client_cert_store_nss.cc 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/client_cert_store_nss.h"
  5. #include <nss.h>
  6. #include <ssl.h>
  7. #include <algorithm>
  8. #include <memory>
  9. #include <utility>
  10. #include <vector>
  11. #include "base/bind.h"
  12. #include "base/callback_helpers.h"
  13. #include "base/location.h"
  14. #include "base/logging.h"
  15. #include "base/strings/string_piece.h"
  16. #include "base/task/thread_pool.h"
  17. #include "base/threading/scoped_blocking_call.h"
  18. #include "crypto/nss_crypto_module_delegate.h"
  19. #include "crypto/nss_util.h"
  20. #include "net/cert/scoped_nss_types.h"
  21. #include "net/cert/x509_util_nss.h"
  22. #include "net/ssl/ssl_cert_request_info.h"
  23. #include "net/ssl/ssl_platform_key_nss.h"
  24. #include "net/ssl/threaded_ssl_private_key.h"
  25. #include "net/third_party/nss/ssl/cmpcert.h"
  26. #include "third_party/boringssl/src/include/openssl/pool.h"
  27. namespace net {
  28. namespace {
  29. class ClientCertIdentityNSS : public ClientCertIdentity {
  30. public:
  31. ClientCertIdentityNSS(
  32. scoped_refptr<net::X509Certificate> cert,
  33. ScopedCERTCertificate cert_certificate,
  34. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  35. password_delegate)
  36. : ClientCertIdentity(std::move(cert)),
  37. cert_certificate_(std::move(cert_certificate)),
  38. password_delegate_(std::move(password_delegate)) {}
  39. ~ClientCertIdentityNSS() override = default;
  40. void AcquirePrivateKey(base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
  41. private_key_callback) override {
  42. // Caller is responsible for keeping the ClientCertIdentity alive until
  43. // the |private_key_callback| is run, so it's safe to use Unretained here.
  44. base::ThreadPool::PostTaskAndReplyWithResult(
  45. FROM_HERE,
  46. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  47. base::BindOnce(&FetchClientCertPrivateKey,
  48. base::Unretained(certificate()), cert_certificate_.get(),
  49. password_delegate_),
  50. std::move(private_key_callback));
  51. }
  52. private:
  53. ScopedCERTCertificate cert_certificate_;
  54. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  55. password_delegate_;
  56. };
  57. } // namespace
  58. ClientCertStoreNSS::ClientCertStoreNSS(
  59. const PasswordDelegateFactory& password_delegate_factory)
  60. : password_delegate_factory_(password_delegate_factory) {}
  61. ClientCertStoreNSS::~ClientCertStoreNSS() = default;
  62. void ClientCertStoreNSS::GetClientCerts(const SSLCertRequestInfo& request,
  63. ClientCertListCallback callback) {
  64. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate> password_delegate;
  65. if (!password_delegate_factory_.is_null())
  66. password_delegate = password_delegate_factory_.Run(request.host_and_port);
  67. base::ThreadPool::PostTaskAndReplyWithResult(
  68. FROM_HERE,
  69. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  70. base::BindOnce(&ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread,
  71. // Caller is responsible for keeping the ClientCertStore
  72. // alive until the callback is run.
  73. base::Unretained(this), std::move(password_delegate),
  74. base::Unretained(&request)),
  75. std::move(callback));
  76. }
  77. // static
  78. void ClientCertStoreNSS::FilterCertsOnWorkerThread(
  79. ClientCertIdentityList* identities,
  80. const SSLCertRequestInfo& request) {
  81. size_t num_raw = 0;
  82. auto keep_iter = identities->begin();
  83. base::Time now = base::Time::Now();
  84. for (auto examine_iter = identities->begin();
  85. examine_iter != identities->end(); ++examine_iter) {
  86. ++num_raw;
  87. X509Certificate* cert = (*examine_iter)->certificate();
  88. // Only offer unexpired certificates.
