nss_util.cc revision 2a99a7e74a7f215066514fe81d2bfa6639d9eddd
15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/nss_util_internal.h" 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <nss.h> 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <pk11pub.h> 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <plarena.h> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prerror.h> 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prinit.h> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <prtime.h> 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <secmod.h> 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_LINUX) 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <linux/nfs_fs.h> 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/vfs.h> 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(OS_OPENBSD) 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/mount.h> 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sys/param.h> 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/debug/alias.h" 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/environment.h" 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/file_util.h" 292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/files/file_path.h" 302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/files/scoped_temp_dir.h" 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/lazy_instance.h" 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/logging.h" 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/scoped_ptr.h" 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/metrics/histogram.h" 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/native_library.h" 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/stringprintf.h" 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/threading/thread_restrictions.h" 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "build/build_config.h" 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/symmetric_key.h" 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// defined, such as on Mac and Windows, we use NSS for SSL only -- we don't 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// use NSS for crypto or certificate verification, and we don't use the NSS 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// certificate and key databases. 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/synchronization/lock.h" 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/crypto_module_blocking_password_delegate.h" 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace crypto { 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kNSSDatabaseName[] = "Real NSS database"; 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Constants for loading the Chrome OS TPM-backed PKCS #11 library. 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsModuleName[] = "Chaps"; 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kChapsPath[] = "libchaps.so"; 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Fake certificate authority database used for testing. 652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const base::FilePath::CharType kReadOnlyCertDB[] = 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb"); 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)std::string GetNSSErrorMessage() { 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string result; 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PR_GetErrorTextLength()) { 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_array<char> error_text(new char[PR_GetErrorTextLength() + 1]); 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRInt32 copied = PR_GetErrorText(error_text.get()); 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result = std::string(error_text.get(), copied); 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) result = base::StringPrintf("NSS error code: %d", PR_GetError()); 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetDefaultConfigDirectory() { 832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath dir = file_util::GetHomeDir(); 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (dir.empty()) { 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to get home directory."; 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir = dir.AppendASCII(".pki").AppendASCII("nssdb"); 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!file_util::CreateDirectory(dir)) { 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to create " << dir.value() << " directory."; 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dir.clear(); 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return dir; 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Supplemental user key id. 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)unsigned char kSupplementalUserKeyId[] = { 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 0xCC, 0x13, 0x19, 0xDE, 0x75, 0x5E, 0xFE, 0xFA, 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 0x5E, 0x71, 0xD4, 0xA6, 0xFB, 0x00, 0x00, 0xCC 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// On non-chromeos platforms, return the default config directory. 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// On chromeos, return a read-only directory with fake root CA certs for testing 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// (which will not exist on non-testing images). These root CA certs are used 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// by the local Google Accounts server mock we use when testing our login code. 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// If this directory is not present, NSS_Init() will fail. It is up to the 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// caller to failover to NSS_NoDB_Init() at that point. 1112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::FilePath GetInitialConfigDirectory() { 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 1132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return base::FilePath(kReadOnlyCertDB); 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return GetDefaultConfigDirectory(); 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This callback for NSS forwards all requests to a caller-specified 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// CryptoModuleBlockingPasswordDelegate object. 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) { 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we get asked for a password for the TPM, then return the 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // well known password we use, as long as the TPM slot has been 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // initialized. 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (crypto::IsTPMTokenReady()) { 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string token_name; 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string user_pin; 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) crypto::GetTPMTokenInfo(&token_name, &user_pin); 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_GetTokenName(slot) == token_name) 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PORT_Strdup(user_pin.c_str()); 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) crypto::CryptoModuleBlockingPasswordDelegate* delegate = 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg); 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (delegate) { 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool cancelled = false; 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string password = delegate->RequestPassword(PK11_GetTokenName(slot), 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) retry != PR_FALSE, 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) &cancelled); 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (cancelled) 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char* result = PORT_Strdup(password.c_str()); 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) password.replace(0, password.size(), password.size(), 0); 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return result; 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DLOG(ERROR) << "PK11 password requested with NULL arg"; 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// NSS creates a local cache of the sqlite database if it detects that the 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// filesystem the database is on is much slower than the local disk. The 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection doesn't work with the latest versions of sqlite, such as 3.6.22 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561). So we set 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// detection when database_dir is on NFS. See http://crbug.com/48585. 