nss_util.cc revision 5d1f7b1de12d16ceb2c938c56701a3e8bfa558f7
15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util_internal.h" 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <nss.h> 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <pk11pub.h> 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <plarena.h> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prerror.h> 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prinit.h> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prtime.h> 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <secmod.h> 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#if defined(OS_OPENBSD) 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/mount.h> 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/param.h> 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 21a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include <map> 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/bind.h" 25a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "base/callback.h" 26f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/cpu.h" 272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/debug/alias.h" 28f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/debug/stack_trace.h" 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/environment.h" 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/file_util.h" 312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/files/file_path.h" 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/lazy_instance.h" 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/logging.h" 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/scoped_ptr.h" 355d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/message_loop/message_loop.h" 362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/metrics/histogram.h" 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/native_library.h" 38a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "base/stl_util.h" 39868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "base/strings/stringprintf.h" 40f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/threading/thread_checker.h" 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/threading/thread_restrictions.h" 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "build/build_config.h" 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// defined, such as on Mac and Windows, we use NSS for SSL only -- we don't 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// use NSS for crypto or certificate verification, and we don't use the NSS 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// certificate and key databases. 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/synchronization/lock.h" 505d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "crypto/nss_crypto_module_delegate.h" 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace crypto { 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kNSSDatabaseName[] = "Real NSS database"; 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Constants for loading the Chrome OS TPM-backed PKCS #11 library. 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsModuleName[] = "Chaps"; 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsPath[] = "libchaps.so"; 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Fake certificate authority database used for testing. 652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const base::FilePath::CharType kReadOnlyCertDB[] = 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb"); 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)std::string GetNSSErrorMessage() { 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string result; 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PR_GetErrorTextLength()) { 72c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) scoped_ptr<char[]> error_text(new char[PR_GetErrorTextLength() + 1]); 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRInt32 copied = PR_GetErrorText(error_text.get()); 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result = std::string(error_text.get(), copied); 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) result = base::StringPrintf("NSS error code: %d", PR_GetError()); 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetDefaultConfigDirectory() { 83a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::FilePath dir = base::GetHomeDir(); 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (dir.empty()) { 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to get home directory."; 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir = dir.AppendASCII(".pki").AppendASCII("nssdb"); 89a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!base::CreateDirectory(dir)) { 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to create " << dir.value() << " directory."; 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir.clear(); 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 93a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "DefaultConfigDirectory: " << dir.value(); 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 97d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// On non-Chrome OS platforms, return the default config directory. On Chrome OS 98d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// test images, return a read-only directory with fake root CA certs (which are 99d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// used by the local Google Accounts server mock we use when testing our login 100d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// code). On Chrome OS non-test images (where the read-only directory doesn't 101d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// exist), return an empty path. 1022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetInitialConfigDirectory() { 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 104d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) base::FilePath database_dir = base::FilePath(kReadOnlyCertDB); 105d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) if (!base::PathExists(database_dir)) 106d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) database_dir.clear(); 107d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) return database_dir; 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return GetDefaultConfigDirectory(); 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This callback for NSS forwards all requests to a caller-specified 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// CryptoModuleBlockingPasswordDelegate object. 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) { 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) crypto::CryptoModuleBlockingPasswordDelegate* delegate = 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg); 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (delegate) { 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool cancelled = false; 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string password = delegate->RequestPassword(PK11_GetTokenName(slot), 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) retry != PR_FALSE, 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) &cancelled); 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (cancelled) 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char* result = PORT_Strdup(password.c_str()); 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) password.replace(0, password.size(), password.size(), 0); 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DLOG(ERROR) << "PK11 password requested with NULL arg"; 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// NSS creates a local cache of the sqlite database if it detects that the 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// filesystem the database is on is much slower than the local disk. The 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection doesn't work with the latest versions of sqlite, such as 3.6.22 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561). So we set 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection when database_dir is on NFS. See http://crbug.com/48585. 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(wtc): port this function to other USE_NSS platforms. It is defined 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// only for OS_LINUX and OS_OPENBSD simply because the statfs structure 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is OS-specific. 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Because this function sets an environment variable it must be run before we 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// go multi-threaded. 