OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chromeos/network/client_cert_resolver.h" | 5 #include "chromeos/network/client_cert_resolver.h" |
6 | 6 |
7 #include <cert.h> | 7 #include <cert.h> |
8 #include <certt.h> // for (SECCertUsageEnum) certUsageAnyCA | 8 #include <certt.h> // for (SECCertUsageEnum) certUsageAnyCA |
9 #include <pk11pub.h> | 9 #include <pk11pub.h> |
10 | 10 |
11 #include <algorithm> | 11 #include <algorithm> |
12 #include <string> | 12 #include <string> |
13 | 13 |
14 #include "base/stl_util.h" | 14 #include "base/stl_util.h" |
15 #include "base/task_runner.h" | 15 #include "base/task_runner.h" |
16 #include "base/threading/worker_pool.h" | 16 #include "base/threading/worker_pool.h" |
17 #include "base/time/time.h" | 17 #include "base/time/time.h" |
18 #include "chromeos/cert_loader.h" | 18 #include "chromeos/cert_loader.h" |
19 #include "chromeos/dbus/dbus_thread_manager.h" | 19 #include "chromeos/dbus/dbus_thread_manager.h" |
20 #include "chromeos/dbus/shill_service_client.h" | 20 #include "chromeos/dbus/shill_service_client.h" |
21 #include "chromeos/network/certificate_pattern.h" | 21 #include "chromeos/network/certificate_pattern.h" |
22 #include "chromeos/network/client_cert_util.h" | 22 #include "chromeos/network/client_cert_util.h" |
| 23 #include "chromeos/network/favorite_state.h" |
23 #include "chromeos/network/managed_network_configuration_handler.h" | 24 #include "chromeos/network/managed_network_configuration_handler.h" |
24 #include "chromeos/network/network_state.h" | |
25 #include "chromeos/network/network_state_handler.h" | 25 #include "chromeos/network/network_state_handler.h" |
26 #include "chromeos/network/network_ui_data.h" | 26 #include "chromeos/network/network_ui_data.h" |
27 #include "chromeos/network/onc/onc_constants.h" | 27 #include "chromeos/network/onc/onc_constants.h" |
28 #include "dbus/object_path.h" | 28 #include "dbus/object_path.h" |
29 #include "net/cert/x509_certificate.h" | 29 #include "net/cert/x509_certificate.h" |
30 | 30 |
31 namespace chromeos { | 31 namespace chromeos { |
32 | 32 |
33 // Describes a network |network_path| for which a matching certificate |cert_id| | 33 // Describes a network |network_path| for which a matching certificate |cert_id| |
34 // was found. | 34 // was found. |
(...skipping 257 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
292 void ClientCertResolver::NetworkListChanged() { | 292 void ClientCertResolver::NetworkListChanged() { |
293 VLOG(2) << "NetworkListChanged."; | 293 VLOG(2) << "NetworkListChanged."; |
294 if (!ClientCertificatesLoaded()) | 294 if (!ClientCertificatesLoaded()) |
295 return; | 295 return; |
296 // Configure only networks that were not configured before. | 296 // Configure only networks that were not configured before. |
297 | 297 |
298 // We'll drop networks from |resolved_networks_|, which are not known anymore. | 298 // We'll drop networks from |resolved_networks_|, which are not known anymore. |
299 std::set<std::string> old_resolved_networks; | 299 std::set<std::string> old_resolved_networks; |
300 old_resolved_networks.swap(resolved_networks_); | 300 old_resolved_networks.swap(resolved_networks_); |
301 | 301 |
302 NetworkStateList networks; | 302 FavoriteStateList networks; |
303 network_state_handler_->GetNetworkList(&networks); | 303 network_state_handler_->GetFavoriteList(&networks); |
304 | 304 |
305 NetworkStateList networks_to_check; | 305 FavoriteStateList networks_to_check; |
306 for (NetworkStateList::const_iterator it = networks.begin(); | 306 for (FavoriteStateList::const_iterator it = networks.begin(); |
307 it != networks.end(); ++it) { | 307 it != networks.end(); ++it) { |
308 // If this network is not managed, it cannot have a ClientCertPattern. | |
309 // We do this check here additionally to ResolveNetworks because it's cheap | |
310 // and prevents |resolved_networks_| from becoming too large. | |
311 if ((*it)->guid().empty()) | |
312 continue; | |
313 | |
314 const std::string& service_path = (*it)->path(); | 308 const std::string& service_path = (*it)->path(); |
315 if (ContainsKey(old_resolved_networks, service_path)) { | 309 if (ContainsKey(old_resolved_networks, service_path)) { |
316 resolved_networks_.insert(service_path); | 310 resolved_networks_.insert(service_path); |
317 continue; | 311 continue; |
318 } | 312 } |
319 networks_to_check.push_back(*it); | 313 networks_to_check.push_back(*it); |
320 } | 314 } |
321 | 315 |
