nss_util.cc revision 5f1c94371a64b3196d4be9466099bb892df9b88e
15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util_internal.h" 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <nss.h> 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <pk11pub.h> 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <plarena.h> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prerror.h> 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prinit.h> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prtime.h> 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <secmod.h> 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#if defined(OS_OPENBSD) 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/mount.h> 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/param.h> 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 21a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include <map> 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 24cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "base/base_paths.h" 255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/bind.h" 26f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/cpu.h" 272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/debug/alias.h" 28f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/debug/stack_trace.h" 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/environment.h" 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/file_util.h" 312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/files/file_path.h" 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/lazy_instance.h" 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/logging.h" 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/scoped_ptr.h" 355d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/message_loop/message_loop.h" 362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/metrics/histogram.h" 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/native_library.h" 38cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "base/path_service.h" 39a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "base/stl_util.h" 40868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "base/strings/stringprintf.h" 41f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/threading/thread_checker.h" 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/threading/thread_restrictions.h" 43a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include "base/threading/worker_pool.h" 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "build/build_config.h" 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// defined, such as on Mac and Windows, we use NSS for SSL only -- we don't 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// use NSS for crypto or certificate verification, and we don't use the NSS 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// certificate and key databases. 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/synchronization/lock.h" 525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "crypto/nss_crypto_module_delegate.h" 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace crypto { 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 60116680a4aac90f2aa7413d9095a592090648e557Ben Murdochconst char kUserNSSDatabaseName[] = "UserNSSDB"; 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Constants for loading the Chrome OS TPM-backed PKCS #11 library. 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsModuleName[] = "Chaps"; 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsPath[] = "libchaps.so"; 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Fake certificate authority database used for testing. 672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const base::FilePath::CharType kReadOnlyCertDB[] = 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb"); 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)std::string GetNSSErrorMessage() { 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string result; 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PR_GetErrorTextLength()) { 74c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) scoped_ptr<char[]> error_text(new char[PR_GetErrorTextLength() + 1]); 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRInt32 copied = PR_GetErrorText(error_text.get()); 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result = std::string(error_text.get(), copied); 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) result = base::StringPrintf("NSS error code: %d", PR_GetError()); 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 84116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch#if !defined(OS_CHROMEOS) 852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetDefaultConfigDirectory() { 86cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) base::FilePath dir; 87cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) PathService::Get(base::DIR_HOME, &dir); 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (dir.empty()) { 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to get home directory."; 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir = dir.AppendASCII(".pki").AppendASCII("nssdb"); 93a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!base::CreateDirectory(dir)) { 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to create " << dir.value() << " directory."; 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir.clear(); 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 97a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << "DefaultConfigDirectory: " << dir.value(); 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 100116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch#endif // !defined(IS_CHROMEOS) 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 102d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// On non-Chrome OS platforms, return the default config directory. On Chrome OS 103d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// test images, return a read-only directory with fake root CA certs (which are 104d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// used by the local Google Accounts server mock we use when testing our login 105d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// code). On Chrome OS non-test images (where the read-only directory doesn't 106d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// exist), return an empty path. 1072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetInitialConfigDirectory() { 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 109d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) base::FilePath database_dir = base::FilePath(kReadOnlyCertDB); 110d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) if (!base::PathExists(database_dir)) 111d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) database_dir.clear(); 112d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) return database_dir; 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return GetDefaultConfigDirectory(); 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This callback for NSS forwards all requests to a caller-specified 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// CryptoModuleBlockingPasswordDelegate object. 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) { 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) crypto::CryptoModuleBlockingPasswordDelegate* delegate = 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg); 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (delegate) { 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool cancelled = false; 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string password = delegate->RequestPassword(PK11_GetTokenName(slot), 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) retry != PR_FALSE, 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) &cancelled); 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (cancelled) 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char* result = PORT_Strdup(password.c_str()); 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) password.replace(0, password.size(), password.size(), 0); 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DLOG(ERROR) << "PK11 password requested with NULL arg"; 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// NSS creates a local cache of the sqlite database if it detects that the 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// filesystem the database is on is much slower than the local disk. The 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection doesn't work with the latest versions of sqlite, such as 3.6.22 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561). So we set 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection when database_dir is on NFS. See http://crbug.com/48585. 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(wtc): port this function to other USE_NSS platforms. It is defined 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// only for OS_LINUX and OS_OPENBSD simply because the statfs structure 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is OS-specific. 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Because this function sets an environment variable it must be run before we 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// go multi-threaded. 