src/chrome/browser/ui/android/ssl_client_certificate_request.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ui/android/ssl_client_certificate_request.h"
   6
   7 #include "base/android/jni_array.h"
   8 #include "base/android/jni_string.h"
   9 #include "base/android/scoped_java_ref.h"
  10 #include "base/basictypes.h"
  11 #include "base/bind.h"
  12 #include "base/callback_helpers.h"
  13 #include "base/compiler_specific.h"
  14 #include "base/logging.h"
  15 #include "chrome/browser/ssl/ssl_client_certificate_selector.h"
  16 #include "content/public/browser/browser_thread.h"
  17 #include "jni/SSLClientCertificateRequest_jni.h"
  18 #include "net/android/keystore_openssl.h"
  19 #include "net/base/host_port_pair.h"
  20 #include "net/cert/x509_certificate.h"
  21 #include "net/ssl/openssl_client_key_store.h"
  22 #include "net/ssl/ssl_cert_request_info.h"
  23 #include "net/ssl/ssl_client_cert_type.h"
  24
  25 namespace chrome {
  26
  27 namespace {
  28
  29 typedef net::OpenSSLClientKeyStore::ScopedEVP_PKEY ScopedEVP_PKEY;
  30
  31 // Must be called on the I/O thread to record a client certificate
  32 // and its private key in the OpenSSLClientKeyStore.
  33 void RecordClientCertificateKey(
  34     const scoped_refptr<net::X509Certificate>& client_cert,
  35     ScopedEVP_PKEY private_key) {
  36   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
  37   net::OpenSSLClientKeyStore::GetInstance()->RecordClientCertPrivateKey(
  38       client_cert.get(), private_key.get());
  39 }
  40
  41 void StartClientCertificateRequest(
  42     const net::SSLCertRequestInfo* cert_request_info,
  43     const chrome::SelectCertificateCallback& callback) {
  44   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
  45
  46   // Ensure that callback(NULL) is posted as a task on the UI thread
  47   // in case of an error.
  48   base::Closure post_task_closure = base::Bind(
  49       base::IgnoreResult(&content::BrowserThread::PostTask),
  50       content::BrowserThread::UI,
  51       FROM_HERE,
  52       base::Bind(callback, scoped_refptr<net::X509Certificate>()));
  53
  54   base::ScopedClosureRunner guard(post_task_closure);
  55
  56   // Build the |key_types| JNI parameter, as a String[]
  57   std::vector<std::string> key_types;
  58   for (size_t n = 0; n < cert_request_info->cert_key_types.size(); ++n) {
  59     switch (cert_request_info->cert_key_types[n]) {
  60       case net::CLIENT_CERT_RSA_SIGN:
  61         key_types.push_back("RSA");
  62         break;
  63       case net::CLIENT_CERT_DSS_SIGN:
  64         key_types.push_back("DSA");
  65         break;
  66       case net::CLIENT_CERT_ECDSA_SIGN:
  67         key_types.push_back("ECDSA");
  68         break;
  69       default:
  70         // Ignore unknown types.
  71         break;
  72     }
  73   }
  74
  75   JNIEnv* env = base::android::AttachCurrentThread();
  76   ScopedJavaLocalRef<jobjectArray> key_types_ref =
  77       base::android::ToJavaArrayOfStrings(env, key_types);
  78   if (key_types_ref.is_null()) {
  79     LOG(ERROR) << "Could not create key types array (String[])";
  80     return;
  81   }
  82
  83   // Build the |encoded_principals| JNI parameter, as a byte[][]
  84   ScopedJavaLocalRef<jobjectArray> principals_ref =
  85       base::android::ToJavaArrayOfByteArray(
  86           env, cert_request_info->cert_authorities);
  87   if (principals_ref.is_null()) {
  88     LOG(ERROR) << "Could not create principals array (byte[][])";
  89     return;
  90   }
  91
  92   // Build the |host_name| and |port| JNI parameters, as a String and
  93   // a jint.
  94   net::HostPortPair host_and_port =
  95       net::HostPortPair::FromString(cert_request_info->host_and_port);
  96
  97   ScopedJavaLocalRef<jstring> host_name_ref =
  98       base::android::ConvertUTF8ToJavaString(env, host_and_port.host());
  99   if (host_name_ref.is_null()) {
 100     LOG(ERROR) << "Could not extract host name from: '"
 101                << cert_request_info->host_and_port << "'";
 102     return;
 103   }
 104
 105   // Create a copy of the callback on the heap so that its address
 106   // and ownership can be passed through and returned from Java via JNI.
