Home | History | Annotate | Download | only in ssl 
      1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_SSL_OPENSSL_CLIENT_KEY_STORE_H_
      6 #define NET_SSL_OPENSSL_CLIENT_KEY_STORE_H_
      7 
      8 #include <openssl/evp.h>
      9 
     10 #include <vector>
     11 
     12 #include "base/basictypes.h"
     13 #include "base/memory/scoped_ptr.h"
     14 #include "base/memory/singleton.h"
     15 #include "crypto/openssl_util.h"
     16 #include "crypto/scoped_openssl_types.h"
     17 #include "net/base/net_export.h"
     18 
     19 namespace net {
     20 
     21 class X509Certificate;
     22 
     23 // OpenSSLClientKeyStore implements an in-memory store for client
     24 // certificate private keys, because the platforms where OpenSSL is
     25 // used do not provide a way to retrieve the private key of a known
     26 // certificate.
     27 //
     28 // This class is not thread-safe and should only be used from the network
     29 // thread.
     30 class NET_EXPORT OpenSSLClientKeyStore {
     31  public:
     32   // Platforms must define this factory function as appropriate.
     33   static OpenSSLClientKeyStore* GetInstance();
     34 
     35   // Record the association between a certificate and its
     36   // private key. This method should be called _before_
     37   // FetchClientCertPrivateKey to ensure that the private key is returned
     38   // when it is called later. The association is recorded in memory
     39   // exclusively.
     40   // |cert| is a handle to a certificate object.
     41   // |private_key| is an OpenSSL EVP_PKEY that corresponds to the
     42   // certificate's private key.
     43   // Returns false if an error occured.
     44   // This function does not take ownership of the private_key, but may
     45   // increment its internal reference count.
     46   NET_EXPORT bool RecordClientCertPrivateKey(const X509Certificate* cert,
     47                                              EVP_PKEY* private_key);
     48 
     49   // Given a certificate's |public_key|, return the corresponding private
     50   // key that has been recorded previously by RecordClientCertPrivateKey().
     51   // |cert| is a client certificate.
     52   // Returns its matching private key on success, NULL otherwise.
     53   crypto::ScopedEVP_PKEY FetchClientCertPrivateKey(const X509Certificate* cert);
     54 
     55   // Flush all recorded keys.
     56   void Flush();
     57 
     58  protected:
     59   OpenSSLClientKeyStore();
     60 
     61   ~OpenSSLClientKeyStore();
     62 
     63   // Adds a given public/private key pair.
     64   // |pub_key| and |private_key| can point to the same object.
     65   // This increments the reference count on both objects, caller
     66   // must still call EVP_PKEY_free on them.
     67   void AddKeyPair(EVP_PKEY* pub_key, EVP_PKEY* private_key);
     68 
     69  private:
     70   // KeyPair is an internal class used to hold a pair of private / public
     71   // EVP_PKEY objects, with appropriate ownership.
     72   class KeyPair {
     73    public:
     74     explicit KeyPair(EVP_PKEY* pub_key, EVP_PKEY* priv_key);
     75     KeyPair(const KeyPair& other);
     76     void operator=(const KeyPair& other);
     77     ~KeyPair();
     78 
     79     crypto::ScopedEVP_PKEY public_key;
     80     crypto::ScopedEVP_PKEY private_key;
     81 
     82    private:
     83     KeyPair();  // intentionally not implemented.
     84   };
     85 
     86   // Returns the index of the keypair for |public_key|. or -1 if not found.
     87   int FindKeyPairIndex(EVP_PKEY* public_key);
     88 
     89   std::vector<KeyPair> pairs_;
     90 
     91   friend struct DefaultSingletonTraits<OpenSSLClientKeyStore>;
     92 
     93   DISALLOW_COPY_AND_ASSIGN(OpenSSLClientKeyStore);
     94 };
     95 
     96 }  // namespace net
     97 
     98 #endif  // NET_SSL_OPENSSL_CLIENT_KEY_STORE_H_
     99