1462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) { 1475d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool db_on_nfs = false; 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_LINUX) 1495d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) file_util::FileSystemType fs_type = file_util::FILE_SYSTEM_UNKNOWN; 1505d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (file_util::GetFileSystemType(database_dir, &fs_type)) 1515d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) db_on_nfs = (fs_type == file_util::FILE_SYSTEM_NFS); 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(OS_OPENBSD) 1535d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) struct statfs buf; 1545d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (statfs(database_dir.value().c_str(), &buf) == 0) 1555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) db_on_nfs = (strcmp(buf.f_fstypename, MOUNT_NFS) == 0); 1565d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#else 1575d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) NOTIMPLEMENTED(); 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (db_on_nfs) { 1615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 1625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) static const char kUseCacheEnvVar[] = "NSS_SDB_USE_CACHE"; 1635d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!env->HasVar(kUseCacheEnvVar)) 1645d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) env->SetVar(kUseCacheEnvVar, "yes"); 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A singleton to initialize/deinitialize NSPR. 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Separate from the NSS singleton because we initialize NSPR on the UI thread. 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Now that we're leaking the singleton, we could merge back with the NSS 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// singleton. 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSPRInitSingleton { 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>; 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSPRInitSingleton() { 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSPRInitSingleton() { 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PL_ArenaFinish(); 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRStatus prstatus = PR_Cleanup(); 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (prstatus != PR_SUCCESS) 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSPRInitSingleton>::Leaky 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton = LAZY_INSTANCE_INITIALIZER; 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This is a LazyInstance so that it will be deleted automatically when the 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// unittest exits. NSSInitSingleton is a LeakySingleton, so it would not be 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// deleted if it were a regular member. 1992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::LazyInstance<base::ScopedTempDir> g_test_nss_db_dir = 2002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LAZY_INSTANCE_INITIALIZER; 2012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Force a crash with error info on NSS_NoDB_Init failure. 2032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CrashOnNSSInitFailure() { 2042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int nss_error = PR_GetError(); 2052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int os_error = PR_GetOSError(); 2062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&nss_error); 2072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&os_error); 2082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(ERROR) << "Error initializing NSS without a persistent database: " 2092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) << GetNSSErrorMessage(); 2102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(FATAL) << "nss_error=" << nss_error << ", os_error=" << os_error; 2112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 213a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 214a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)class ChromeOSUserData { 215a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public: 216a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ChromeOSUserData(ScopedPK11Slot public_slot, bool is_primary_user) 217a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) : public_slot_(public_slot.Pass()), 218a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) is_primary_user_(is_primary_user) {} 219a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ~ChromeOSUserData() { 220a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (public_slot_ && !is_primary_user_) { 221a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SECStatus status = SECMOD_CloseUserDB(public_slot_.get()); 222a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (status != SECSuccess) 223a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError(); 224a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 225a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 226a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 227a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPublicSlot() { 228a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot( 229a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public_slot_ ? PK11_ReferenceSlot(public_slot_.get()) : NULL); 230a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 231a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 232a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPrivateSlot( 233a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 234a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (private_slot_) 235a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get())); 236a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) 237a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) tpm_ready_callback_list_.push_back(callback); 238a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(); 239a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 240a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 241a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void SetPrivateSlot(ScopedPK11Slot private_slot) { 242a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(!private_slot_); 243a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) private_slot_ = private_slot.Pass(); 244a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 245a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList callback_list; 246a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback_list.swap(tpm_ready_callback_list_); 247a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) for (SlotReadyCallbackList::iterator i = callback_list.begin(); 248a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) i != callback_list.end(); 249a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ++i) { 250a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) (*i).Run(ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()))); 251a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 252a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 253a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 254a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) private: 255a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot public_slot_; 256a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot private_slot_; 257a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool is_primary_user_; 258a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 259a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::vector<base::Callback<void(ScopedPK11Slot)> > 260a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList; 261a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList tpm_ready_callback_list_; 262a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)}; 263a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 264a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 2655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSSInitSingleton { 2665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 2675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 2685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void OpenPersistentNSSDB() { 269f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 270f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 2715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!chromeos_user_logged_in_) { 2725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporarily allow it until we fix http://crbug.com/70119 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chromeos_user_logged_in_ = true; 2765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This creates another DB slot in NSS that is read/write, unlike 2785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the fake root CA cert DB and the "default" crypto key 2795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // provider, which are still read-only (because we initialized 2805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NSS before we had a cryptohome mounted). 