|
||||
const net::ScopedCERTCertificateList& certificates,
|
||||
net::NSSCertDatabase::TrustBits trust_bits,
|
||||
net::NSSCertDatabase::ImportCertFailureList* not_imported) {
|
||||
return cert_db_->ImportCACerts(certificates, trust_bits, not_imported);
|
||||
}
|
||||
|
||||
bool CertificateManagerModel::ImportServerCert(
|
||||
const net::ScopedCERTCertificateList& certificates,
|
||||
net::NSSCertDatabase::TrustBits trust_bits,
|
||||
net::NSSCertDatabase::ImportCertFailureList* not_imported) {
|
||||
return cert_db_->ImportServerCert(certificates, trust_bits, not_imported);
|
||||
}
|
||||
|
||||
bool CertificateManagerModel::SetCertTrust(
|
||||
CERTCertificate* cert,
|
||||
net::CertType type,
|
||||
net::NSSCertDatabase::TrustBits trust_bits) {
|
||||
return cert_db_->SetCertTrust(cert, type, trust_bits);
|
||||
}
|
||||
|
||||
bool CertificateManagerModel::Delete(CERTCertificate* cert) {
|
||||
return cert_db_->DeleteCertAndKey(cert);
|
||||
}
|
||||
|
||||
// static
|
||||
void CertificateManagerModel::DidGetCertDBOnUIThread(
|
||||
net::NSSCertDatabase* cert_db,
|
||||
bool is_user_db_available,
|
||||
CreationCallback callback) {
|
||||
DCHECK_CURRENTLY_ON(BrowserThread::UI);
|
||||
|
||||
auto model = base::WrapUnique(
|
||||
new CertificateManagerModel(cert_db, is_user_db_available));
|
||||
std::move(callback).Run(std::move(model));
|
||||
}
|
||||
|
||||
// static
|
||||
void CertificateManagerModel::DidGetCertDBOnIOThread(
|
||||
CreationCallback callback,
|
||||
net::NSSCertDatabase* cert_db) {
|
||||
DCHECK_CURRENTLY_ON(BrowserThread::IO);
|
||||
|
||||
bool is_user_db_available = !!cert_db->GetPublicSlot();
|
||||
base::PostTask(
|
||||
FROM_HERE, {BrowserThread::UI},
|
||||
base::BindOnce(&CertificateManagerModel::DidGetCertDBOnUIThread, cert_db,
|
||||
is_user_db_available, std::move(callback)));
|
||||
}
|
||||
|
||||
// static
|
||||
void CertificateManagerModel::GetCertDBOnIOThread(
|
||||
content::ResourceContext* context,
|
||||
CreationCallback callback) {
|
||||
DCHECK_CURRENTLY_ON(BrowserThread::IO);
|
||||
|
||||
auto split_callback = base::SplitOnceCallback(base::BindOnce(
|
||||
&CertificateManagerModel::DidGetCertDBOnIOThread, std::move(callback)));
|
||||
|
||||
net::NSSCertDatabase* cert_db = GetNSSCertDatabaseForResourceContext(
|
||||
context, std::move(split_callback.first));
|
||||
|
||||
// If the NSS database was already available, |cert_db| is non-null and
|
||||
// |did_get_cert_db_callback| has not been called. Call it explicitly.
|
||||
if (cert_db)
|
||||
std::move(split_callback.second).Run(cert_db);
|
||||
}
|
||||
116
shell/browser/certificate_manager_model.h
Normal file
116
shell/browser/certificate_manager_model.h
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
#ifndef SHELL_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
|
||||
#define SHELL_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
|
||||
|
||||
#include <memory>
|
||||
#include <string>
|
||||
|
||||
#include "base/callback.h"
|
||||
#include "base/memory/ref_counted.h"
|
||||
#include "net/cert/nss_cert_database.h"
|
||||
|
||||
namespace content {
|
||||
class BrowserContext;
|
||||
class ResourceContext;
|
||||
} // namespace content
|
||||
|
||||
// CertificateManagerModel provides the data to be displayed in the certificate
|
||||
// manager dialog, and processes changes from the view.
|
||||
class CertificateManagerModel {
|
||||
public:
|
||||
using CreationCallback =
|
||||
base::OnceCallback<void(std::unique_ptr<CertificateManagerModel>)>;
|
||||
|
||||
// Creates a CertificateManagerModel. The model will be passed to the callback
|
||||
// when it is ready. The caller must ensure the model does not outlive the
|
||||
// |browser_context|.
