src/chrome/browser/ui/android/ssl_client_certificate_request.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ui/android/ssl_client_certificate_request.h"
   6
   7 #include "base/android/jni_array.h"
   8 #include "base/android/jni_string.h"
   9 #include "base/android/scoped_java_ref.h"
  10 #include "base/basictypes.h"
  11 #include "base/bind.h"
  12 #include "base/callback_helpers.h"
  13 #include "base/compiler_specific.h"
  14 #include "base/logging.h"
  15 #include "chrome/browser/ssl/ssl_client_certificate_selector.h"
  16 #include "chrome/browser/ui/android/window_android_helper.h"
  17 #include "content/public/browser/browser_thread.h"
  18 #include "crypto/scoped_openssl_types.h"
  19 #include "jni/SSLClientCertificateRequest_jni.h"
  20 #include "net/android/keystore_openssl.h"
  21 #include "net/base/host_port_pair.h"
  22 #include "net/cert/cert_database.h"
  23 #include "net/cert/x509_certificate.h"
  24 #include "net/ssl/openssl_client_key_store.h"
  25 #include "net/ssl/ssl_cert_request_info.h"
  26 #include "net/ssl/ssl_client_cert_type.h"
  27 #include "ui/base/android/window_android.h"
  28
  29
  30 namespace chrome {
  31
  32 namespace {
  33
  34 // Must be called on the I/O thread to record a client certificate
  35 // and its private key in the OpenSSLClientKeyStore.
  36 void RecordClientCertificateKey(
  37     const scoped_refptr<net::X509Certificate>& client_cert,
  38     crypto::ScopedEVP_PKEY private_key) {
  39   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
  40   net::OpenSSLClientKeyStore::GetInstance()->RecordClientCertPrivateKey(
  41       client_cert.get(), private_key.get());
  42 }
  43
  44 void StartClientCertificateRequest(
  45     const net::SSLCertRequestInfo* cert_request_info,
  46     ui::WindowAndroid* window,
  47     const chrome::SelectCertificateCallback& callback) {
  48   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
  49
  50   // Ensure that callback(NULL) is posted as a task on the UI thread
  51   // in case of an error.
  52   base::Closure post_task_closure = base::Bind(
  53       base::IgnoreResult(&content::BrowserThread::PostTask),
  54       content::BrowserThread::UI,
  55       FROM_HERE,
  56       base::Bind(callback, scoped_refptr<net::X509Certificate>()));
  57
  58   base::ScopedClosureRunner guard(post_task_closure);
  59
  60   // Build the |key_types| JNI parameter, as a String[]
  61   std::vector<std::string> key_types;
  62   for (size_t n = 0; n < cert_request_info->cert_key_types.size(); ++n) {
  63     switch (cert_request_info->cert_key_types[n]) {
  64       case net::CLIENT_CERT_RSA_SIGN:
  65         key_types.push_back("RSA");
  66         break;
  67       case net::CLIENT_CERT_DSS_SIGN:
  68         key_types.push_back("DSA");
  69         break;
  70       case net::CLIENT_CERT_ECDSA_SIGN:
  71         key_types.push_back("ECDSA");
  72         break;
  73       default:
  74         // Ignore unknown types.
  75         break;
  76     }
  77   }
  78
  79   JNIEnv* env = base::android::AttachCurrentThread();
  80   ScopedJavaLocalRef<jobjectArray> key_types_ref =
  81       base::android::ToJavaArrayOfStrings(env, key_types);
  82   if (key_types_ref.is_null()) {
  83     LOG(ERROR) << "Could not create key types array (String[])";
  84     return;
  85   }
  86
  87   // Build the |encoded_principals| JNI parameter, as a byte[][]
  88   ScopedJavaLocalRef<jobjectArray> principals_ref =
  89       base::android::ToJavaArrayOfByteArray(
  90           env, cert_request_info->cert_authorities);
  91   if (principals_ref.is_null()) {
  92     LOG(ERROR) << "Could not create principals array (byte[][])";
  93     return;
  94   }
  95
  96   // Build the |host_name| and |port| JNI parameters, as a String and
  97   // a jint.
  98   ScopedJavaLocalRef<jstring> host_name_ref =
  99       base::android::ConvertUTF8ToJavaString(
 100           env, cert_request_info->host_and_port.host());
 101
 102   // Create a copy of the callback on the heap so that its address
 103   // and ownership can be passed through and returned from Java via JNI.
 104   scoped_ptr<chrome::SelectCertificateCallback> request(
 105       new chrome::SelectCertificateCallback(callback));
 106
 107   jlong request_id = reinterpret_cast<intptr_t>(request.get());
 108
 109   if (!chrome::android::
 110       Java_SSLClientCertificateRequest_selectClientCertificate(
 111           env,
 112           request_id,
 113           window->GetJavaObject().obj(),
 114           key_types_ref.obj(),
 115           principals_ref.obj(),
 116           host_name_ref.obj(),
 117           cert_request_info->host_and_port.port())) {
 118     return;
 119   }
 120
 121   ignore_result(guard.Release());
 122
 123   // Ownership was transferred to Java.