2815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_ = OpenUserDB(GetDefaultConfigDirectory(), 2825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kNSSDatabaseName); 2835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 286a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) PK11SlotInfo* OpenPersistentNSSDBForPath(const base::FilePath& path) { 287a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 288a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // NSS is allowed to do IO on the current thread since dispatching 289a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // to a dedicated thread would still have the affect of blocking 290a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // the current thread, due to NSS's internal locking requirements 291a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 292a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 293a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::FilePath nssdb_path = path.AppendASCII(".pki").AppendASCII("nssdb"); 294a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!base::CreateDirectory(nssdb_path)) { 295a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) LOG(ERROR) << "Failed to create " << nssdb_path.value() << " directory."; 296a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return NULL; 297a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 298a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return OpenUserDB(nssdb_path, kNSSDatabaseName); 299a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 300a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 3015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void EnableTPMTokenForNSS() { 302f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 303f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 3041e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // If this gets set, then we'll use the TPM for certs with 3051e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // private keys, otherwise we'll fall back to the software 3061e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // implementation. 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_token_enabled_for_nss_ = true; 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 310a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool IsTPMTokenEnabledForNSS() { 311a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 312a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return tpm_token_enabled_for_nss_; 313a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 314a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 315f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) bool InitializeTPMToken(int token_slot_id) { 316f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 317f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 3185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If EnableTPMTokenForNSS hasn't been called, return false. 3195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!tpm_token_enabled_for_nss_) 3205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If everything is already initialized, then return true. 3235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_ && tpm_slot_) 3245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 3255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This tries to load the Chaps module so NSS can talk to the hardware 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TPM. 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!chaps_module_) { 3295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_ = LoadModule( 3305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsModuleName, 3315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsPath, 3325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For more details on these parameters, see: 3335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://developer.mozilla.org/en/PKCS11_Module_Specs 3345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // slotFlags=[PublicCerts] -- Certificates and public keys can be 3355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read from this slot without requiring a call to C_Login. 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // askpw=only -- Only authenticate to the token when necessary. 3375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\""); 3381e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!chaps_module_ && test_slot_) { 3391e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // chromeos_unittests try to test the TPM initialization process. If we 3401e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // have a test DB open, pretend that it is the TPM slot. 3411e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) tpm_slot_ = PK11_ReferenceSlot(test_slot_); 3421e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return true; 3431e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) } 3445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_){ 3461e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) tpm_slot_ = GetTPMSlotForId(token_slot_id); 3475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 348a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!tpm_slot_) 349a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 350a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 351a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) TPMReadyCallbackList callback_list; 352a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback_list.swap(tpm_ready_callback_list_); 353a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) for (TPMReadyCallbackList::iterator i = 354a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback_list.begin(); 355a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) i != callback_list.end(); 356a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ++i) { 357a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) (*i).Run(); 358a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 359a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 360a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 3635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 365a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool IsTPMTokenReady(const base::Closure& callback) { 366a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) { 367a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // Cannot DCHECK in the general case yet, but since the callback is 368a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // a new addition to the API, DCHECK to make sure at least the new uses 369a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // don't regress. 370a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 371a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } else if (!thread_checker_.CalledOnValidThread()) { 372a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // TODO(mattm): Change to DCHECK when callers have been fixed. 373f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "Called on wrong thread.\n" 374f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << base::debug::StackTrace().ToString(); 3755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 377a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (tpm_slot_ != NULL) 378a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 379a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 380a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) 381a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) tpm_ready_callback_list_.push_back(callback); 382a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 383a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 3845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3861e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // Note that CK_SLOT_ID is an unsigned long, but cryptohome gives us the slot 3871e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // id as an int. This should be safe since this is only used with chaps, which 3881e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // we also control. 3891e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) PK11SlotInfo* GetTPMSlotForId(CK_SLOT_ID slot_id) { 390f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 391f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 3921e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!chaps_module_) 3931e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return NULL; 3941e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) 395a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(3) << "Poking chaps module."; 3961e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) SECStatus rv = SECMOD_UpdateSlotList(chaps_module_); 3971e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (rv != SECSuccess) 3981e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) PLOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError(); 3991e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) 4001e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) PK11SlotInfo* slot = SECMOD_LookupSlot(chaps_module_->moduleID, slot_id); 4011e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!slot) 4021e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) LOG(ERROR) << "TPM slot " << slot_id << " not found."; 4031e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return slot; 4045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 405a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 406a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool InitializeNSSForChromeOSUser( 407a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& email, 408a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 409a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool is_primary_user, 410a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::FilePath& path) { 411a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 412a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()) { 413a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // This user already exists in our mapping. 