1512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) { 1525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool db_on_nfs = false; 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_LINUX) 154a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::FileSystemType fs_type = base::FILE_SYSTEM_UNKNOWN; 155a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (base::GetFileSystemType(database_dir, &fs_type)) 156a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) db_on_nfs = (fs_type == base::FILE_SYSTEM_NFS); 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(OS_OPENBSD) 1585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) struct statfs buf; 1595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (statfs(database_dir.value().c_str(), &buf) == 0) 1605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) db_on_nfs = (strcmp(buf.f_fstypename, MOUNT_NFS) == 0); 1615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#else 1625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) NOTIMPLEMENTED(); 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1645d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1655d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (db_on_nfs) { 1665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 1675d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) static const char kUseCacheEnvVar[] = "NSS_SDB_USE_CACHE"; 1685d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!env->HasVar(kUseCacheEnvVar)) 1695d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) env->SetVar(kUseCacheEnvVar, "yes"); 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A singleton to initialize/deinitialize NSPR. 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Separate from the NSS singleton because we initialize NSPR on the UI thread. 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Now that we're leaking the singleton, we could merge back with the NSS 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// singleton. 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSPRInitSingleton { 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>; 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSPRInitSingleton() { 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSPRInitSingleton() { 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PL_ArenaFinish(); 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRStatus prstatus = PR_Cleanup(); 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (prstatus != PR_SUCCESS) 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSPRInitSingleton>::Leaky 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton = LAZY_INSTANCE_INITIALIZER; 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Force a crash with error info on NSS_NoDB_Init failure. 2022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CrashOnNSSInitFailure() { 2032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int nss_error = PR_GetError(); 2042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int os_error = PR_GetOSError(); 2052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&nss_error); 2062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&os_error); 2072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(ERROR) << "Error initializing NSS without a persistent database: " 2082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) << GetNSSErrorMessage(); 2092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(FATAL) << "nss_error=" << nss_error << ", os_error=" << os_error; 2102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 212a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 213a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)class ChromeOSUserData { 214a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public: 215116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch explicit ChromeOSUserData(ScopedPK11Slot public_slot) 216a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) : public_slot_(public_slot.Pass()), 217116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch private_slot_initialization_started_(false) {} 218a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ~ChromeOSUserData() { 219116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch if (public_slot_) { 220a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SECStatus status = SECMOD_CloseUserDB(public_slot_.get()); 221a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (status != SECSuccess) 222a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError(); 223a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 224a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 225a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 226a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPublicSlot() { 227a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot( 228a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) public_slot_ ? PK11_ReferenceSlot(public_slot_.get()) : NULL); 229a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 230a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 231a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPrivateSlot( 232a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 233a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (private_slot_) 234a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get())); 235a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) 236a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) tpm_ready_callback_list_.push_back(callback); 237a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(); 238a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 239a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 240a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void SetPrivateSlot(ScopedPK11Slot private_slot) { 241a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(!private_slot_); 242a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) private_slot_ = private_slot.Pass(); 243a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 244a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList callback_list; 245a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback_list.swap(tpm_ready_callback_list_); 246a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) for (SlotReadyCallbackList::iterator i = callback_list.begin(); 247a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) i != callback_list.end(); 248a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ++i) { 249a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) (*i).Run(ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()))); 250a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 251a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 252a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 253116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch bool private_slot_initialization_started() const { 254116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch return private_slot_initialization_started_; 255116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch } 256116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 257116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch void set_private_slot_initialization_started() { 258116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch private_slot_initialization_started_ = true; 259116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch } 260116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 261a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) private: 262a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot public_slot_; 263a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot private_slot_; 264116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 265116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch bool private_slot_initialization_started_; 266a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 267a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::vector<base::Callback<void(ScopedPK11Slot)> > 268a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList; 269a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) SlotReadyCallbackList tpm_ready_callback_list_; 270a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)}; 271a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 272a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSSInitSingleton { 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 276a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Used with PostTaskAndReply to pass handles to worker thread and back. 277a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) struct TPMModuleAndSlot { 278a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) explicit TPMModuleAndSlot(SECMODModule* init_chaps_module) 2795f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) : chaps_module(init_chaps_module) {} 280a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) SECMODModule* chaps_module; 2815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) crypto::ScopedPK11Slot tpm_slot; 282a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) }; 283a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 2845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ScopedPK11Slot OpenPersistentNSSDBForPath(const std::string& db_name, 2855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const base::FilePath& path) { 286a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 287a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // NSS is allowed to do IO on the current thread since dispatching 288a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // to a dedicated thread would still have the affect of blocking 289a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // the current thread, due to NSS's internal locking requirements 290a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 291a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 292a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::FilePath nssdb_path = path.AppendASCII(".pki").AppendASCII("nssdb"); 293a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!base::CreateDirectory(nssdb_path)) { 294a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) LOG(ERROR) << "Failed to create " << nssdb_path.value() << " directory."; 2955f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return ScopedPK11Slot(); 296a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 2975f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return OpenSoftwareNSSDB(nssdb_path, db_name); 298a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 299a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 3005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void EnableTPMTokenForNSS() { 301f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 302f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 3031e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // If this gets set, then we'll use the TPM for certs with 3041e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // private keys, otherwise we'll fall back to the software 3051e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // implementation. 