1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/device_bound_sessions/unexportable_key_service_factory.h"
#include "base/logging.h"
#include "components/unexportable_keys/unexportable_key_service.h"
#include "components/unexportable_keys/unexportable_key_service_impl.h"
#include "components/unexportable_keys/unexportable_key_task_manager.h"
#include "crypto/unexportable_key.h"
namespace {
#if BUILDFLAG(IS_MAC)
// TODO(crbug.com/384055845): Use the correct value for Secure Enclave
constexpr char kKeychainAccessGroup[] =
".org.chromium.Chromium.unexportable-keys";
#endif // BUILDFLAG(IS_MAC)
// Returns a newly created task manager instance, or nullptr if unexportable
// keys are not available.
std::unique_ptr<unexportable_keys::UnexportableKeyTaskManager>
CreateTaskManagerInstance() {
crypto::UnexportableKeyProvider::Config config{
#if BUILDFLAG(IS_MAC)
.keychain_access_group = kKeychainAccessGroup,
#endif // BUILDFLAG(IS_MAC)
};
if (!unexportable_keys::UnexportableKeyServiceImpl::
IsUnexportableKeyProviderSupported(config)) {
return nullptr;
}
return std::make_unique<unexportable_keys::UnexportableKeyTaskManager>(
std::move(config));
}
// Returns an `UnexportableKeyTaskManager` instance that is shared across the
// process hosting the network service, or nullptr if unexportable keys are not
// available. This function caches availability, so any flags that may change
// it must be set before the first call.
//
// Note: this instance is currently accessible only to
// `UnexportableKeyServiceFactory`. The getter can be moved to some common place
// if there is a need.
unexportable_keys::UnexportableKeyTaskManager* GetSharedTaskManagerInstance() {
static base::NoDestructor<
std::unique_ptr<unexportable_keys::UnexportableKeyTaskManager>>
instance(CreateTaskManagerInstance());
return instance->get();
}
unexportable_keys::UnexportableKeyService* (*g_mock_factory)() = nullptr;
} // namespace
namespace net::device_bound_sessions {
// Currently there is another UnexportableKeyServiceFactory in the
// chrome/browser/signin code in the browser process. They do not share code,
// currently code for other factory is here:
// https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/signin/bound_session_credentials/unexportable_key_service_factory.cc
// It is not an issue if both factories are hosted in the browser process.
// static
UnexportableKeyServiceFactory* UnexportableKeyServiceFactory::GetInstance() {
static base::NoDestructor<UnexportableKeyServiceFactory> instance;
return instance.get();
}
void UnexportableKeyServiceFactory::SetUnexportableKeyFactoryForTesting(
unexportable_keys::UnexportableKeyService* (*func)()) {
if (g_mock_factory) {
CHECK(!func);
g_mock_factory = nullptr;
} else {
g_mock_factory = func;
}
}
unexportable_keys::UnexportableKeyService*
UnexportableKeyServiceFactory::GetShared() {
if (g_mock_factory) {
return g_mock_factory();
}
if (!has_created_service_) {
has_created_service_ = true;
unexportable_keys::UnexportableKeyTaskManager* task_manager =
GetSharedTaskManagerInstance();
if (task_manager) {
unexportable_key_service_ =
std::make_unique<unexportable_keys::UnexportableKeyServiceImpl>(
*task_manager);
}
}
return unexportable_key_service_.get();
}
UnexportableKeyServiceFactory*
UnexportableKeyServiceFactory::GetInstanceForTesting() {
return new UnexportableKeyServiceFactory();
}
UnexportableKeyServiceFactory::UnexportableKeyServiceFactory() = default;
UnexportableKeyServiceFactory::~UnexportableKeyServiceFactory() = default;
} // namespace net::device_bound_sessions
|