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(wtc): port this function to other USE_NSS platforms. It is defined 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// only for OS_LINUX and OS_OPENBSD simply because the statfs structure 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is OS-specific. 1615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 1625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Because this function sets an environment variable it must be run before we 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// go multi-threaded. 1642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) { 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_LINUX) || defined(OS_OPENBSD) 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) struct statfs buf; 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (statfs(database_dir.value().c_str(), &buf) == 0) { 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_LINUX) 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (buf.f_type == NFS_SUPER_MAGIC) { 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(OS_OPENBSD) 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (strcmp(buf.f_fstypename, MOUNT_NFS) == 0) { 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* use_cache_env_var = "NSS_SDB_USE_CACHE"; 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!env->HasVar(use_cache_env_var)) 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) env->SetVar(use_cache_env_var, "yes"); 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_LINUX) || defined(OS_OPENBSD) 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PK11SlotInfo* FindSlotWithTokenName(const std::string& token_name) { 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) AutoSECMODListReadLock auto_lock; 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModuleList* head = SECMOD_GetDefaultModuleList(); 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (SECMODModuleList* item = head; item != NULL; item = item->next) { 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int slot_count = item->module->loaded ? item->module->slotCount : 0; 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (int i = 0; i < slot_count; i++) { 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* slot = item->module->slots[i]; 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_GetTokenName(slot) == token_name) 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(slot); 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A singleton to initialize/deinitialize NSPR. 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Separate from the NSS singleton because we initialize NSPR on the UI thread. 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Now that we're leaking the singleton, we could merge back with the NSS 2015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// singleton. 2025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSPRInitSingleton { 2035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 2045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>; 2055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSPRInitSingleton() { 2075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); 2085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 2135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSPRInitSingleton() { 2145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PL_ArenaFinish(); 2155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PRStatus prstatus = PR_Cleanup(); 2165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (prstatus != PR_SUCCESS) 2175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; 2185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 2205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSPRInitSingleton>::Leaky 2225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton = LAZY_INSTANCE_INITIALIZER; 2235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This is a LazyInstance so that it will be deleted automatically when the 2255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// unittest exits. NSSInitSingleton is a LeakySingleton, so it would not be 2265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// deleted if it were a regular member. 2272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)base::LazyInstance<base::ScopedTempDir> g_test_nss_db_dir = 2282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LAZY_INSTANCE_INITIALIZER; 2292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Force a crash with error info on NSS_NoDB_Init failure. 2312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CrashOnNSSInitFailure() { 2322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int nss_error = PR_GetError(); 2332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int os_error = PR_GetOSError(); 2342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&nss_error); 2352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::debug::Alias(&os_error); 2362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(ERROR) << "Error initializing NSS without a persistent database: " 2372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) << GetNSSErrorMessage(); 2382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) LOG(FATAL) << "nss_error=" << nss_error << ", os_error=" << os_error; 2392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class NSSInitSingleton { 2425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 2435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 2445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void OpenPersistentNSSDB() { 2455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!chromeos_user_logged_in_) { 2465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. 2475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporarily allow it until we fix http://crbug.com/70119 2485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 2495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chromeos_user_logged_in_ = true; 2505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This creates another DB slot in NSS that is read/write, unlike 2525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the fake root CA cert DB and the "default" crypto key 2535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // provider, which are still read-only (because we initialized 2545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NSS before we had a cryptohome mounted). 2555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_ = OpenUserDB(GetDefaultConfigDirectory(), 2565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kNSSDatabaseName); 2575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void EnableTPMTokenForNSS() { 2615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_token_enabled_for_nss_ = true; 2625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool InitializeTPMToken(const std::string& token_name, 2655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& user_pin) { 2665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If EnableTPMTokenForNSS hasn't been called, return false. 