414a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << username_hash << " already initialized."; 415a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 416a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 417a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot public_slot; 418a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (is_primary_user) { 419a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "Primary user, using GetPublicNSSKeySlot()"; 420a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public_slot.reset(GetPublicNSSKeySlot()); 421a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } else { 422a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "Opening NSS DB " << path.value(); 423a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public_slot.reset(OpenPersistentNSSDBForPath(path)); 424a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 425a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash] = 426a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) new ChromeOSUserData(public_slot.Pass(), is_primary_user); 427a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 428a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 429a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 430a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void InitializeTPMForChromeOSUser(const std::string& username_hash, 431a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CK_SLOT_ID slot_id) { 432a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 433a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 434a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash] 435a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ->SetPrivateSlot(ScopedPK11Slot(GetTPMSlotForId(slot_id))); 436a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 437a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 438a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void InitializePrivateSoftwareSlotForChromeOSUser( 439a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 440a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 4415d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) VLOG(1) << "using software private slot for " << username_hash; 442a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 443a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash]->SetPrivateSlot( 444a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash]->GetPublicSlot()); 445a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 446a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 447a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPublicSlotForChromeOSUser( 448a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 449a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 4505d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 4515d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (username_hash.empty()) { 4525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DVLOG(2) << "empty username_hash"; 4535d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return ScopedPK11Slot(); 4545d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 4555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 456a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (test_slot_) { 457a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "returning test_slot_ for " << username_hash; 458a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(PK11_ReferenceSlot(test_slot_)); 459a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 460a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 461a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (chromeos_user_map_.find(username_hash) == chromeos_user_map_.end()) { 462a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) LOG(ERROR) << username_hash << " not initialized."; 463a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(); 464a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 465a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return chromeos_user_map_[username_hash]->GetPublicSlot(); 466a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 467a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 468a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPrivateSlotForChromeOSUser( 469a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 470a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 471a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 4725d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 4735d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (username_hash.empty()) { 4745d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DVLOG(2) << "empty username_hash"; 4755d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!callback.is_null()) { 4765d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::MessageLoop::current()->PostTask( 4775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) FROM_HERE, base::Bind(callback, base::Passed(ScopedPK11Slot()))); 4785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 4795d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return ScopedPK11Slot(); 4805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 4815d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 482a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 483a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 484a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (test_slot_) { 485a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "returning test_slot_ for " << username_hash; 486a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(PK11_ReferenceSlot(test_slot_)); 487a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 488a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 489a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return chromeos_user_map_[username_hash]->GetPrivateSlot(callback); 490a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 4915d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 4925d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) void CloseTestChromeOSUser(const std::string& username_hash) { 4935d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 4945d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ChromeOSUserMap::iterator i = chromeos_user_map_.find(username_hash); 4955d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DCHECK(i != chromeos_user_map_.end()); 4965d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) delete i->second; 4975d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) chromeos_user_map_.erase(i); 4985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 4995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 5005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool OpenTestNSSDB() { 503f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 504a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // NSS is allowed to do IO on the current thread since dispatching 505a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // to a dedicated thread would still have the affect of blocking 506a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // the current thread, due to NSS's internal locking requirements 507a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 508f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 5095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 5105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 5115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!g_test_nss_db_dir.Get().CreateUniqueTempDir()) 5125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 513c2db58bd994c04d98e4ee2cd7565b71548655fe3Ben Murdoch test_slot_ = OpenUserDB(g_test_nss_db_dir.Get().path(), kTestTPMTokenName); 5145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return !!test_slot_; 5155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void CloseTestNSSDB() { 518f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 519a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // NSS is allowed to do IO on the current thread since dispatching 520a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // to a dedicated thread would still have the affect of blocking 521a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // the current thread, due to NSS's internal locking requirements 522a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 523f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 524eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch if (!test_slot_) 525eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch return; 526eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch SECStatus status = SECMOD_CloseUserDB(test_slot_); 527eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch if (status != SECSuccess) 528eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError(); 529eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch PK11_FreeSlot(test_slot_); 530eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch test_slot_ = NULL; 531eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch ignore_result(g_test_nss_db_dir.Get().Delete()); 5325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* GetPublicNSSKeySlot() { 535f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // TODO(mattm): Change to DCHECK when callers have been fixed. 