3065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_token_enabled_for_nss_ = true; 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 309a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool IsTPMTokenEnabledForNSS() { 310a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 311a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return tpm_token_enabled_for_nss_; 312a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 313a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 314116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch void InitializeTPMTokenAndSystemSlot( 315116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch int system_slot_id, 316116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const base::Callback<void(bool)>& callback) { 317f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 318a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Should not be called while there is already an initialization in 319a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // progress. 320a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DCHECK(!initializing_tpm_token_); 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If EnableTPMTokenForNSS hasn't been called, return false. 322a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (!tpm_token_enabled_for_nss_) { 323a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::MessageLoop::current()->PostTask(FROM_HERE, 324a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(callback, false)); 325a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return; 326a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If everything is already initialized, then return true. 329a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Note that only |tpm_slot_| is checked, since |chaps_module_| could be 330a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // NULL in tests while |tpm_slot_| has been set to the test DB. 331a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (tpm_slot_) { 332a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::MessageLoop::current()->PostTask(FROM_HERE, 333a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(callback, true)); 334a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return; 335a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 337a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Note that a reference is not taken to chaps_module_. This is safe since 338a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // NSSInitSingleton is Leaky, so the reference it holds is never released. 339a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) scoped_ptr<TPMModuleAndSlot> tpm_args(new TPMModuleAndSlot(chaps_module_)); 340a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) TPMModuleAndSlot* tpm_args_ptr = tpm_args.get(); 341a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (base::WorkerPool::PostTaskAndReply( 342a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) FROM_HERE, 343a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread, 344116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch system_slot_id, 345a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) tpm_args_ptr), 346116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch base::Bind(&NSSInitSingleton::OnInitializedTPMTokenAndSystemSlot, 347a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Unretained(this), // NSSInitSingleton is leaky 348a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) callback, 349a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Passed(&tpm_args)), 350a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) true /* task_is_slow */ 351a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) )) { 352a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) initializing_tpm_token_ = true; 353a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } else { 354a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::MessageLoop::current()->PostTask(FROM_HERE, 355a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(callback, false)); 356a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 357a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 358a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 359a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) static void InitializeTPMTokenOnWorkerThread(CK_SLOT_ID token_slot_id, 360a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) TPMModuleAndSlot* tpm_args) { 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This tries to load the Chaps module so NSS can talk to the hardware 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TPM. 363a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (!tpm_args->chaps_module) { 364a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DVLOG(3) << "Loading chaps..."; 365a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) tpm_args->chaps_module = LoadModule( 3665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsModuleName, 3675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsPath, 3685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For more details on these parameters, see: 3695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://developer.mozilla.org/en/PKCS11_Module_Specs 3705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // slotFlags=[PublicCerts] -- Certificates and public keys can be 3715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read from this slot without requiring a call to C_Login. 3725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // askpw=only -- Only authenticate to the token when necessary. 3735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\""); 3745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 375a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (tpm_args->chaps_module) { 376a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) tpm_args->tpm_slot = 377a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) GetTPMSlotForIdOnWorkerThread(tpm_args->chaps_module, token_slot_id); 378a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 379a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 3805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 381116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch void OnInitializedTPMTokenAndSystemSlot( 382116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const base::Callback<void(bool)>& callback, 383116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch scoped_ptr<TPMModuleAndSlot> tpm_args) { 384a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 385a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DVLOG(2) << "Loaded chaps: " << !!tpm_args->chaps_module 386a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) << ", got tpm slot: " << !!tpm_args->tpm_slot; 387a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 388a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) chaps_module_ = tpm_args->chaps_module; 3895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_slot_ = tpm_args->tpm_slot.Pass(); 3905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!chaps_module_ && test_system_slot_) { 391a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // chromeos_unittests try to test the TPM initialization process. If we 392a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // have a test DB open, pretend that it is the TPM slot. 3935f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_slot_.reset(PK11_ReferenceSlot(test_system_slot_.get())); 394a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 395a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) initializing_tpm_token_ = false; 396a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 3975f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (tpm_slot_) 3985f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) RunAndClearTPMReadyCallbackList(); 399a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 400a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) callback.Run(!!tpm_slot_); 4015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4035f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) void RunAndClearTPMReadyCallbackList() { 4045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) TPMReadyCallbackList callback_list; 4055f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback_list.swap(tpm_ready_callback_list_); 4065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) for (TPMReadyCallbackList::iterator i = callback_list.begin(); 4075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) i != callback_list.end(); 4085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ++i) { 4095f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) i->Run(); 4105f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 4115f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 4125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 413a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool IsTPMTokenReady(const base::Closure& callback) { 414a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) { 415a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // Cannot DCHECK in the general case yet, but since the callback is 416a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // a new addition to the API, DCHECK to make sure at least the new uses 417a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // don't regress. 