Home | History | Annotate | Download | only in network 
      1 // Copyright 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chromeos/network/client_cert_resolver.h"
      6 
      7 #include <cert.h>
      8 #include <certt.h>  // for (SECCertUsageEnum) certUsageAnyCA
      9 #include <pk11pub.h>
     10 
     11 #include <algorithm>
     12 #include <string>
     13 
     14 #include "base/bind.h"
     15 #include "base/location.h"
     16 #include "base/stl_util.h"
     17 #include "base/task_runner.h"
     18 #include "base/threading/worker_pool.h"
     19 #include "base/time/time.h"
     20 #include "chromeos/cert_loader.h"
     21 #include "chromeos/dbus/dbus_thread_manager.h"
     22 #include "chromeos/dbus/shill_service_client.h"
     23 #include "chromeos/network/managed_network_configuration_handler.h"
     24 #include "chromeos/network/network_state.h"
     25 #include "components/onc/onc_constants.h"
     26 #include "dbus/object_path.h"
     27 #include "net/cert/scoped_nss_types.h"
     28 #include "net/cert/x509_certificate.h"
     29 
     30 namespace chromeos {
     31 
     32 // Describes a network |network_path| for which a matching certificate |cert_id|
     33 // was found or for which no certificate was found (|cert_id| will be empty).
     34 struct ClientCertResolver::NetworkAndMatchingCert {
     35   NetworkAndMatchingCert(const std::string& network_path,
     36                          client_cert::ConfigType config_type,
     37                          const std::string& cert_id,
     38                          int slot_id)
     39       : service_path(network_path),
     40         cert_config_type(config_type),
     41         pkcs11_id(cert_id),
     42         key_slot_id(slot_id) {}
     43 
     44   std::string service_path;
     45   client_cert::ConfigType cert_config_type;
     46 
     47   // The id of the matching certificate or empty if no certificate was found.
     48   std::string pkcs11_id;
     49 
     50   // The id of the slot containing the certificate and the private key.
     51   int key_slot_id;
     52 };
     53 
     54 typedef std::vector<ClientCertResolver::NetworkAndMatchingCert>
     55     NetworkCertMatches;
     56 
     57 namespace {
     58 
     59 // Returns true if |vector| contains |value|.
     60 template <class T>
     61 bool ContainsValue(const std::vector<T>& vector, const T& value) {
     62   return find(vector.begin(), vector.end(), value) != vector.end();
     63 }
     64 
     65 // Returns true if a private key for certificate |cert| is installed.
     66 bool HasPrivateKey(const net::X509Certificate& cert) {
     67   PK11SlotInfo* slot = PK11_KeyForCertExists(cert.os_cert_handle(), NULL, NULL);
     68   if (!slot)
     69     return false;
     70 
     71   PK11_FreeSlot(slot);
     72   return true;
     73 }
     74 
     75 // Describes a certificate which is issued by |issuer| (encoded as PEM).
     76 struct CertAndIssuer {
     77   CertAndIssuer(const scoped_refptr<net::X509Certificate>& certificate,
     78                 const std::string& issuer)
     79       : cert(certificate),
     80         pem_encoded_issuer(issuer) {}
     81 
     82   scoped_refptr<net::X509Certificate> cert;
     83   std::string pem_encoded_issuer;
     84 };
     85 
     86 bool CompareCertExpiration(const CertAndIssuer& a,
     87                            const CertAndIssuer& b) {
     88   return (a.cert->valid_expiry() > b.cert->valid_expiry());
     89 }
     90 
     91 // Describes a network that is configured with the certificate pattern
     92 // |client_cert_pattern|.
     93 struct NetworkAndCertPattern {
     94   NetworkAndCertPattern(const std::string& network_path,
     95                         const client_cert::ClientCertConfig& client_cert_config)
     96       : service_path(network_path),
     97         cert_config(client_cert_config) {}
     98 
     99   std::string service_path;
    100   client_cert::ClientCertConfig cert_config;
    101 };
    102 
    103 // A unary predicate that returns true if the given CertAndIssuer matches the
    104 // given certificate pattern.
    105 struct MatchCertWithPattern {
    106   explicit MatchCertWithPattern(const CertificatePattern& cert_pattern)
    107       : pattern(cert_pattern) {}
    108 
    109   bool operator()(const CertAndIssuer& cert_and_issuer) {
    110     if (!pattern.issuer().Empty() &&
    111         !client_cert::CertPrincipalMatches(pattern.issuer(),
    112                                            cert_and_issuer.cert->issuer())) {
    113       return false;
    114     }
    115     if (!pattern.subject().Empty() &&
    116         !client_cert::CertPrincipalMatches(pattern.subject(),
    117                                            cert_and_issuer.cert->subject())) {
    118       return false;
    119     }
    120 
    121     const std::vector<std::string>& issuer_ca_pems = pattern.issuer_ca_pems();
    122     if (!issuer_ca_pems.empty() &&
    123         !ContainsValue(issuer_ca_pems, cert_and_issuer.pem_encoded_issuer)) {
    124       return false;
    125     }
    126     return true;
    127   }
    128 
    129   const CertificatePattern pattern;
    130 };
    131 
    132 std::vector<CertAndIssuer> CreateSortedCertAndIssuerList(
    133     const net::CertificateList& certs) {
    134   // Filter all client certs and determines each certificate's issuer, which is
    135   // required for the pattern matching.