536f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!thread_checker_.CalledOnValidThread()) { 537f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "Called on wrong thread.\n" 538f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << base::debug::StackTrace().ToString(); 539f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 540f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 5415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 5425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(test_slot_); 5435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) 5445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(software_slot_); 5455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_GetInternalKeySlot(); 5465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* GetPrivateNSSKeySlot() { 549f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // TODO(mattm): Change to DCHECK when callers have been fixed. 550f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!thread_checker_.CalledOnValidThread()) { 551f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "Called on wrong thread.\n" 552f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << base::debug::StackTrace().ToString(); 553f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 554f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 5555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 5565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(test_slot_); 5575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 5595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (tpm_token_enabled_for_nss_) { 560a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (IsTPMTokenReady(base::Closure())) { 5615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(tpm_slot_); 5625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 5635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we were supposed to get the hardware token, but were 5645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // unable to, return NULL rather than fall back to sofware. 5655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 5665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 5695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we weren't supposed to enable the TPM for NSS, then return 5705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the software slot. 5715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) 5725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(software_slot_); 5735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_GetInternalKeySlot(); 5745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 5775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock* write_lock() { 5785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return &write_lock_; 5795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 5815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This method is used to force NSS to be initialized without a DB. 5835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Call this method before NSSInitSingleton() is constructed. 5845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static void ForceNoDBInit() { 5855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) force_nodb_init_ = true; 5865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 5895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>; 5905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton() 5925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : tpm_token_enabled_for_nss_(false), 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_(NULL), 5945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_(NULL), 5955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) test_slot_(NULL), 5965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_slot_(NULL), 5975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_(NULL), 5985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chromeos_user_logged_in_(false) { 5992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks start_time = base::TimeTicks::Now(); 600f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 601f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // It's safe to construct on any thread, since LazyInstance will prevent any 602f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // other threads from accessing until the constructor is done. 603f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) thread_checker_.DetachFromThread(); 604f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 605f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DisableAESNIIfNeeded(); 606f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 6075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EnsureNSPRInit(); 6085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 609bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch // We *must* have NSS >= 3.14.3. 6105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) COMPILE_ASSERT( 611bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch (NSS_VMAJOR == 3 && NSS_VMINOR == 14 && NSS_VPATCH >= 3) || 612bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch (NSS_VMAJOR == 3 && NSS_VMINOR > 14) || 6135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (NSS_VMAJOR > 3), 6145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nss_version_check_failed); 6155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Also check the run-time NSS version. 6165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NSS_VersionCheck is a >= check, not strict equality. 617bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch if (!NSS_VersionCheck("3.14.3")) { 618bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch LOG(FATAL) << "NSS_VersionCheck(\"3.14.3\") failed. NSS >= 3.14.3 is " 619bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch "required. Please upgrade to the latest NSS, and if you " 6205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "still get this error, contact your distribution " 6215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "maintainer."; 6225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = SECFailure; 6255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool nodb_init = force_nodb_init_; 6265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 6285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use the system certificate store, so initialize NSS without database. 6295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nodb_init = true; 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 6315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (nodb_init) { 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 6352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 6362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return; 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_IOS) 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_IOS) 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) { 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This duplicates the work which should have been done in 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // EarlySetupForNSSInit. However, this function is idempotent so 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // there's no harm done. 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initialize with a persistent database (likely, ~/.pki/nssdb). 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use "sql:" which can be shared by multiple processes safely. 6525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string nss_config_dir = 6532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::StringPrintf("sql:%s", database_dir.value().c_str()); 6545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 6555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_Init(nss_config_dir.c_str()); 6565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 6575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_InitReadWrite(nss_config_dir.c_str()); 6585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 6595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 6605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error initializing NSS with a persistent " 6615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "database (" << nss_config_dir 6625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "): " << GetNSSErrorMessage(); 6635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 6665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "Initializing NSS without a persistent database."; 6675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 6685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 6692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 6705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 6715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_SetPasswordFunc(PKCS11PasswordFunc); 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we haven't initialized the password for the NSS databases, 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // initialize an empty-string password so that we don't need to 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // log in. 