  89. if (now < cert->valid_start() || now > cert->valid_expiry()) {
  90. continue;
  91. }
  92. ScopedCERTCertificateList nss_intermediates;
  93. if (!MatchClientCertificateIssuers(cert, request.cert_authorities,
  94. &nss_intermediates)) {
  95. continue;
  96. }
  97. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  98. intermediates.reserve(nss_intermediates.size());
  99. for (const ScopedCERTCertificate& nss_intermediate : nss_intermediates) {
  100. bssl::UniquePtr<CRYPTO_BUFFER> intermediate_cert_handle(
  101. X509Certificate::CreateCertBufferFromBytes(base::make_span(
  102. nss_intermediate->derCert.data, nss_intermediate->derCert.len)));
  103. if (!intermediate_cert_handle)
  104. break;
  105. intermediates.push_back(std::move(intermediate_cert_handle));
  106. }
  107. // Retain a copy of the intermediates. Some deployments expect the client to
  108. // supply intermediates out of the local store. See
  109. // https://crbug.com/548631.
  110. (*examine_iter)->SetIntermediates(std::move(intermediates));
  111. if (examine_iter == keep_iter)
  112. ++keep_iter;
  113. else
  114. *keep_iter++ = std::move(*examine_iter);
  115. }
  116. identities->erase(keep_iter, identities->end());
  117. DVLOG(2) << "num_raw:" << num_raw << " num_filtered:" << identities->size();
  118. std::sort(identities->begin(), identities->end(), ClientCertIdentitySorter());
  119. }
  120. ClientCertIdentityList ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread(
  121. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  122. password_delegate,
  123. const SSLCertRequestInfo* request) {
  124. // This method may acquire the NSS lock or reenter this code via extension
  125. // hooks (such as smart card UI). To ensure threads are not starved or
  126. // deadlocked, the base::ScopedBlockingCall below increments the thread pool
  127. // capacity if this method takes too much time to run.
  128. base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
  129. base::BlockingType::MAY_BLOCK);
  130. ClientCertIdentityList selected_identities;
  131. GetPlatformCertsOnWorkerThread(std::move(password_delegate), CertFilter(),
  132. &selected_identities);
  133. FilterCertsOnWorkerThread(&selected_identities, *request);
  134. return selected_identities;
  135. }
  136. // static
  137. void ClientCertStoreNSS::GetPlatformCertsOnWorkerThread(
  138. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  139. password_delegate,
  140. const CertFilter& cert_filter,
  141. ClientCertIdentityList* identities) {
  142. crypto::EnsureNSSInit();
  143. CERTCertList* found_certs = CERT_FindUserCertsByUsage(
  144. CERT_GetDefaultCertDB(), certUsageSSLClient, PR_FALSE, PR_FALSE,
  145. password_delegate ? password_delegate->wincx() : nullptr);
  146. if (!found_certs) {
  147. DVLOG(2) << "No client certs found.";
  148. return;
  149. }
  150. for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs);
  151. !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) {
  152. if (!cert_filter.is_null() && !cert_filter.Run(node->cert))
  153. continue;
  154. // Allow UTF-8 inside PrintableStrings in client certificates. See
  155. // crbug.com/770323.
  156. X509Certificate::UnsafeCreateOptions options;
  157. options.printable_string_is_utf8 = true;
  158. scoped_refptr<X509Certificate> cert =
  159. x509_util::CreateX509CertificateFromCERTCertificate(node->cert, {},
  160. options);
  161. if (!cert) {
  162. DVLOG(2) << "x509_util::CreateX509CertificateFromCERTCertificate failed";
  163. continue;
  164. }
  165. identities->push_back(std::make_unique<ClientCertIdentityNSS>(
  166. cert, x509_util::DupCERTCertificate(node->cert), password_delegate));
  167. }
  168. CERT_DestroyCertList(found_certs);
  169. }
  170. } // namespace net