    136   std::vector<CertAndIssuer> client_certs;
    137   for (net::CertificateList::const_iterator it = certs.begin();
    138        it != certs.end(); ++it) {
    139     const net::X509Certificate& cert = **it;
    140     if (cert.valid_expiry().is_null() || cert.HasExpired() ||
    141         !HasPrivateKey(cert)) {
    142       continue;
    143     }
    144     net::ScopedCERTCertificate issuer_handle(
    145         CERT_FindCertIssuer(cert.os_cert_handle(), PR_Now(), certUsageAnyCA));
    146     if (!issuer_handle) {
    147       LOG(ERROR) << "Couldn't find an issuer.";
    148       continue;
    149     }
    150     scoped_refptr<net::X509Certificate> issuer =
    151         net::X509Certificate::CreateFromHandle(
    152             issuer_handle.get(),
    153             net::X509Certificate::OSCertHandles() /* no intermediate certs */);
    154     if (!issuer.get()) {
    155       LOG(ERROR) << "Couldn't create issuer cert.";
    156       continue;
    157     }
    158     std::string pem_encoded_issuer;
    159     if (!net::X509Certificate::GetPEMEncoded(issuer->os_cert_handle(),
    160                                              &pem_encoded_issuer)) {
    161       LOG(ERROR) << "Couldn't PEM-encode certificate.";
    162       continue;
    163     }
    164     client_certs.push_back(CertAndIssuer(*it, pem_encoded_issuer));
    165   }
    166 
    167   std::sort(client_certs.begin(), client_certs.end(), &CompareCertExpiration);
    168   return client_certs;
    169 }
    170 
    171 // Searches for matches between |networks| and |certs| and writes matches to
    172 // |matches|. Because this calls NSS functions and is potentially slow, it must
    173 // be run on a worker thread.
    174 void FindCertificateMatches(const net::CertificateList& certs,
    175                             std::vector<NetworkAndCertPattern>* networks,
    176                             NetworkCertMatches* matches) {
    177   std::vector<CertAndIssuer> client_certs(CreateSortedCertAndIssuerList(certs));
    178 
    179   for (std::vector<NetworkAndCertPattern>::const_iterator it =
    180            networks->begin();
    181        it != networks->end(); ++it) {
    182     std::vector<CertAndIssuer>::iterator cert_it =
    183         std::find_if(client_certs.begin(),
    184                      client_certs.end(),
    185                      MatchCertWithPattern(it->cert_config.pattern));
    186     std::string pkcs11_id;
    187     int slot_id = -1;
    188     if (cert_it == client_certs.end()) {
    189       VLOG(1) << "Couldn't find a matching client cert for network "
    190               << it->service_path;
    191       // Leave |pkcs11_id| empty to indicate that no cert was found for this
    192       // network.
    193     } else {
    194       pkcs11_id =
    195           CertLoader::GetPkcs11IdAndSlotForCert(*cert_it->cert, &slot_id);
    196       if (pkcs11_id.empty()) {
    197         LOG(ERROR) << "Couldn't determine PKCS#11 ID.";
    198         // So far this error is not expected to happen. We can just continue, in
    199         // the worst case the user can remove the problematic cert.