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* slot = PK11_GetInternalKeySlot(); 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (slot) { 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PK11_InitPin may write to the keyDB, but no other thread can use NSS 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // yet, so we don't need to lock. 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_NeedUserInit(slot)) 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_InitPin(slot, NULL, NULL); 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(slot); 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 6895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 6905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 6922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Disable MD5 certificate signatures. (They are disabled by default in 6932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // NSS 3.14.) 6942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_MD5, 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 6952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION, 6962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 6972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 6982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // The UMA bit is conditionally set for this histogram in 6992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // chrome/common/startup_metric_utils.cc . 7002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) HISTOGRAM_CUSTOM_TIMES("Startup.SlowStartupNSSInit", 7012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks::Now() - start_time, 7022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromMilliseconds(10), 7032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromHours(1), 7042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 50); 7055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 7095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSSInitSingleton() { 711a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 712a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) STLDeleteValues(&chromeos_user_map_); 713a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif 7145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (tpm_slot_) { 7155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(tpm_slot_); 7165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_slot_ = NULL; 7175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) { 7195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_CloseUserDB(software_slot_); 7205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(software_slot_); 7215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_ = NULL; 7225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CloseTestNSSDB(); 7245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root_) { 7255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(root_); 7265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(root_); 7275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = NULL; 7285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_) { 7305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(chaps_module_); 7315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(chaps_module_); 7325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_ = NULL; 7335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = NSS_Shutdown(); 7365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 7375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // We VLOG(1) because this failure is relatively harmless (leaking, but 7385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // we're shutting down anyway). 7395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609"; 7405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) || defined(OS_IOS) 7445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load nss's built-in root certs. 7455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* InitDefaultRootCerts() { 7465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL); 7475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root) 7485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return root; 7495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Aw, snap. Can't find/load root cert shared library. 7515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This will make it hard to talk to anybody via https. 7521e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // TODO(mattm): Re-add the NOTREACHED here when crbug.com/310972 is fixed. 7535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 7545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load the given module for this NSS session. 7575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* LoadModule(const char* name, 7585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* library_path, 7595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* params) { 7602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::string modparams = base::StringPrintf( 7615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "name=\"%s\" library=\"%s\" %s", 7625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) name, library_path, params ? params : ""); 7635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Shouldn't need to const_cast here, but SECMOD doesn't properly 7655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // declare input string arguments as const. Bug 7665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed 7675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // on NSS codebase to address this. 7685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* module = SECMOD_LoadUserModule( 7695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(modparams.c_str()), NULL, PR_FALSE); 7705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!module) { 7715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error loading " << name << " module into NSS: " 7725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << GetNSSErrorMessage(); 7735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 7745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7751e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!module->loaded) { 7761e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) LOG(ERROR) << "After loading " << name << ", loaded==false: " 7771e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) << GetNSSErrorMessage(); 7781e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) SECMOD_DestroyModule(module); 7791e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return NULL; 7801e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) } 7815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return module; 7825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 7845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static PK11SlotInfo* OpenUserDB(const base::FilePath& path, 7865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* description) { 7875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string modspec = 7882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::StringPrintf("configDir='sql:%s' tokenDescription='%s'", 7892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) path.value().c_str(), description); 7905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str()); 7915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (db_slot) { 7925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_NeedUserInit(db_slot)) 7935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_InitPin(db_slot, NULL, NULL); 7945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) else { 7965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error opening persistent database (" << modspec 7975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "): " << GetNSSErrorMessage(); 7985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return db_slot; 8005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 8015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 802f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) static void DisableAESNIIfNeeded() { 803f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (NSS_VersionCheck("3.15") && !NSS_VersionCheck("3.15.4")) { 804f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Some versions of NSS have a bug that causes AVX instructions to be 805f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // used without testing whether XSAVE is enabled by the operating system. 