2675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!tpm_token_enabled_for_nss_) 2685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 2695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If everything is already initialized, then return true. 2715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_ && tpm_slot_) 2725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_token_name_ = token_name; 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_user_pin_ = user_pin; 2765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This tries to load the Chaps module so NSS can talk to the hardware 2785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TPM. 2795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!chaps_module_) { 2805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_ = LoadModule( 2815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsModuleName, 2825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kChapsPath, 2835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For more details on these parameters, see: 2845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://developer.mozilla.org/en/PKCS11_Module_Specs 2855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // slotFlags=[PublicCerts] -- Certificates and public keys can be 2865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // read from this slot without requiring a call to C_Login. 2875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // askpw=only -- Only authenticate to the token when necessary. 2885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\""); 2895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_){ 2915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If this gets set, then we'll use the TPM for certs with 2925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // private keys, otherwise we'll fall back to the software 2935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // implementation. 2945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_slot_ = GetTPMSlot(); 2955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return tpm_slot_ != NULL; 2975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 2995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) { 3025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!tpm_token_enabled_for_nss_) { 3035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "GetTPMTokenInfo called before TPM Token is ready."; 3045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 3055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (token_name) 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *token_name = tpm_token_name_; 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (user_pin) 3095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *user_pin = tpm_user_pin_; 3105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool IsTPMTokenReady() { 3135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return tpm_slot_ != NULL; 3145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* GetTPMSlot() { 3175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string token_name; 3185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GetTPMTokenInfo(&token_name, NULL); 3195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return FindSlotWithTokenName(token_name); 3205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SymmetricKey* GetSupplementalUserKey() { 3235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(chromeos_user_logged_in_); 3245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* slot = NULL; 3265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SymKey* key = NULL; 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECItem keyID; 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CK_MECHANISM_TYPE type = CKM_AES_ECB; 3295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) slot = GetPublicNSSKeySlot(); 3315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!slot) 3325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) goto done; 3335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_Authenticate(slot, PR_TRUE, NULL) != SECSuccess) 3355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) goto done; 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) keyID.type = siBuffer; 3385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) keyID.data = kSupplementalUserKeyId; 3395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) keyID.len = static_cast<int>(sizeof(kSupplementalUserKeyId)); 3405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Find/generate AES key. 3425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key = PK11_FindFixedKey(slot, type, &keyID, NULL); 3435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!key) { 3445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const int kKeySizeInBytes = 32; 3455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key = PK11_TokenKeyGen(slot, type, NULL, 3465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kKeySizeInBytes, 3475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) &keyID, PR_TRUE, NULL); 3485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) done: 3515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (slot) 3525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(slot); 3535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return key ? SymmetricKey::CreateFromKey(key) : NULL; 3555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 3575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool OpenTestNSSDB() { 3605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!g_test_nss_db_dir.Get().CreateUniqueTempDir()) 3635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 3645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) test_slot_ = OpenUserDB(g_test_nss_db_dir.Get().path(), "Test DB"); 3655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return !!test_slot_; 3665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void CloseTestNSSDB() { 3695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) { 3705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = SECMOD_CloseUserDB(test_slot_); 3715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) 3725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError(); 3735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(test_slot_); 3745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) test_slot_ = NULL; 3755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ignore_result(g_test_nss_db_dir.Get().Delete()); 3765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* GetPublicNSSKeySlot() { 3805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 3815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(test_slot_); 3825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) 3835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(software_slot_); 3845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_GetInternalKeySlot(); 3855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* GetPrivateNSSKeySlot() { 3885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (test_slot_) 3895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(test_slot_); 3905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 3925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (tpm_token_enabled_for_nss_) { 3935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (IsTPMTokenReady()) { 3945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(tpm_slot_); 3955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 3965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we were supposed to get the hardware token, but were 3975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // unable to, return NULL rather than fall back to sofware. 