    200         continue;
    201       }
    202     }
    203     matches->push_back(ClientCertResolver::NetworkAndMatchingCert(
    204         it->service_path, it->cert_config.location, pkcs11_id, slot_id));
    205   }
    206 }
    207 
    208 void LogError(const std::string& service_path,
    209               const std::string& dbus_error_name,
    210               const std::string& dbus_error_message) {
    211   network_handler::ShillErrorCallbackFunction(
    212       "ClientCertResolver.SetProperties failed",
    213       service_path,
    214       network_handler::ErrorCallback(),
    215       dbus_error_name,
    216       dbus_error_message);
    217 }
    218 
    219 bool ClientCertificatesLoaded() {
    220   if (!CertLoader::Get()->certificates_loaded()) {
    221     VLOG(1) << "Certificates not loaded yet.";
    222     return false;
    223   }
    224   if (!CertLoader::Get()->IsHardwareBacked()) {
    225     VLOG(1) << "TPM is not available.";
    226     return false;
    227   }
    228   return true;
    229 }
    230 
    231 }  // namespace
    232 
    233 ClientCertResolver::ClientCertResolver()
    234     : network_state_handler_(NULL),
    235       managed_network_config_handler_(NULL),
    236       weak_ptr_factory_(this) {
    237 }
    238 
    239 ClientCertResolver::~ClientCertResolver() {
    240   if (network_state_handler_)
    241     network_state_handler_->RemoveObserver(this, FROM_HERE);
    242   if (CertLoader::IsInitialized())
    243     CertLoader::Get()->RemoveObserver(this);
    244   if (managed_network_config_handler_)
    245     managed_network_config_handler_->RemoveObserver(this);
    246 }
    247 
    248 void ClientCertResolver::Init(
    249     NetworkStateHandler* network_state_handler,
    250     ManagedNetworkConfigurationHandler* managed_network_config_handler) {
    251   DCHECK(network_state_handler);
    252   network_state_handler_ = network_state_handler;
    253   network_state_handler_->AddObserver(this, FROM_HERE);
    254 
    255   DCHECK(managed_network_config_handler);
    256   managed_network_config_handler_ = managed_network_config_handler;
    257   managed_network_config_handler_->AddObserver(this);
    258 
    259   CertLoader::Get()->AddObserver(this);
    260 }
    261 
    262 void ClientCertResolver::SetSlowTaskRunnerForTest(
    263     const scoped_refptr<base::TaskRunner>& task_runner) {
    264   slow_task_runner_for_test_ = task_runner;
    265 }
    266 
    267 // static
    268 bool ClientCertResolver::ResolveCertificatePatternSync(
    269     const client_cert::ConfigType client_cert_type,
    270     const CertificatePattern& pattern,
    271     base::DictionaryValue* shill_properties) {
    272   // Prepare and sort the list of known client certs.
    273   std::vector<CertAndIssuer> client_certs(
    274       CreateSortedCertAndIssuerList(CertLoader::Get()->cert_list()));
    275 
    276   // Search for a certificate matching the pattern.
    277   std::vector<CertAndIssuer>::iterator cert_it = std::find_if(
    278       client_certs.begin(), client_certs.end(), MatchCertWithPattern(pattern));
    279 
    280   if (cert_it == client_certs.end()) {
    281     VLOG(1) << "Couldn't find a matching client cert";
    282     client_cert::SetEmptyShillProperties(client_cert_type, shill_properties);
    283     return false;
    284   }
    285 
    286   int slot_id = -1;
    287   std::string pkcs11_id =
    288       CertLoader::GetPkcs11IdAndSlotForCert(*cert_it->cert, &slot_id);
    289   if (pkcs11_id.empty()) {
    290     LOG(ERROR) << "Couldn't determine PKCS#11 ID.";
    291     // So far this error is not expected to happen. We can just continue, in
    292     // the worst case the user can remove the problematic cert.
    293     return false;
    294   }
    295   client_cert::SetShillProperties(
    296       client_cert_type, slot_id, pkcs11_id, shill_properties);
    297   return true;
    298 }
    299 
    300 void ClientCertResolver::NetworkListChanged() {
    301   VLOG(2) << "NetworkListChanged.";
    302   if (!ClientCertificatesLoaded())
    303     return;
    304   // Configure only networks that were not configured before.
    305 
    306   // We'll drop networks from |resolved_networks_|, which are not known anymore.
    307   std::set<std::string> old_resolved_networks;
    308   old_resolved_networks.swap(resolved_networks_);
    309 
    310   NetworkStateHandler::NetworkStateList networks;
    311   network_state_handler_->GetNetworkListByType(
    312       NetworkTypePattern::Default(),
    313       true /* configured_only */,
    314       false /* visible_only */,
    315       0 /* no limit */,
    316       &networks);
    317 
    318   NetworkStateHandler::NetworkStateList networks_to_check;
    319   for (NetworkStateHandler::NetworkStateList::const_iterator it =
    320            networks.begin(); it != networks.end(); ++it) {
    321     const std::string& service_path = (*it)->path();
    322     if (ContainsKey(old_resolved_networks, service_path)) {
    323       resolved_networks_.insert(service_path);
    324       continue;
    325     }
    326     networks_to_check.push_back(*it);
    327   }
    328 
    329   ResolveNetworks(networks_to_check);
    330 }
    331 
    332 void ClientCertResolver::OnCertificatesLoaded(
    333     const net::CertificateList& cert_list,
    334     bool initial_load) {
    335   VLOG(2) << "OnCertificatesLoaded.";
    336   if (!ClientCertificatesLoaded())
    337     return;
    338   // Compare all networks with all certificates.
