1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
// Copyright 2013 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROMEOS_ASH_COMPONENTS_NETWORK_CLIENT_CERT_RESOLVER_H_
#define CHROMEOS_ASH_COMPONENTS_NETWORK_CLIENT_CERT_RESOLVER_H_
#include <set>
#include <string>
#include <vector>
#include "base/component_export.h"
#include "base/containers/flat_set.h"
#include "base/functional/callback_helpers.h"
#include "base/memory/raw_ptr.h"
#include "base/memory/weak_ptr.h"
#include "base/observer_list.h"
#include "base/scoped_observation.h"
#include "base/sequence_checker.h"
#include "base/time/time.h"
#include "chromeos/ash/components/network/client_cert_util.h"
#include "chromeos/ash/components/network/network_cert_loader.h"
#include "chromeos/ash/components/network/network_policy_observer.h"
#include "chromeos/ash/components/network/network_state_handler.h"
#include "chromeos/ash/components/network/network_state_handler_observer.h"
namespace base {
class Clock;
class Value;
} // namespace base
namespace ash {
class ManagedNetworkConfigurationHandler;
class NetworkState;
namespace internal {
struct NetworkAndMatchingCert;
} // namespace internal
// Observes the known networks. If a network is configured with a client
// certificate pattern, this class searches for a matching client certificate.
// Each time it finds a match, it configures the network accordingly.
class COMPONENT_EXPORT(CHROMEOS_NETWORK) ClientCertResolver
: public NetworkStateHandlerObserver,
public NetworkCertLoader::Observer,
public NetworkPolicyObserver {
public:
class Observer {
public:
Observer& operator=(const Observer&) = delete;
// Called every time resolving of client certificate patterns finishes,
// no resolve requests are pending and no tasks are running.
// |network_properties_changed| will be true if any network properties were
// changed by this resolver since the last notification.
virtual void ResolveRequestCompleted(bool network_properties_changed) = 0;
protected:
virtual ~Observer() {}
};
ClientCertResolver();
ClientCertResolver(const ClientCertResolver&) = delete;
ClientCertResolver& operator=(const ClientCertResolver&) = delete;
~ClientCertResolver() override;
void Init(NetworkStateHandler* network_state_handler,
ManagedNetworkConfigurationHandler* managed_network_config_handler);
void AddObserver(Observer* observer);
void RemoveObserver(Observer* observer);
// Returns true if any resolve tasks are running. Every time a task finishes
// and no further requests are pending, a notification is sent, see
// |Observer|.
bool IsAnyResolveTaskRunning() const;
// Sets the clock for testing. This clock is used when checking the
// certificates for expiration.
void SetClockForTesting(base::Clock* clock);
// Returns true and sets the Shill properties that have to be configured in
// |shill_properties| if the client certificate could be resolved according to
// |client_cert_config|.
// Returns false otherwise and sets empty Shill properties to clear the
// certificate configuration.
// Note that it uses the global clock when checking the certificates for
// expiration.
static bool ResolveClientCertificateSync(
const client_cert::ConfigType client_cert_type,
const client_cert::ClientCertConfig& client_cert_config,
base::Value::Dict* shill_properties);
// Allows overwriting the function which gets the client certificate
// provisioning profile id of a certificate. This is necessary for unit tests,
// because there we use an NSS soft token which does not support the custom
// attributes used for storing the id. Calling this will overwrite the
// behavior until the returned ScopedClosureRunner is destructed, which will
// reset to the original behavior.
using ProvisioningProfileIdGetter =
base::RepeatingCallback<std::string(CERTCertificate* cert)>;
static base::ScopedClosureRunner SetProvisioningIdForCertGetterForTesting(
ProvisioningProfileIdGetter getter);
private:
// NetworkStateHandlerObserver overrides
void NetworkListChanged() override;
void NetworkConnectionStateChanged(const NetworkState* network) override;
// NetworkCertLoader::Observer overrides
void OnCertificatesLoaded() override;
// NetworkPolicyObserver overrides
void PolicyAppliedToNetwork(const std::string& service_path) override;
// Check which networks of |networks| are configured with a client certificate
// pattern. Search for certificates, on the worker thread, and configure the
// networks for which a matching cert is found (see ConfigureCertificates).
void ResolveNetworks(const NetworkStateHandler::NetworkStateList& networks);
// Resolves certificates for the pending networks. This will always trigger a
// ResolveRequestCompleted notification, even if the queue is empty.
void ResolvePendingNetworks();
// |matches| contains networks for which a matching certificate was found.
// Configures these networks.
void ConfigureCertificates(
std::vector<internal::NetworkAndMatchingCert> matches);
// Trigger a ResolveRequestCompleted event on all observers.
void NotifyResolveRequestCompleted();
// Returns Time::Now() unless a mock clock has been installed with
// SetClockForTesting, in which case the time according to that clock is used
// instead.
base::Time Now() const;
base::ObserverList<Observer, true>::Unchecked observers_;
// Tracks which network configurations ClientCertResolver is aware of, to be
// able to detect newly created networks for which certificate resolution may
// be necessary. The elements in the set are shill service paths.
base::flat_set<std::string> known_networks_service_paths_;
// The list of network paths that still have to be resolved.
std::set<std::string> queued_networks_to_resolve_;
// True if currently a resolve task is running.
bool resolve_task_running_;
// True if any network properties were changed since the last notification to
// observers.
bool network_properties_changed_;
// Unowned associated (global or test) instance.
raw_ptr<NetworkStateHandler> network_state_handler_;
base::ScopedObservation<NetworkStateHandler, NetworkStateHandlerObserver>
network_state_handler_observer_{this};
// Unowned associated (global or test) instance.
raw_ptr<ManagedNetworkConfigurationHandler> managed_network_config_handler_;
// Can be set for testing.
raw_ptr<base::Clock> testing_clock_;
SEQUENCE_CHECKER(sequence_checker_);
base::WeakPtrFactory<ClientCertResolver> weak_ptr_factory_{this};
};
} // namespace ash
#endif // CHROMEOS_ASH_COMPONENTS_NETWORK_CLIENT_CERT_RESOLVER_H_
|