322 ResolveNetworks(networks_to_check); | 316 ResolveNetworks(networks_to_check); |
323 } | 317 } |
324 | 318 |
325 void ClientCertResolver::OnCertificatesLoaded( | 319 void ClientCertResolver::OnCertificatesLoaded( |
326 const net::CertificateList& cert_list, | 320 const net::CertificateList& cert_list, |
327 bool initial_load) { | 321 bool initial_load) { |
328 VLOG(2) << "OnCertificatesLoaded."; | 322 VLOG(2) << "OnCertificatesLoaded."; |
329 if (!ClientCertificatesLoaded()) | 323 if (!ClientCertificatesLoaded()) |
330 return; | 324 return; |
331 // Compare all networks with all certificates. | 325 // Compare all networks with all certificates. |
332 NetworkStateList networks; | 326 FavoriteStateList networks; |
333 network_state_handler_->GetNetworkList(&networks); | 327 network_state_handler_->GetFavoriteList(&networks); |
334 ResolveNetworks(networks); | 328 ResolveNetworks(networks); |
335 } | 329 } |
336 | 330 |
337 void ClientCertResolver::PolicyApplied(const std::string& service_path) { | 331 void ClientCertResolver::PolicyApplied(const std::string& service_path) { |
338 VLOG(2) << "PolicyApplied " << service_path; | 332 VLOG(2) << "PolicyApplied " << service_path; |
339 if (!ClientCertificatesLoaded()) | 333 if (!ClientCertificatesLoaded()) |
340 return; | 334 return; |
341 // Compare this network with all certificates. | 335 // Compare this network with all certificates. |
342 const NetworkState* network = | 336 const FavoriteState* network = |
343 network_state_handler_->GetNetworkState(service_path); | 337 network_state_handler_->GetFavoriteState(service_path); |
344 if (!network) { | 338 if (!network) { |
345 LOG(ERROR) << "service path '" << service_path << "' unknown."; | 339 LOG(ERROR) << "service path '" << service_path << "' unknown."; |
346 return; | 340 return; |
347 } | 341 } |
348 NetworkStateList networks; | 342 FavoriteStateList networks; |
349 networks.push_back(network); | 343 networks.push_back(network); |
350 ResolveNetworks(networks); | 344 ResolveNetworks(networks); |
351 } | 345 } |
352 | 346 |
353 void ClientCertResolver::ResolveNetworks( | 347 void ClientCertResolver::ResolveNetworks(const FavoriteStateList& networks) { |
354 const NetworkStateList& networks) { | |
355 scoped_ptr<std::vector<NetworkAndCertPattern> > networks_with_pattern( | 348 scoped_ptr<std::vector<NetworkAndCertPattern> > networks_with_pattern( |
356 new std::vector<NetworkAndCertPattern>); | 349 new std::vector<NetworkAndCertPattern>); |
357 | 350 |
358 // Filter networks with ClientCertPattern. As ClientCertPatterns can only be | 351 // Filter networks with ClientCertPattern. As ClientCertPatterns can only be |
359 // set by policy, we check there. | 352 // set by policy, we check there. |
360 for (NetworkStateList::const_iterator it = networks.begin(); | 353 for (FavoriteStateList::const_iterator it = networks.begin(); |
361 it != networks.end(); ++it) { | 354 it != networks.end(); ++it) { |
362 const NetworkState* network = *it; | 355 const FavoriteState* network = *it; |
363 | 356 |
364 // In any case, don't check this network again in NetworkListChanged. | 357 // In any case, don't check this network again in NetworkListChanged. |
365 resolved_networks_.insert(network->path()); | 358 resolved_networks_.insert(network->path()); |
366 | 359 |
367 // If this network is not managed, it cannot have a ClientCertPattern. | 360 // If this network is not managed, it cannot have a ClientCertPattern. |
368 if (network->guid().empty()) | 361 if (network->guid().empty()) |
369 continue; | 362 continue; |
370 | 363 |
371 if (network->profile_path().empty()) { | 364 if (network->profile_path().empty()) { |
372 LOG(ERROR) << "Network " << network->path() | 365 LOG(ERROR) << "Network " << network->path() |
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
441 DBusThreadManager::Get()->GetShillServiceClient()-> | 434 DBusThreadManager::Get()->GetShillServiceClient()-> |
442 SetProperties(dbus::ObjectPath(it->service_path), | 435 SetProperties(dbus::ObjectPath(it->service_path), |
443 shill_properties, | 436 shill_properties, |
444 base::Bind(&base::DoNothing), | 437 base::Bind(&base::DoNothing), |
445 base::Bind(&LogError, it->service_path)); | 438 base::Bind(&LogError, it->service_path)); |
446 network_state_handler_->RequestUpdateForNetwork(it->service_path); | 439 network_state_handler_->RequestUpdateForNetwork(it->service_path); |
447 } | 440 } |
448 } | 441 } |
449 | 442 |
450 } // namespace chromeos | 443 } // namespace chromeos |
OLD | NEW |