 124   ignore_result(request.release());
 125 }
 126
 127 }  // namespace
 128
 129 namespace android {
 130
 131 // Called from JNI on request completion/result.
 132 // |env| is the current thread's JNIEnv.
 133 // |clazz| is the SSLClientCertificateRequest JNI class reference.
 134 // |request_id| is the id passed to
 135 // Java_SSLClientCertificateRequest_selectClientCertificate() in Start().
 136 // |encoded_chain_ref| is a JNI reference to a Java array of byte arrays,
 137 // each item holding a DER-encoded X.509 certificate.
 138 // |private_key_ref| is the platform PrivateKey object JNI reference for
 139 // the client certificate.
 140 // Note: both |encoded_chain_ref| and |private_key_ref| will be NULL if
 141 // the user didn't select a certificate.
 142 static void OnSystemRequestCompletion(
 143     JNIEnv* env,
 144     jclass clazz,
 145     jlong request_id,
 146     jobjectArray encoded_chain_ref,
 147     jobject private_key_ref) {
 148   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 149
 150   // Take back ownership of the request object.
 151   scoped_ptr<chrome::SelectCertificateCallback> callback(
 152       reinterpret_cast<chrome::SelectCertificateCallback*>(request_id));
 153
 154   // Ensure that callback(NULL) is called in case of an error.
 155   base::Closure null_closure =
 156       base::Bind(*callback, scoped_refptr<net::X509Certificate>());
 157
 158   base::ScopedClosureRunner guard(null_closure);
 159
 160   if (encoded_chain_ref == NULL || private_key_ref == NULL) {
 161     LOG(ERROR) << "Client certificate request cancelled";
 162     return;
 163   }
 164
 165   // Convert the encoded chain to a vector of strings.
 166   std::vector<std::string> encoded_chain_strings;
 167   if (encoded_chain_ref) {
 168     base::android::JavaArrayOfByteArrayToStringVector(
 169         env, encoded_chain_ref, &encoded_chain_strings);
 170   }
 171
 172   std::vector<base::StringPiece> encoded_chain;
 173   for (size_t n = 0; n < encoded_chain_strings.size(); ++n)
 174     encoded_chain.push_back(encoded_chain_strings[n]);
 175
 176   // Create the X509Certificate object from the encoded chain.
 177   scoped_refptr<net::X509Certificate> client_cert(
 178       net::X509Certificate::CreateFromDERCertChain(encoded_chain));
 179   if (!client_cert.get()) {
 180     LOG(ERROR) << "Could not decode client certificate chain";
 181     return;
 182   }
 183
 184   // Create an EVP_PKEY wrapper for the private key JNI reference.
 185   crypto::ScopedEVP_PKEY private_key(
 186       net::android::GetOpenSSLPrivateKeyWrapper(private_key_ref));
 187   if (!private_key.get()) {
 188     LOG(ERROR) << "Could not create OpenSSL wrapper for private key";
 189     return;
 190   }
 191
 192   ignore_result(guard.Release());
 193
 194   // RecordClientCertificateKey() must be called on the I/O thread,
 195   // before the callback is called with the selected certificate on
 196   // the UI thread.
 197   content::BrowserThread::PostTaskAndReply(
 198       content::BrowserThread::IO,
 199       FROM_HERE,
 200       base::Bind(&RecordClientCertificateKey,
 201                  client_cert,
 202                  base::Passed(&private_key)),
 203       base::Bind(*callback, client_cert));
 204 }
 205
 206 static void NotifyClientCertificatesChanged() {
 207   net::CertDatabase::GetInstance()->OnAndroidKeyStoreChanged();
 208 }
 209
 210 static void NotifyClientCertificatesChangedOnIOThread(JNIEnv* env, jclass) {
 211   if (content::BrowserThread::CurrentlyOn(content::BrowserThread::IO)) {
 212     NotifyClientCertificatesChanged();
 213   } else {
 214     content::BrowserThread::PostTask(
 215          content::BrowserThread::IO,
 216          FROM_HERE,
 217          base::Bind(&NotifyClientCertificatesChanged));
 218   }
 219 }
 220
 221 bool RegisterSSLClientCertificateRequestAndroid(JNIEnv* env) {
 222   return RegisterNativesImpl(env);
 223 }
 224
 225 }  // namespace android
 226
 227 void ShowSSLClientCertificateSelector(
 228     content::WebContents* contents,
 229     net::SSLCertRequestInfo* cert_request_info,
 230     const chrome::SelectCertificateCallback& callback) {
 231   ui::WindowAndroid* window =
 232       WindowAndroidHelper::FromWebContents(contents)->GetWindowAndroid();
 233   DCHECK(window);
 234   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 235   StartClientCertificateRequest(cert_request_info, window, callback);
 236 }
 237
 238 }  // namespace chrome