418a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 419a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } else if (!thread_checker_.CalledOnValidThread()) { 420a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // TODO(mattm): Change to DCHECK when callers have been fixed. 421f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "Called on wrong thread.\n" 422f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << base::debug::StackTrace().ToString(); 4235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (tpm_slot_) 426a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 427a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 428a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!callback.is_null()) 429a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) tpm_ready_callback_list_.push_back(callback); 430a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 431a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 4325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4341e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // Note that CK_SLOT_ID is an unsigned long, but cryptohome gives us the slot 4351e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // id as an int. This should be safe since this is only used with chaps, which 4361e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // we also control. 4375f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) static crypto::ScopedPK11Slot GetTPMSlotForIdOnWorkerThread( 4385f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) SECMODModule* chaps_module, 4395f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) CK_SLOT_ID slot_id) { 440a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DCHECK(chaps_module); 4411e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) 442a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(3) << "Poking chaps module."; 443a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) SECStatus rv = SECMOD_UpdateSlotList(chaps_module); 4441e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (rv != SECSuccess) 4451e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) PLOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError(); 4461e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) 447a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) PK11SlotInfo* slot = SECMOD_LookupSlot(chaps_module->moduleID, slot_id); 4481e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!slot) 4491e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) LOG(ERROR) << "TPM slot " << slot_id << " not found."; 4505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return crypto::ScopedPK11Slot(slot); 4515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 452a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 453a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool InitializeNSSForChromeOSUser( 454a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& email, 455a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 456a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::FilePath& path) { 457a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 458a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()) { 459a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // This user already exists in our mapping. 460a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DVLOG(2) << username_hash << " already initialized."; 461a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 462a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 463116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 464116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DVLOG(2) << "Opening NSS DB " << path.value(); 465116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch std::string db_name = base::StringPrintf( 466116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch "%s %s", kUserNSSDatabaseName, username_hash.c_str()); 467116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch ScopedPK11Slot public_slot(OpenPersistentNSSDBForPath(db_name, path)); 468a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash] = 469116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch new ChromeOSUserData(public_slot.Pass()); 470a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 471a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 472a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 473116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch bool ShouldInitializeTPMForChromeOSUser(const std::string& username_hash) { 474116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(thread_checker_.CalledOnValidThread()); 475116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 476116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 477116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch return !chromeos_user_map_[username_hash] 478116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch ->private_slot_initialization_started(); 479116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch } 480116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 481116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch void WillInitializeTPMForChromeOSUser(const std::string& username_hash) { 482116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(thread_checker_.CalledOnValidThread()); 483116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 484116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 485116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch chromeos_user_map_[username_hash] 486116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch ->set_private_slot_initialization_started(); 487116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch } 488116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 489a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void InitializeTPMForChromeOSUser(const std::string& username_hash, 490a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CK_SLOT_ID slot_id) { 491a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 492a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 493116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(chromeos_user_map_[username_hash]-> 494116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch private_slot_initialization_started()); 495a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 496a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (!chaps_module_) 497a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return; 498a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 499a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Note that a reference is not taken to chaps_module_. This is safe since 500a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // NSSInitSingleton is Leaky, so the reference it holds is never released. 501a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) scoped_ptr<TPMModuleAndSlot> tpm_args(new TPMModuleAndSlot(chaps_module_)); 502a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) TPMModuleAndSlot* tpm_args_ptr = tpm_args.get(); 503a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::WorkerPool::PostTaskAndReply( 504a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) FROM_HERE, 505a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread, 506a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) slot_id, 507a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) tpm_args_ptr), 508a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Bind(&NSSInitSingleton::OnInitializedTPMForChromeOSUser, 509a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Unretained(this), // NSSInitSingleton is leaky 510a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) username_hash, 511a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) base::Passed(&tpm_args)), 512a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) true /* task_is_slow */ 513a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) ); 514a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 515a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 516a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) void OnInitializedTPMForChromeOSUser(const std::string& username_hash, 517a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) scoped_ptr<TPMModuleAndSlot> tpm_args) { 518a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 519a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) DVLOG(2) << "Got tpm slot for " << username_hash << " " 520a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) << !!tpm_args->tpm_slot; 521a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) chromeos_user_map_[username_hash]->SetPrivateSlot( 5225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_args->tpm_slot.Pass()); 523a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 524a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 525a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) void InitializePrivateSoftwareSlotForChromeOSUser( 526a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 527a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 5285d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) VLOG(1) << "using software private slot for " << username_hash; 529a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 530116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch DCHECK(chromeos_user_map_[username_hash]-> 531116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch private_slot_initialization_started()); 532116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 533a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash]->SetPrivateSlot( 534a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) chromeos_user_map_[username_hash]->GetPublicSlot()); 535a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 536a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 537a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPublicSlotForChromeOSUser( 538a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 539a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 5405d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 5415d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (username_hash.empty()) { 