 107   scoped_ptr<chrome::SelectCertificateCallback> request(
 108       new chrome::SelectCertificateCallback(callback));
 109
 110   jint request_id = reinterpret_cast<jint>(request.get());
 111
 112   if (!chrome::android::
 113       Java_SSLClientCertificateRequest_selectClientCertificate(
 114           env, request_id, key_types_ref.obj(), principals_ref.obj(),
 115           host_name_ref.obj(), host_and_port.port())) {
 116     return;
 117   }
 118
 119   ignore_result(guard.Release());
 120
 121   // Ownership was transferred to Java.
 122   chrome::SelectCertificateCallback* ALLOW_UNUSED dummy =
 123       request.release();
 124 }
 125
 126 }  // namespace
 127
 128 namespace android {
 129
 130 // Called from JNI on request completion/result.
 131 // |env| is the current thread's JNIEnv.
 132 // |clazz| is the SSLClientCertificateRequest JNI class reference.
 133 // |request_id| is the id passed to
 134 // Java_SSLClientCertificateRequest_selectClientCertificate() in Start().
 135 // |encoded_chain_ref| is a JNI reference to a Java array of byte arrays,
 136 // each item holding a DER-encoded X.509 certificate.
 137 // |private_key_ref| is the platform PrivateKey object JNI reference for
 138 // the client certificate.
 139 // Note: both |encoded_chain_ref| and |private_key_ref| will be NULL if
 140 // the user didn't select a certificate.
 141 static void OnSystemRequestCompletion(
 142     JNIEnv* env,
 143     jclass clazz,
 144     jint request_id,
 145     jobjectArray encoded_chain_ref,
 146     jobject private_key_ref) {
 147   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 148
 149   // Take back ownership of the request object.
 150   scoped_ptr<chrome::SelectCertificateCallback> callback(
 151       reinterpret_cast<chrome::SelectCertificateCallback*>(request_id));
 152
 153   // Ensure that callback(NULL) is called in case of an error.
 154   base::Closure null_closure =
 155       base::Bind(*callback, scoped_refptr<net::X509Certificate>());
 156
 157   base::ScopedClosureRunner guard(null_closure);
 158
 159   if (encoded_chain_ref == NULL || private_key_ref == NULL) {
 160     LOG(ERROR) << "Client certificate request cancelled";
 161     return;
 162   }
 163
 164   // Convert the encoded chain to a vector of strings.
 165   std::vector<std::string> encoded_chain_strings;
 166   if (encoded_chain_ref) {
 167     base::android::JavaArrayOfByteArrayToStringVector(
 168         env, encoded_chain_ref, &encoded_chain_strings);
 169   }
 170
 171   std::vector<base::StringPiece> encoded_chain;
 172   for (size_t n = 0; n < encoded_chain_strings.size(); ++n)
 173     encoded_chain.push_back(encoded_chain_strings[n]);
 174
 175   // Create the X509Certificate object from the encoded chain.
 176   scoped_refptr<net::X509Certificate> client_cert(
 177       net::X509Certificate::CreateFromDERCertChain(encoded_chain));
 178   if (!client_cert.get()) {
 179     LOG(ERROR) << "Could not decode client certificate chain";
 180     return;
 181   }
 182
 183   // Create an EVP_PKEY wrapper for the private key JNI reference.
 184   ScopedEVP_PKEY private_key(
 185       net::android::GetOpenSSLPrivateKeyWrapper(private_key_ref));
 186   if (!private_key.get()) {
 187     LOG(ERROR) << "Could not create OpenSSL wrapper for private key";
 188     return;
 189   }
 190
 191   ignore_result(guard.Release());
 192
 193   // RecordClientCertificateKey() must be called on the I/O thread,
 194   // before the callback is called with the selected certificate on
 195   // the UI thread.
 196   content::BrowserThread::PostTaskAndReply(
 197       content::BrowserThread::IO,
 198       FROM_HERE,
 199       base::Bind(&RecordClientCertificateKey,
 200                  client_cert,
 201                  base::Passed(&private_key)),
 202       base::Bind(*callback, client_cert));
 203 }
 204
 205 bool RegisterSSLClientCertificateRequestAndroid(JNIEnv* env) {
 206   return RegisterNativesImpl(env);
 207 }
 208
 209 }  // namespace android
 210
 211 void ShowSSLClientCertificateSelector(
 212     content::WebContents* contents,
 213     const net::HttpNetworkSession* network_session,
 214     net::SSLCertRequestInfo* cert_request_info,
 215     const chrome::SelectCertificateCallback& callback) {
 216   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 217   StartClientCertificateRequest(cert_request_info, callback);
 218 }
 219
 220 }  // namespace chrome