client_cert_store_nss.h 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SSL_CLIENT_CERT_STORE_NSS_H_
  5. #define NET_SSL_CLIENT_CERT_STORE_NSS_H_
  6. #include "base/callback.h"
  7. #include "net/base/net_export.h"
  8. #include "net/ssl/client_cert_store.h"
  9. typedef struct CERTCertListStr CERTCertList;
  10. typedef struct CERTCertificateStr CERTCertificate;
  11. namespace crypto {
  12. class CryptoModuleBlockingPasswordDelegate;
  13. }
  14. namespace net {
  15. class HostPortPair;
  16. class SSLCertRequestInfo;
  17. class NET_EXPORT ClientCertStoreNSS : public ClientCertStore {
  18. public:
  19. using PasswordDelegateFactory =
  20. base::RepeatingCallback<crypto::CryptoModuleBlockingPasswordDelegate*(
  21. const HostPortPair& /* server */)>;
  22. using CertFilter = base::RepeatingCallback<bool(CERTCertificate*)>;
  23. explicit ClientCertStoreNSS(
  24. const PasswordDelegateFactory& password_delegate_factory);
  25. ClientCertStoreNSS(const ClientCertStoreNSS&) = delete;
  26. ClientCertStoreNSS& operator=(const ClientCertStoreNSS&) = delete;
  27. ~ClientCertStoreNSS() override;
  28. // ClientCertStore:
  29. void GetClientCerts(const SSLCertRequestInfo& cert_request_info,
  30. ClientCertListCallback callback) override;
  31. // Examines the certificates in |identities| to find all certificates that
  32. // match the client certificate request in |request|, removing any that don't.
  33. // The remaining certs will be updated to include intermediates.
  34. // Must be called from a worker thread.
  35. static void FilterCertsOnWorkerThread(ClientCertIdentityList* identities,
  36. const SSLCertRequestInfo& request);
  37. // Retrieves all client certificates that are stored by NSS and adds them to
  38. // |identities|. |password_delegate| is used to unlock slots if required. If
  39. // |cert_filter| is not null, only certificates that it returns true on will
  40. // be added.
  41. // Must be called from a worker thread.
  42. static void GetPlatformCertsOnWorkerThread(
  43. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  44. password_delegate,
  45. const CertFilter& cert_filter,
  46. ClientCertIdentityList* identities);
  47. private:
  48. ClientCertIdentityList GetAndFilterCertsOnWorkerThread(
  49. scoped_refptr<crypto::CryptoModuleBlockingPasswordDelegate>
  50. password_delegate,
  51. const SSLCertRequestInfo* request);
  52. // The factory for creating the delegate for requesting a password to a
  53. // PKCS#11 token. May be null.
  54. PasswordDelegateFactory password_delegate_factory_;
  55. };
  56. } // namespace net
  57. #endif // NET_SSL_CLIENT_CERT_STORE_NSS_H_