806f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // In order to work around this, we disable AES-NI in NSS when we find 807f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // that |has_avx()| is false (which includes the XSAVE test). See 808f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // https://bugzilla.mozilla.org/show_bug.cgi?id=940794 809f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::CPU cpu; 810f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 811f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (cpu.has_avx_hardware() && !cpu.has_avx()) { 812f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::Environment::Create()->SetVar("NSS_DISABLE_HW_AES", "1"); 813f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 814f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 815f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 816f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 8175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If this is set to true NSS is forced to be initialized without a DB. 8185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static bool force_nodb_init_; 8195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool tpm_token_enabled_for_nss_; 821a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::vector<base::Closure> TPMReadyCallbackList; 822a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) TPMReadyCallbackList tpm_ready_callback_list_; 8235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* chaps_module_; 8245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* software_slot_; 8255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* test_slot_; 8265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* tpm_slot_; 8275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root_; 8285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool chromeos_user_logged_in_; 829a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 830a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::map<std::string, ChromeOSUserData*> ChromeOSUserMap; 831a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ChromeOSUserMap chromeos_user_map_; 832a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif 8335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 8345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 8355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // is fixed, we will no longer need the lock. 8365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock write_lock_; 8375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 838f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 839f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::ThreadChecker thread_checker_; 8405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 8415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 8435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool NSSInitSingleton::force_nodb_init_ = false; 8445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSSInitSingleton>::Leaky 8465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton = LAZY_INSTANCE_INITIALIZER; 8475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace 8485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 849c2db58bd994c04d98e4ee2cd7565b71548655fe3Ben Murdochconst char kTestTPMTokenName[] = "Test DB"; 850c2db58bd994c04d98e4ee2cd7565b71548655fe3Ben Murdoch 8515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 8525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EarlySetupForNSSInit() { 8532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 8545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) 8555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 8565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 8585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSPRInit() { 8605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton.Get(); 8615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void InitNSSSafely() { 8642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We might fork, but we haven't loaded any security modules. 8652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DisableNSSForkCheck(); 8662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If we're sandboxed, we shouldn't be able to open user security modules, 8672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // but it's more correct to tell NSS to not even try. 8682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Loading user security modules would have security implications. 8692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ForceNSSNoDBInit(); 8702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Initialize NSS. 8712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EnsureNSSInit(); 8722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 8732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 8745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSSInit() { 8755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initializing SSL causes us to do blocking IO. 8765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporarily allow it until we fix 8775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // http://code.google.com/p/chromium/issues/detail?id=59847 8785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 8795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get(); 8805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void ForceNSSNoDBInit() { 8835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton::ForceNoDBInit(); 8845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void DisableNSSForkCheck() { 8875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 8885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); 8895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void LoadNSSLibraries() { 8925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Some NSS libraries are linked dynamically so load them here. 8935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 8945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Try to search for multiple directories to load the libraries. 8952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::vector<base::FilePath> paths; 8965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use relative path to Search PATH for the library files. 8982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath()); 8995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For Debian derivatives NSS libraries are located here. 9012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/nss")); 9025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 903a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) // Ubuntu 11.10 (Oneiric) and Debian Wheezy place the libraries here. 9045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(ARCH_CPU_X86_64) 9052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/x86_64-linux-gnu/nss")); 9065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_X86) 9072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/i386-linux-gnu/nss")); 9085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_ARMEL) 909a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(__ARM_PCS_VFP) 910a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabihf/nss")); 911a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#else 9122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabi/nss")); 9135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(__ARM_PCS_VFP) 914a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles)#elif defined(ARCH_CPU_MIPSEL) 915a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/mipsel-linux-gnu/nss")); 9165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(ARCH_CPU_X86_64) 9175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A list of library files to load. 9195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> libs; 9205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libsoftokn3.so"); 9215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libfreebl3.so"); 9225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For each combination of library file and path, check for existence and 9245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // then load. 9255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t loaded = 0; 9265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < libs.size(); ++i) { 9275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t j = 0; j < paths.size(); ++j) { 9282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath path = paths[j].Append(libs[i]); 9295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL); 9305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lib) { 9315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++loaded; 9325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 9335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (loaded == libs.size()) { 9385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(3) << "NSS libraries loaded."; 9395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 9405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to load NSS libraries."; 9415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9425d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(USE_NSS) 9435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool CheckNSSVersion(const char* version) { 9465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return !!NSS_VersionCheck(version); 9475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 9505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)ScopedTestNSSDB::ScopedTestNSSDB() 9515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : is_open_(g_nss_singleton.Get().OpenTestNSSDB()) { 9525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)ScopedTestNSSDB::~ScopedTestNSSDB() { 955eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // Don't close when NSS is < 3.15.1, because it would require an additional 956eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // sleep for 1 second after closing the database, due to 957eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // http://bugzil.la/875601. 958eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch if (NSS_VersionCheck("3.15.1")) { 959eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch g_nss_singleton.Get().CloseTestNSSDB(); 960eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch } 9615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Lock* GetNSSWriteLock() { 9645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().write_lock(); 9655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) { 9685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // May be NULL if the lock is not needed in our version of NSS. 9695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) 9705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Acquire(); 9715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::~AutoNSSWriteLock() { 9745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) { 9755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->AssertAcquired(); 9765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Release(); 9775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::AutoSECMODListReadLock() 9815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : lock_(SECMOD_GetDefaultModuleListLock()) { 9825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_GetReadLock(lock_); 9835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::~AutoSECMODListReadLock() { 9865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_ReleaseReadLock(lock_); 9875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 9905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 9925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void OpenPersistentNSSDB() { 9935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().OpenPersistentNSSDB(); 9945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnableTPMTokenForNSS() { 9975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().EnableTPMTokenForNSS(); 9985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1000a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool IsTPMTokenEnabledForNSS() { 1001a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().IsTPMTokenEnabledForNSS(); 1002a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1003a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 1004a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool IsTPMTokenReady(const base::Closure& callback) { 1005a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().IsTPMTokenReady(callback); 10065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1008f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool InitializeTPMToken(int token_slot_id) { 1009f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return g_nss_singleton.Get().InitializeTPMToken(token_slot_id); 10105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1011a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 10125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)ScopedTestNSSChromeOSUser::ScopedTestNSSChromeOSUser( 10135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const std::string& username_hash) 10145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) : username_hash_(username_hash), constructed_successfully_(false) { 10155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!temp_dir_.CreateUniqueTempDir()) 10165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return; 10175d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) constructed_successfully_ = 10185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) InitializeNSSForChromeOSUser(username_hash, 10195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) username_hash, 10205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) false /* is_primary_user */, 10215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) temp_dir_.path()); 10225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 10235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 10245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)ScopedTestNSSChromeOSUser::~ScopedTestNSSChromeOSUser() { 10255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (constructed_successfully_) 10265d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) g_nss_singleton.Get().CloseTestChromeOSUser(username_hash_); 10275d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 10285d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 10295d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)void ScopedTestNSSChromeOSUser::FinishInit() { 10305d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) InitializePrivateSoftwareSlotForChromeOSUser(username_hash_); 10315d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 10325d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1033a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool InitializeNSSForChromeOSUser( 1034a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& email, 1035a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1036a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool is_primary_user, 1037a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::FilePath& path) { 1038a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().InitializeNSSForChromeOSUser( 1039a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) email, username_hash, is_primary_user, path); 1040a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1041a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void InitializeTPMForChromeOSUser( 1042a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1043a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CK_SLOT_ID slot_id) { 1044a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) g_nss_singleton.Get().InitializeTPMForChromeOSUser(username_hash, slot_id); 1045a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1046a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void InitializePrivateSoftwareSlotForChromeOSUser( 1047a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 1048a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) g_nss_singleton.Get().InitializePrivateSoftwareSlotForChromeOSUser( 1049a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) username_hash); 1050a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1051a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)ScopedPK11Slot GetPublicSlotForChromeOSUser(const std::string& username_hash) { 1052a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().GetPublicSlotForChromeOSUser(username_hash); 1053a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1054a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)ScopedPK11Slot GetPrivateSlotForChromeOSUser( 1055a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1056a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 1057a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().GetPrivateSlotForChromeOSUser(username_hash, 1058a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback); 1059a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 10605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 10615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Time PRTimeToBaseTime(PRTime prtime) { 10635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return base::Time::FromInternalValue( 10645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) prtime + base::Time::UnixEpoch().ToInternalValue()); 10655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PRTime BaseTimeToPRTime(base::Time time) { 10685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue(); 10695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PK11SlotInfo* GetPublicNSSKeySlot() { 10725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().GetPublicNSSKeySlot(); 10735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PK11SlotInfo* GetPrivateNSSKeySlot() { 10765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().GetPrivateNSSKeySlot(); 10775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace crypto 1080