3985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 4025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we weren't supposed to enable the TPM for NSS, then return 4035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the software slot. 4045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) 4055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_ReferenceSlot(software_slot_); 4065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return PK11_GetInternalKeySlot(); 4075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 4105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock* write_lock() { 4115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return &write_lock_; 4125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 4145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This method is used to force NSS to be initialized without a DB. 4165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Call this method before NSSInitSingleton() is constructed. 4175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static void ForceNoDBInit() { 4185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) force_nodb_init_ = true; 4195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 4225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>; 4235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton() 4255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : tpm_token_enabled_for_nss_(false), 4265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_(NULL), 4275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_(NULL), 4285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) test_slot_(NULL), 4295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_slot_(NULL), 4305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_(NULL), 4315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chromeos_user_logged_in_(false) { 4322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks start_time = base::TimeTicks::Now(); 4335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EnsureNSPRInit(); 4345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // We *must* have NSS >= 3.12.3. See bug 26448. 4365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) COMPILE_ASSERT( 4375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (NSS_VMAJOR == 3 && NSS_VMINOR == 12 && NSS_VPATCH >= 3) || 4385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (NSS_VMAJOR == 3 && NSS_VMINOR > 12) || 4395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) (NSS_VMAJOR > 3), 4405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nss_version_check_failed); 4415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Also check the run-time NSS version. 4425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NSS_VersionCheck is a >= check, not strict equality. 4435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!NSS_VersionCheck("3.12.3")) { 4445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // It turns out many people have misconfigured NSS setups, where 4455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // their run-time NSPR doesn't match the one their NSS was compiled 4465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // against. So rather than aborting, complain loudly. 4475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed. " 4485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "We depend on NSS >= 3.12.3, and this error is not fatal " 4495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "only because many people have busted NSS setups (for " 4505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "example, using the wrong version of NSPR). " 4515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "Please upgrade to the latest NSS and NSPR, and if you " 4525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "still get this error, contact your distribution " 4535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "maintainer."; 4545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = SECFailure; 4575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool nodb_init = force_nodb_init_; 4585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 4605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use the system certificate store, so initialize NSS without database. 4615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) nodb_init = true; 4625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 4635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (nodb_init) { 4655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 4665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 4672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 4682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return; 4695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_IOS) 4715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 4725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_IOS) 4735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 4745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 4752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 4765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) { 4775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This duplicates the work which should have been done in 4785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // EarlySetupForNSSInit. However, this function is idempotent so 4795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // there's no harm done. 4805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 4815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initialize with a persistent database (likely, ~/.pki/nssdb). 4835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use "sql:" which can be shared by multiple processes safely. 4845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string nss_config_dir = 4852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::StringPrintf("sql:%s", database_dir.value().c_str()); 4865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 4875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_Init(nss_config_dir.c_str()); 4885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#else 4895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_InitReadWrite(nss_config_dir.c_str()); 4905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 4915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 4925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error initializing NSS with a persistent " 4935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "database (" << nss_config_dir 4945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "): " << GetNSSErrorMessage(); 4955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 4985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "Initializing NSS without a persistent database."; 4995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) status = NSS_NoDB_Init(NULL); 5005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 5012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CrashOnNSSInitFailure(); 5025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 5035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_SetPasswordFunc(PKCS11PasswordFunc); 5075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If we haven't initialized the password for the NSS databases, 5095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // initialize an empty-string password so that we don't need to 5105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // log in. 5115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* slot = PK11_GetInternalKeySlot(); 5125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (slot) { 5135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PK11_InitPin may write to the keyDB, but no other thread can use NSS 5145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // yet, so we don't need to lock. 5155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_NeedUserInit(slot)) 5165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_InitPin(slot, NULL, NULL); 5175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(slot); 5185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = InitDefaultRootCerts(); 5215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 5225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 5242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Disable MD5 certificate signatures. (They are disabled by default in 5252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // NSS 3.14.) 