1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_SSL_CLIENT_CERT_IDENTITY_H_
#define NET_SSL_CLIENT_CERT_IDENTITY_H_
#include "base/functional/callback.h"
#include "base/time/time.h"
#include "net/base/net_export.h"
#include "net/cert/x509_certificate.h"
namespace base {
class Time;
}
namespace net {
class SSLPrivateKey;
// Represents a client certificate and a promise to retrieve the associated
// private key.
class NET_EXPORT ClientCertIdentity {
public:
explicit ClientCertIdentity(scoped_refptr<net::X509Certificate> cert);
virtual ~ClientCertIdentity();
// Returns the certificate.
X509Certificate* certificate() const { return cert_.get(); }
// Passes the private key to |private_key_callback| on the same sequence
// AcquirePrivateKey is called on, or nullptr on error. The callback may be
// run synchronously or asynchronously. The caller is responsible for
// keeping the ClientCertIdentity alive until the callback is run.
virtual void AcquirePrivateKey(
base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
private_key_callback) = 0;
// Acquires the private key for |identity|, taking ownership of |identity| so
// that the caller does not need to manage its lifetime. The other semantics
// are the same as for AcquirePrivateKey above.
static void SelfOwningAcquirePrivateKey(
std::unique_ptr<ClientCertIdentity> identity,
base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
private_key_callback);
// Sets the intermediates of |certificate()| to |intermediates|. Note that
// this will change the value of |certificate()|, and any references that
// were retained to the previous value will not reflect the updated
// intermediates list.
void SetIntermediates(
std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates);
private:
scoped_refptr<net::X509Certificate> cert_;
};
// Comparator for use in STL algorithms that will sort client certificates by
// order of preference.
// Returns true if |a| is more preferable than |b|, allowing it to be used
// with any algorithm that compares according to strict weak ordering.
//
// Criteria include:
// - Prefer certificates that have a longer validity period (later
// expiration dates)
// - If equal, prefer certificates that were issued more recently
// - If equal, prefer shorter chains (if available)
class NET_EXPORT_PRIVATE ClientCertIdentitySorter {
public:
ClientCertIdentitySorter();
bool operator()(const std::unique_ptr<ClientCertIdentity>& a,
const std::unique_ptr<ClientCertIdentity>& b) const;
private:
base::Time now_;
};
using ClientCertIdentityList = std::vector<std::unique_ptr<ClientCertIdentity>>;
} // namespace net
#endif // NET_SSL_CLIENT_CERT_IDENTITY_H_
|