    339   NetworkStateHandler::NetworkStateList networks;
    340   network_state_handler_->GetNetworkListByType(
    341       NetworkTypePattern::Default(),
    342       true /* configured_only */,
    343       false /* visible_only */,
    344       0 /* no limit */,
    345       &networks);
    346   ResolveNetworks(networks);
    347 }
    348 
    349 void ClientCertResolver::PolicyApplied(const std::string& service_path) {
    350   VLOG(2) << "PolicyApplied " << service_path;
    351   if (!ClientCertificatesLoaded())
    352     return;
    353   // Compare this network with all certificates.
    354   const NetworkState* network =
    355       network_state_handler_->GetNetworkStateFromServicePath(
    356           service_path, true /* configured_only */);
    357   if (!network) {
    358     LOG(ERROR) << "service path '" << service_path << "' unknown.";
    359     return;
    360   }
    361   NetworkStateHandler::NetworkStateList networks;
    362   networks.push_back(network);
    363   ResolveNetworks(networks);
    364 }
    365 
    366 void ClientCertResolver::ResolveNetworks(
    367     const NetworkStateHandler::NetworkStateList& networks) {
    368   scoped_ptr<std::vector<NetworkAndCertPattern> > networks_with_pattern(
    369       new std::vector<NetworkAndCertPattern>);
    370 
    371   // Filter networks with ClientCertPattern. As ClientCertPatterns can only be
    372   // set by policy, we check there.
    373   for (NetworkStateHandler::NetworkStateList::const_iterator it =
    374            networks.begin(); it != networks.end(); ++it) {
    375     const NetworkState* network = *it;
    376 
    377     // In any case, don't check this network again in NetworkListChanged.
    378     resolved_networks_.insert(network->path());
    379 
    380     // If this network is not configured, it cannot have a ClientCertPattern.
    381     if (network->profile_path().empty())
    382       continue;
    383 
    384     const base::DictionaryValue* policy =
    385         managed_network_config_handler_->FindPolicyByGuidAndProfile(
    386             network->guid(), network->profile_path());
    387 
    388     if (!policy) {
    389       VLOG(1) << "The policy for network " << network->path() << " with GUID "
    390               << network->guid() << " is not available yet.";
    391       // Skip this network for now. Once the policy is loaded, PolicyApplied()
    392       // will retry.
    393       continue;
    394     }
    395 
    396     VLOG(2) << "Inspecting network " << network->path();
    397     client_cert::ClientCertConfig cert_config;
    398     OncToClientCertConfig(*policy, &cert_config);
    399 
    400     // Skip networks that don't have a ClientCertPattern.
    401     if (cert_config.client_cert_type != ::onc::client_cert::kPattern)
    402       continue;
    403 
    404     networks_with_pattern->push_back(
    405         NetworkAndCertPattern(network->path(), cert_config));
    406   }
    407   if (networks_with_pattern->empty())
    408     return;
    409 
    410   VLOG(2) << "Start task for resolving client cert patterns.";
    411   base::TaskRunner* task_runner = slow_task_runner_for_test_.get();
    412   if (!task_runner)
    413     task_runner =
    414         base::WorkerPool::GetTaskRunner(true /* task is slow */).get();
    415 
    416   NetworkCertMatches* matches = new NetworkCertMatches;
    417   task_runner->PostTaskAndReply(
    418       FROM_HERE,
    419       base::Bind(&FindCertificateMatches,
    420                  CertLoader::Get()->cert_list(),
    421                  base::Owned(networks_with_pattern.release()),
    422                  matches),
    423       base::Bind(&ClientCertResolver::ConfigureCertificates,
    424                  weak_ptr_factory_.GetWeakPtr(),
    425                  base::Owned(matches)));
    426 }
    427 
    428 void ClientCertResolver::ConfigureCertificates(NetworkCertMatches* matches) {
    429   for (NetworkCertMatches::const_iterator it = matches->begin();
    430        it != matches->end(); ++it) {
    431     VLOG(1) << "Configuring certificate of network " << it->service_path;
    432     base::DictionaryValue shill_properties;
    433     if (it->pkcs11_id.empty()) {
    434       client_cert::SetEmptyShillProperties(it->cert_config_type,
    435                                            &shill_properties);
    436     } else {
    437       client_cert::SetShillProperties(it->cert_config_type,
    438                                       it->key_slot_id,
    439                                       it->pkcs11_id,
    440                                       &shill_properties);
    441     }
    442     DBusThreadManager::Get()->GetShillServiceClient()->
    443         SetProperties(dbus::ObjectPath(it->service_path),
    444                         shill_properties,
    445                         base::Bind(&base::DoNothing),
    446                         base::Bind(&LogError, it->service_path));
    447     network_state_handler_->RequestUpdateForNetwork(it->service_path);
    448   }
    449 }
    450 
    451 }  // namespace chromeos
    452