File: soft_bind_attestation_flow_impl.h

package info (click to toggle)
chromium 139.0.7258.127-1
  • links: PTS, VCS
  • area: main
  • in suites:
  • size: 6,122,068 kB
  • sloc: cpp: 35,100,771; ansic: 7,163,530; javascript: 4,103,002; python: 1,436,920; asm: 946,517; xml: 746,709; pascal: 187,653; perl: 88,691; sh: 88,436; objc: 79,953; sql: 51,488; cs: 44,583; fortran: 24,137; makefile: 22,147; tcl: 15,277; php: 13,980; yacc: 8,984; ruby: 7,485; awk: 3,720; lisp: 3,096; lex: 1,327; ada: 727; jsp: 228; sed: 36
file content (118 lines) | stat: -rw-r--r-- 4,962 bytes parent folder | download | duplicates (6)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef CHROME_BROWSER_ASH_ATTESTATION_SOFT_BIND_ATTESTATION_FLOW_IMPL_H_
#define CHROME_BROWSER_ASH_ATTESTATION_SOFT_BIND_ATTESTATION_FLOW_IMPL_H_

#include <string>

#include "base/functional/callback.h"
#include "base/memory/raw_ptr.h"
#include "base/timer/timer.h"
#include "chrome/browser/ash/attestation/certificate_util.h"
#include "chrome/browser/ash/attestation/soft_bind_attestation_flow.h"
#include "chromeos/ash/components/attestation/attestation_flow.h"
#include "chromeos/ash/components/dbus/attestation/attestation_client.h"
#include "components/account_id/account_id.h"
#include "third_party/boringssl/src/include/openssl/evp.h"

namespace ash {
namespace attestation {

// Generates certificates asynchronously for soft key binding.
class SoftBindAttestationFlowImpl : public SoftBindAttestationFlow {
 public:
  SoftBindAttestationFlowImpl();
  ~SoftBindAttestationFlowImpl() override;

  SoftBindAttestationFlowImpl(const SoftBindAttestationFlowImpl&) = delete;
  SoftBindAttestationFlowImpl(SoftBindAttestationFlowImpl&&) = delete;
  SoftBindAttestationFlowImpl& operator=(const SoftBindAttestationFlowImpl&) =
      delete;
  SoftBindAttestationFlowImpl& operator=(SoftBindAttestationFlowImpl&&) =
      delete;

  // !!! WARNING !!! This API should only be called by the browser itself.
  // Any new usage of this API should undergo security review.
  // Must be invoked on the UI thread due to AttestationClient requirements.
  // If the call times out before request completion, the request will
  // continue in the background so long as this object is not freed.
  void GetCertificate(Callback callback,
                      const AccountId& account_id,
                      const std::string& user_key) override;

  void SetAttestationFlowForTesting(
      std::unique_ptr<AttestationFlow> attestation_flow);

 private:
  // Encapsulates data necessary to construct the certificate chain. This data
  // holder is passed along through the entire callback flow, ultimately
  // returning the completed cert chain via its own callback.
  class Session {
   public:
    Session(Callback callback,
            AccountId account_id,
            const std::string& user_key);
    ~Session();
    Session(const Session&) = delete;
    Session(Session&&) = delete;
    Session& operator=(const Session&) = delete;
    Session& operator=(Session&&) = delete;

    bool IsTimerRunning() const;
    void StopTimer();
    // Returns false if the maximum number of certificate fetch retries (timer
    // resets) has been reached.
    bool ResetTimer();
    const AccountId& GetAccountId() const;
    const std::string& GetUserKey() const;
    void ReportFailure(const std::string& error_message);
    void ReportSuccess(const std::vector<std::string>& certificate_chain);

   private:
    void OnTimeout();

    Callback callback_;
    base::RetainingOneShotTimer timer_;
    const AccountId account_id_;
    std::string user_key_;
    int max_retries_ = 3;
    base::WeakPtrFactory<SoftBindAttestationFlowImpl::Session>
        weak_ptr_factory_{this};
  };

  void GetCertificateInternal(bool force_new_key,
                              std::unique_ptr<Session> session);
  void OnCertificateReady(std::unique_ptr<Session> session,
                          AttestationStatus operation_status,
                          const std::string& certificate_chain);
  EVP_PKEY* GetLeafCertSpki(const std::string& certificate_chain);
  void OnCertificateSigned(std::unique_ptr<Session> session,
                           const std::string& tbs_cert,
                           const std::string& certificate_chain,
                           bool should_renew,
                           const ::attestation::SignReply& reply);
  bool IsAttestationAllowedByPolicy() const;
  CertificateExpiryStatus CheckExpiry(const std::string& certificate_chain);
  EVP_PKEY* GetLeafSubjectPublicKeyInfo(const std::string& certificate_chain);
  void RenewCertificateCallback(const std::string& old_certificate_chain,
                                AttestationStatus operation_status,
                                const std::string& certificate_chain);
  // Returns true if the cert was successfully generated, and false otherwise
  bool GenerateLeafCert(EVP_PKEY* key,
                        base::Time not_valid_before,
                        base::Time not_valid_after,
                        std::string* pem_encoded_cert);

  const raw_ptr<AttestationClient, DanglingUntriaged> attestation_client_;
  std::unique_ptr<AttestationFlow> attestation_flow_;
  std::set<std::string> renewals_in_progress_;

  base::WeakPtrFactory<SoftBindAttestationFlowImpl> weak_ptr_factory_{this};
};

}  // namespace attestation
}  // namespace ash

#endif  // CHROME_BROWSER_ASH_ATTESTATION_SOFT_BIND_ATTESTATION_FLOW_IMPL_H_