5262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_MD5, 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 5272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NSS_SetAlgorithmPolicy(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION, 5282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 0, NSS_USE_ALG_IN_CERT_SIGNATURE); 5292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 5302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // The UMA bit is conditionally set for this histogram in 5312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // chrome/common/startup_metric_utils.cc . 5322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) HISTOGRAM_CUSTOM_TIMES("Startup.SlowStartupNSSInit", 5332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeTicks::Now() - start_time, 5342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromMilliseconds(10), 5352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::TimeDelta::FromHours(1), 5362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 50); 5375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // NOTE(willchan): We don't actually execute this code since we leak NSS to 5405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // prevent non-joinable threads from using NSS after it's already been shut 5415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // down. 5425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~NSSInitSingleton() { 5435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (tpm_slot_) { 5445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(tpm_slot_); 5455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) tpm_slot_ = NULL; 5465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (software_slot_) { 5485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_CloseUserDB(software_slot_); 5495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_FreeSlot(software_slot_); 5505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) software_slot_ = NULL; 5515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CloseTestNSSDB(); 5535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root_) { 5545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(root_); 5555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(root_); 5565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) root_ = NULL; 5575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (chaps_module_) { 5595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_UnloadUserModule(chaps_module_); 5605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_DestroyModule(chaps_module_); 5615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) chaps_module_ = NULL; 5625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECStatus status = NSS_Shutdown(); 5655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (status != SECSuccess) { 5665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // We VLOG(1) because this failure is relatively harmless (leaking, but 5675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // we're shutting down anyway). 5685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609"; 5695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) || defined(OS_IOS) 5735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load nss's built-in root certs. 5745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* InitDefaultRootCerts() { 5755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL); 5765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (root) 5775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return root; 5785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Aw, snap. Can't find/load root cert shared library. 5805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This will make it hard to talk to anybody via https. 5815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 5825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 5835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Load the given module for this NSS session. 5865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* LoadModule(const char* name, 5875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* library_path, 5885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* params) { 5892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::string modparams = base::StringPrintf( 5905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "name=\"%s\" library=\"%s\" %s", 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) name, library_path, params ? params : ""); 5925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Shouldn't need to const_cast here, but SECMOD doesn't properly 5945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // declare input string arguments as const. Bug 5955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed 5965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // on NSS codebase to address this. 5975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* module = SECMOD_LoadUserModule( 5985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(modparams.c_str()), NULL, PR_FALSE); 5995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!module) { 6005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error loading " << name << " module into NSS: " 6015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << GetNSSErrorMessage(); 6025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 6035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return module; 6055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 6075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static PK11SlotInfo* OpenUserDB(const base::FilePath& path, 6095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* description) { 6105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string modspec = 6112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::StringPrintf("configDir='sql:%s' tokenDescription='%s'", 6122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) path.value().c_str(), description); 6135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str()); 6145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (db_slot) { 6155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (PK11_NeedUserInit(db_slot)) 6165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11_InitPin(db_slot, NULL, NULL); 6175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) else { 6195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Error opening persistent database (" << modspec 6205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "): " << GetNSSErrorMessage(); 6215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return db_slot; 6235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If this is set to true NSS is forced to be initialized without a DB. 6265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static bool force_nodb_init_; 6275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool tpm_token_enabled_for_nss_; 6295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string tpm_token_name_; 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string tpm_user_pin_; 6315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* chaps_module_; 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* software_slot_; 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* test_slot_; 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PK11SlotInfo* tpm_slot_; 6355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODModule* root_; 6365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool chromeos_user_logged_in_; 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // is fixed, we will no longer need the lock. 