|
||||
static void Create(content::BrowserContext* browser_context,
|
||||
CreationCallback callback);
|
||||
|
||||
// disable copy
|
||||
CertificateManagerModel(const CertificateManagerModel&) = delete;
|
||||
CertificateManagerModel& operator=(const CertificateManagerModel&) = delete;
|
||||
|
||||
~CertificateManagerModel();
|
||||
|
||||
bool is_user_db_available() const { return is_user_db_available_; }
|
||||
|
||||
// Accessor for read-only access to the underlying NSSCertDatabase.
|
||||
const net::NSSCertDatabase* cert_db() const { return cert_db_; }
|
||||
|
||||
// Import private keys and certificates from PKCS #12 encoded
|
||||
// |data|, using the given |password|. If |is_extractable| is false,
|
||||
// mark the private key as unextractable from the module.
|
||||
// Returns a net error code on failure.
|
||||
int ImportFromPKCS12(PK11SlotInfo* slot_info,
|
||||
const std::string& data,
|
||||
const std::u16string& password,
|
||||
bool is_extractable,
|
||||
net::ScopedCERTCertificateList* imported_certs);
|
||||
|
||||
// Import user certificate from DER encoded |data|.
|
||||
// Returns a net error code on failure.
|
||||
int ImportUserCert(const std::string& data);
|
||||
|
||||
// Import CA certificates.
|
||||
// Tries to import all the certificates given. The root will be trusted
|
||||
// according to |trust_bits|. Any certificates that could not be imported
|
||||
// will be listed in |not_imported|.
|
||||
// |trust_bits| should be a bit field of TRUST* values from NSSCertDatabase.
|
||||
// Returns false if there is an internal error, otherwise true is returned and
|
||||
// |not_imported| should be checked for any certificates that were not
|
||||
// imported.
|
||||
bool ImportCACerts(const net::ScopedCERTCertificateList& certificates,
|
||||
net::NSSCertDatabase::TrustBits trust_bits,
|
||||
net::NSSCertDatabase::ImportCertFailureList* not_imported);
|
||||
|
||||
// Import server certificate. The first cert should be the server cert. Any
|
||||
// additional certs should be intermediate/CA certs and will be imported but
|
||||
// not given any trust.
|
||||
// Any certificates that could not be imported will be listed in
|
||||
// |not_imported|.
|
||||
// |trust_bits| can be set to explicitly trust or distrust the certificate, or
|
||||
// use TRUST_DEFAULT to inherit trust as normal.
|
||||
// Returns false if there is an internal error, otherwise true is returned and
|
||||
// |not_imported| should be checked for any certificates that were not
|
||||
// imported.
|
||||
bool ImportServerCert(
|
||||
const net::ScopedCERTCertificateList& certificates,
|
||||
net::NSSCertDatabase::TrustBits trust_bits,
|
||||
net::NSSCertDatabase::ImportCertFailureList* not_imported);
|
||||
|
||||
// Set trust values for certificate.
|
||||
// |trust_bits| should be a bit field of TRUST* values from NSSCertDatabase.
|
||||
// Returns true on success or false on failure.
|
||||
bool SetCertTrust(CERTCertificate* cert,
|
||||
net::CertType type,
|
||||
net::NSSCertDatabase::TrustBits trust_bits);
|
||||
|
||||
// Delete the cert. Returns true on success. |cert| is still valid when this
|
||||
// function returns.
|
||||
bool Delete(CERTCertificate* cert);
|
||||
|
||||
private:
|
||||
CertificateManagerModel(net::NSSCertDatabase* nss_cert_database,
|
||||
bool is_user_db_available);
|
||||
|
||||
// Methods used during initialization, see the comment at the top of the .cc
|
||||
// file for details.
|
||||
static void DidGetCertDBOnUIThread(net::NSSCertDatabase* cert_db,
|
||||
bool is_user_db_available,
|
||||
CreationCallback callback);
|
||||
static void DidGetCertDBOnIOThread(CreationCallback callback,
|
||||
net::NSSCertDatabase* cert_db);
|
||||
static void GetCertDBOnIOThread(content::ResourceContext* context,
|
||||
CreationCallback callback);
|
||||
|
||||
net::NSSCertDatabase* cert_db_;
|
||||
// Whether the certificate database has a public slot associated with the
|
||||
// profile. If not set, importing certificates is not allowed with this model.
|
||||
bool is_user_db_available_;
|
||||
};
|
||||
|
||||
#endif // SHELL_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
|
||||
Loading…
Add table
Add a link
Reference in a new issue