5425d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DVLOG(2) << "empty username_hash"; 5435d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return ScopedPK11Slot(); 5445d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 5455d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 546a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (chromeos_user_map_.find(username_hash) == chromeos_user_map_.end()) { 547a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) LOG(ERROR) << username_hash << " not initialized."; 548a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return ScopedPK11Slot(); 549a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 550a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return chromeos_user_map_[username_hash]->GetPublicSlot(); 551a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 552a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 553a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ScopedPK11Slot GetPrivateSlotForChromeOSUser( 554a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 555a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 556a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 5575d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 5585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (username_hash.empty()) { 5595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DVLOG(2) << "empty username_hash"; 5605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!callback.is_null()) { 5615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::MessageLoop::current()->PostTask( 5625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) FROM_HERE, base::Bind(callback, base::Passed(ScopedPK11Slot()))); 5635d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 5645d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return ScopedPK11Slot(); 5655d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 5665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 567a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()); 568a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 569a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return chromeos_user_map_[username_hash]->GetPrivateSlot(callback); 570a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 5715d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 5725f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) void CloseChromeOSUserForTesting(const std::string& username_hash) { 5735d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 5745d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ChromeOSUserMap::iterator i = chromeos_user_map_.find(username_hash); 5755d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) DCHECK(i != chromeos_user_map_.end()); 5765d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) delete i->second; 5775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) chromeos_user_map_.erase(i); 5785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 5795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) void SetSystemKeySlotForTesting(ScopedPK11Slot slot) { 5815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Ensure that a previous value of test_system_slot_ is not overwritten. 5825f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) // Unsetting, i.e. setting a NULL, however is allowed. 5835f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(!slot || !test_system_slot_); 5845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) test_system_slot_ = slot.Pass(); 5855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (test_system_slot_) { 5865f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_slot_.reset(PK11_ReferenceSlot(test_system_slot_.get())); 5875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) RunAndClearTPMReadyCallbackList(); 5885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } else { 5895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_slot_.reset(); 5905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5925f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#endif // defined(OS_CHROMEOS) 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5945f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#if !defined(OS_CHROMEOS) 595116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch PK11SlotInfo* GetPersistentNSSKeySlot() { 596f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // TODO(mattm): Change to DCHECK when callers have been fixed. 597f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!thread_checker_.CalledOnValidThread()) { 598f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "Called on wrong thread.\n" 599f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << base::debug::StackTrace().ToString(); 600f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 601f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 6025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_GetInternalKeySlot(); 6035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#endif 6055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 606116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch#if defined(OS_CHROMEOS) 6075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) void GetSystemNSSKeySlotCallback( 6085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 6095f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback.Run(ScopedPK11Slot(PK11_ReferenceSlot(tpm_slot_.get()))); 6105f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 6115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ScopedPK11Slot GetSystemNSSKeySlot( 6135f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 6145f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) DCHECK(thread_checker_.CalledOnValidThread()); 615116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // TODO(mattm): chromeos::TPMTokenloader always calls 616116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // InitializeTPMTokenAndSystemSlot with slot 0. If the system slot is 617116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // disabled, tpm_slot_ will be the first user's slot instead. Can that be 618116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // detected and return NULL instead? 6195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 6205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::Closure wrapped_callback; 6215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!callback.is_null()) { 6225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) wrapped_callback = 6235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::Bind(&NSSInitSingleton::GetSystemNSSKeySlotCallback, 6245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::Unretained(this) /* singleton is leaky */, 6255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) callback); 6265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 6275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (IsTPMTokenReady(wrapped_callback)) 6285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return ScopedPK11Slot(PK11_ReferenceSlot(tpm_slot_.get())); 6295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return ScopedPK11Slot(); 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 631116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch#endif 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock* write_lock() { 6355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return &write_lock_; 6365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This method is used to force NSS to be initialized without a DB. 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Call this method before NSSInitSingleton() is constructed. 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static void ForceNoDBInit() { 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) force_nodb_init_ = true; 6435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>; 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton() 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : tpm_token_enabled_for_nss_(false), 650a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) initializing_tpm_token_(false), 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_(NULL), 652116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch root_(NULL) { 6532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks start_time = base::TimeTicks::Now(); 654f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 655f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // It's safe to construct on any thread, since LazyInstance will prevent any 656f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // other threads from accessing until the constructor is done. 657f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) thread_checker_.DetachFromThread(); 658f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 659f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DisableAESNIIfNeeded(); 660f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 6615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EnsureNSPRInit(); 6625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 663bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch // We *must* have NSS >= 3.14.3. 6645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) COMPILE_ASSERT( 665bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch (NSS_VMAJOR == 3 && NSS_VMINOR == 14 && NSS_VPATCH >= 3) || 666bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch (NSS_VMAJOR == 3 && NSS_VMINOR > 14) || 6675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (NSS_VMAJOR > 3), 6685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nss_version_check_failed); 6695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Also check the run-time NSS version. 6705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NSS_VersionCheck is a >= check, not strict equality. 671bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch if (!NSS_VersionCheck("3.14.3")) { 672bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch LOG(FATAL) << "NSS_VersionCheck(\"3.14.3\") failed. NSS >= 3.14.3 is " 673bb1529ce867d8845a77ec7cdf3e3003ef1771a40Ben Murdoch "required. Please upgrade to the latest NSS, and if you " 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "still get this error, contact your distribution " 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "maintainer."; 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = SECFailure; 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool nodb_init = force_nodb_init_; 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use the system certificate store, so initialize NSS without database. 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nodb_init = true; 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (nodb_init) { 6875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 6885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 6892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 6902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return; 6915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_IOS) 6935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 6945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_IOS) 6955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 6965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 6985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) { 6995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This duplicates the work which should have been done in 7005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // EarlySetupForNSSInit. However, this function is idempotent so 7015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // there's no harm done. 7025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 7035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initialize with a persistent database (likely, ~/.pki/nssdb). 7055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use "sql:" which can be shared by multiple processes safely. 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string nss_config_dir = 7072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::StringPrintf("sql:%s", database_dir.value().c_str()); 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 7095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_Init(nss_config_dir.c_str()); 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 7115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_InitReadWrite(nss_config_dir.c_str()); 7125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 7135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 7145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error initializing NSS with a persistent " 7155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "database (" << nss_config_dir 7165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "): " << GetNSSErrorMessage(); 7175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 7205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "Initializing NSS without a persistent database."; 7215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 7225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 7232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 7245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 7255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_SetPasswordFunc(PKCS11PasswordFunc); 7295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we haven't initialized the password for the NSS databases, 7315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // initialize an empty-string password so that we don't need to 7325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // log in. 7335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* slot = PK11_GetInternalKeySlot(); 7345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (slot) { 7355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PK11_InitPin may write to the keyDB, but no other thread can use NSS 7365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // yet, so we don't need to lock. 7375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_NeedUserInit(slot)) 7385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_InitPin(slot, NULL, NULL); 7395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(slot); 7405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 7435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 7445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 7462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Disable MD5 certificate signatures. (They are disabled by default in 7472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // NSS 3.14.) 7482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_MD5, 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 7492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION, 7502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 7512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 7522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // The UMA bit is conditionally set for this histogram in 7532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // chrome/common/startup_metric_utils.cc . 7542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) HISTOGRAM_CUSTOM_TIMES("Startup.SlowStartupNSSInit", 7552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks::Now() - start_time, 7562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromMilliseconds(10), 7572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromHours(1), 7582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 50); 7595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 7625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 7635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 7645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSSInitSingleton() { 765a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 766a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) STLDeleteValues(&chromeos_user_map_); 767a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif 7685f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) tpm_slot_.reset(); 7695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root_) { 7705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(root_); 7715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(root_); 7725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = NULL; 7735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_) { 7755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(chaps_module_); 7765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(chaps_module_); 7775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_ = NULL; 7785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = NSS_Shutdown(); 7815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 7825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // We VLOG(1) because this failure is relatively harmless (leaking, but 7835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // we're shutting down anyway). 7845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609"; 7855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) || defined(OS_IOS) 7895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load nss's built-in root certs. 7905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* InitDefaultRootCerts() { 7915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL); 7925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root) 7935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return root; 7945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Aw, snap. Can't find/load root cert shared library. 7965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This will make it hard to talk to anybody via https. 7971e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) // TODO(mattm): Re-add the NOTREACHED here when crbug.com/310972 is fixed. 7985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 7995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 8005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load the given module for this NSS session. 802a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) static SECMODModule* LoadModule(const char* name, 803a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) const char* library_path, 804a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) const char* params) { 8052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::string modparams = base::StringPrintf( 8065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "name=\"%s\" library=\"%s\" %s", 8075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) name, library_path, params ? params : ""); 8085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Shouldn't need to const_cast here, but SECMOD doesn't properly 8105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // declare input string arguments as const. Bug 8115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed 8125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // on NSS codebase to address this. 8135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* module = SECMOD_LoadUserModule( 8145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(modparams.c_str()), NULL, PR_FALSE); 8155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!module) { 8165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error loading " << name << " module into NSS: " 8175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << GetNSSErrorMessage(); 8185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 8195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 8201e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) if (!module->loaded) { 8211e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) LOG(ERROR) << "After loading " << name << ", loaded==false: " 8221e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) << GetNSSErrorMessage(); 8231e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) SECMOD_DestroyModule(module); 8241e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return NULL; 8251e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) } 8265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return module; 8275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 8285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 8295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 830f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) static void DisableAESNIIfNeeded() { 831f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (NSS_VersionCheck("3.15") && !NSS_VersionCheck("3.15.4")) { 832f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Some versions of NSS have a bug that causes AVX instructions to be 833f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // used without testing whether XSAVE is enabled by the operating system. 834f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // In order to work around this, we disable AES-NI in NSS when we find 835f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // that |has_avx()| is false (which includes the XSAVE test). See 836f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // https://bugzilla.mozilla.org/show_bug.cgi?id=940794 837f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::CPU cpu; 838f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 839f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (cpu.has_avx_hardware() && !cpu.has_avx()) { 840f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::Environment::Create()->SetVar("NSS_DISABLE_HW_AES", "1"); 841f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 842f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 843f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 844f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 8455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If this is set to true NSS is forced to be initialized without a DB. 8465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static bool force_nodb_init_; 8475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool tpm_token_enabled_for_nss_; 849a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) bool initializing_tpm_token_; 850a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::vector<base::Closure> TPMReadyCallbackList; 851a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) TPMReadyCallbackList tpm_ready_callback_list_; 8525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* chaps_module_; 8535f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) crypto::ScopedPK11Slot tpm_slot_; 8545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root_; 855a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 856a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) typedef std::map<std::string, ChromeOSUserData*> ChromeOSUserMap; 857a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) ChromeOSUserMap chromeos_user_map_; 8585f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) ScopedPK11Slot test_system_slot_; 859a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif 8605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 8615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 8625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // is fixed, we will no longer need the lock. 8635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock write_lock_; 8645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 865f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 866f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::ThreadChecker thread_checker_; 8675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 8685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 8705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool NSSInitSingleton::force_nodb_init_ = false; 8715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSSInitSingleton>::Leaky 8735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton = LAZY_INSTANCE_INITIALIZER; 8745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace 8755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 8775f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)ScopedPK11Slot OpenSoftwareNSSDB(const base::FilePath& path, 8785f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& description) { 8795f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string modspec = 8805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) base::StringPrintf("configDir='sql:%s' tokenDescription='%s'", 8815f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) path.value().c_str(), 8825f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) description.c_str()); 8835f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str()); 8845f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (db_slot) { 8855f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (PK11_NeedUserInit(db_slot)) 8865f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) PK11_InitPin(db_slot, NULL, NULL); 8875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } else { 8885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) LOG(ERROR) << "Error opening persistent database (" << modspec 8895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) << "): " << GetNSSErrorMessage(); 8905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 8915f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return ScopedPK11Slot(db_slot); 8925f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 8935f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 8945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EarlySetupForNSSInit() { 8952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 8965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) 8975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 8985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 9005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSPRInit() { 9025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton.Get(); 9035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void InitNSSSafely() { 9062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We might fork, but we haven't loaded any security modules. 9072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DisableNSSForkCheck(); 9082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If we're sandboxed, we shouldn't be able to open user security modules, 9092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // but it's more correct to tell NSS to not even try. 9102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Loading user security modules would have security implications. 9112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ForceNSSNoDBInit(); 9122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Initialize NSS. 9132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EnsureNSSInit(); 9142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 9152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 9165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSSInit() { 9175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initializing SSL causes us to do blocking IO. 9185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporarily allow it until we fix 9195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // http://code.google.com/p/chromium/issues/detail?id=59847 9205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 9215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get(); 9225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void ForceNSSNoDBInit() { 9255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton::ForceNoDBInit(); 9265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void DisableNSSForkCheck() { 9295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 9305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); 9315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void LoadNSSLibraries() { 9345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Some NSS libraries are linked dynamically so load them here. 9355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 9365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Try to search for multiple directories to load the libraries. 9372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::vector<base::FilePath> paths; 9385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use relative path to Search PATH for the library files. 9402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath()); 9415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For Debian derivatives NSS libraries are located here. 9432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/nss")); 9445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 945a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) // Ubuntu 11.10 (Oneiric) and Debian Wheezy place the libraries here. 9465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(ARCH_CPU_X86_64) 9472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/x86_64-linux-gnu/nss")); 9485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_X86) 9492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/i386-linux-gnu/nss")); 9505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_ARMEL) 951a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(__ARM_PCS_VFP) 952a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabihf/nss")); 953a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#else 9542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabi/nss")); 9555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(__ARM_PCS_VFP) 956a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles)#elif defined(ARCH_CPU_MIPSEL) 957a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/mipsel-linux-gnu/nss")); 9585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(ARCH_CPU_X86_64) 9595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A list of library files to load. 9615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> libs; 9625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libsoftokn3.so"); 9635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libfreebl3.so"); 9645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For each combination of library file and path, check for existence and 9665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // then load. 9675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t loaded = 0; 9685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < libs.size(); ++i) { 9695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t j = 0; j < paths.size(); ++j) { 9702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath path = paths[j].Append(libs[i]); 9715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL); 9725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lib) { 9735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++loaded; 9745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 9755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (loaded == libs.size()) { 9805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(3) << "NSS libraries loaded."; 9815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 9825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to load NSS libraries."; 9835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 9845d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif // defined(USE_NSS) 9855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool CheckNSSVersion(const char* version) { 9885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return !!NSS_VersionCheck(version); 9895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 9925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Lock* GetNSSWriteLock() { 9935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().write_lock(); 9945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 9955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 9965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) { 9975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // May be NULL if the lock is not needed in our version of NSS. 9985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) 9995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Acquire(); 10005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::~AutoNSSWriteLock() { 10035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) { 10045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->AssertAcquired(); 10055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Release(); 10065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 10075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::AutoSECMODListReadLock() 10105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : lock_(SECMOD_GetDefaultModuleListLock()) { 10115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_GetReadLock(lock_); 10125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 10135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::~AutoSECMODListReadLock() { 10155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_ReleaseReadLock(lock_); 10165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 10185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 10205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)ScopedPK11Slot GetSystemNSSKeySlot( 10215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 10225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return g_nss_singleton.Get().GetSystemNSSKeySlot(callback); 10235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 10245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 10255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void SetSystemKeySlotForTesting(ScopedPK11Slot slot) { 10265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) g_nss_singleton.Get().SetSystemKeySlotForTesting(slot.Pass()); 10275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnableTPMTokenForNSS() { 10305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().EnableTPMTokenForNSS(); 10315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1033a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool IsTPMTokenEnabledForNSS() { 1034a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().IsTPMTokenEnabledForNSS(); 1035a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1036a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 1037a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool IsTPMTokenReady(const base::Closure& callback) { 1038a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().IsTPMTokenReady(callback); 10395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1041116680a4aac90f2aa7413d9095a592090648e557Ben Murdochvoid InitializeTPMTokenAndSystemSlot( 1042116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch int token_slot_id, 1043116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const base::Callback<void(bool)>& callback) { 1044116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch g_nss_singleton.Get().InitializeTPMTokenAndSystemSlot(token_slot_id, 1045116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch callback); 10465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1047a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 1048a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)bool InitializeNSSForChromeOSUser( 1049a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& email, 1050a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1051a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::FilePath& path) { 1052a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().InitializeNSSForChromeOSUser( 1053116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch email, username_hash, path); 1054116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch} 1055116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 1056116680a4aac90f2aa7413d9095a592090648e557Ben Murdochbool ShouldInitializeTPMForChromeOSUser(const std::string& username_hash) { 1057116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch return g_nss_singleton.Get().ShouldInitializeTPMForChromeOSUser( 1058116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch username_hash); 1059116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch} 1060116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 1061116680a4aac90f2aa7413d9095a592090648e557Ben Murdochvoid WillInitializeTPMForChromeOSUser(const std::string& username_hash) { 1062116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch g_nss_singleton.Get().WillInitializeTPMForChromeOSUser(username_hash); 1063a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 1064116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 1065a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void InitializeTPMForChromeOSUser( 1066a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1067a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CK_SLOT_ID slot_id) { 1068a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) g_nss_singleton.Get().InitializeTPMForChromeOSUser(username_hash, slot_id); 1069a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 10705f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1071a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void InitializePrivateSoftwareSlotForChromeOSUser( 1072a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) { 1073a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) g_nss_singleton.Get().InitializePrivateSoftwareSlotForChromeOSUser( 1074a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) username_hash); 1075a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 10765f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1077a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)ScopedPK11Slot GetPublicSlotForChromeOSUser(const std::string& username_hash) { 1078a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().GetPublicSlotForChromeOSUser(username_hash); 1079a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 10805f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1081a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)ScopedPK11Slot GetPrivateSlotForChromeOSUser( 1082a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 1083a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) { 1084a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return g_nss_singleton.Get().GetPrivateSlotForChromeOSUser(username_hash, 1085a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) callback); 1086a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 10875f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 10885f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)void CloseChromeOSUserForTesting(const std::string& username_hash) { 10895f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) g_nss_singleton.Get().CloseChromeOSUserForTesting(username_hash); 10905f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 10915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 10925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Time PRTimeToBaseTime(PRTime prtime) { 10945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return base::Time::FromInternalValue( 10955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) prtime + base::Time::UnixEpoch().ToInternalValue()); 10965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 10975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PRTime BaseTimeToPRTime(base::Time time) { 10995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue(); 11005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 11015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 11025f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#if !defined(OS_CHROMEOS) 1103116680a4aac90f2aa7413d9095a592090648e557Ben MurdochPK11SlotInfo* GetPersistentNSSKeySlot() { 1104116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch return g_nss_singleton.Get().GetPersistentNSSKeySlot(); 11055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 11065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#endif 11075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 11085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace crypto 1109