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock write_lock_; 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 6435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool NSSInitSingleton::force_nodb_init_ = false; 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<NSSInitSingleton>::Leaky 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton = LAZY_INSTANCE_INITIALIZER; 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace 6505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EarlySetupForNSSInit() { 6532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath database_dir = GetInitialConfigDirectory(); 6545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!database_dir.empty()) 6555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) UseLocalCacheOfNSSDatabaseIfNFS(database_dir); 6565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 6585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSPRInit() { 6605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nspr_singleton.Get(); 6615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void InitNSSSafely() { 6642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We might fork, but we haven't loaded any security modules. 6652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DisableNSSForkCheck(); 6662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If we're sandboxed, we shouldn't be able to open user security modules, 6672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // but it's more correct to tell NSS to not even try. 6682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Loading user security modules would have security implications. 6692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ForceNSSNoDBInit(); 6702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Initialize NSS. 6712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EnsureNSSInit(); 6722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 6732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnsureNSSInit() { 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Initializing SSL causes us to do blocking IO. 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Temporarily allow it until we fix 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // http://code.google.com/p/chromium/issues/detail?id=59847 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::ThreadRestrictions::ScopedAllowIO allow_io; 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get(); 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void ForceNSSNoDBInit() { 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NSSInitSingleton::ForceNoDBInit(); 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void DisableNSSForkCheck() { 6875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 6885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); 6895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void LoadNSSLibraries() { 6925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Some NSS libraries are linked dynamically so load them here. 6935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 6945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Try to search for multiple directories to load the libraries. 6952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) std::vector<base::FilePath> paths; 6965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Use relative path to Search PATH for the library files. 6982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath()); 6995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For Debian derivatives NSS libraries are located here. 7012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/nss")); 7025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Ubuntu 11.10 (Oneiric) places the libraries here. 7045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(ARCH_CPU_X86_64) 7052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/x86_64-linux-gnu/nss")); 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_X86) 7072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/i386-linux-gnu/nss")); 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#elif defined(ARCH_CPU_ARMEL) 7092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabi/nss")); 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 7115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A list of library files to load. 7135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> libs; 7145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libsoftokn3.so"); 7155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) libs.push_back("libfreebl3.so"); 7165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // For each combination of library file and path, check for existence and 7185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // then load. 7195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t loaded = 0; 7205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < libs.size(); ++i) { 7215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t j = 0; j < paths.size(); ++j) { 7222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath path = paths[j].Append(libs[i]); 7235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL); 7245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lib) { 7255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++loaded; 7265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 7275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (loaded == libs.size()) { 7325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) VLOG(3) << "NSS libraries loaded."; 7335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 7345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << "Failed to load NSS libraries."; 7355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 7375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool CheckNSSVersion(const char* version) { 7405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return !!NSS_VersionCheck(version); 7415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(USE_NSS) 7445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)ScopedTestNSSDB::ScopedTestNSSDB() 7455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : is_open_(g_nss_singleton.Get().OpenTestNSSDB()) { 7465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)ScopedTestNSSDB::~ScopedTestNSSDB() { 7495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(mattm): Close the dababase once NSS 3.14 is required, 7505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // which fixes https://bugzilla.mozilla.org/show_bug.cgi?id=588269 7515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Resource leaks are suppressed. http://crbug.com/156433 . 7525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Lock* GetNSSWriteLock() { 7555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().write_lock(); 7565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) { 7595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // May be NULL if the lock is not needed in our version of NSS. 7605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) 7615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Acquire(); 7625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoNSSWriteLock::~AutoNSSWriteLock() { 7655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lock_) { 7665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->AssertAcquired(); 7675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) lock_->Release(); 7685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::AutoSECMODListReadLock() 7725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : lock_(SECMOD_GetDefaultModuleListLock()) { 7735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_GetReadLock(lock_); 7745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)AutoSECMODListReadLock::~AutoSECMODListReadLock() { 7775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMOD_ReleaseReadLock(lock_); 7785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(USE_NSS) 7815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_CHROMEOS) 7835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void OpenPersistentNSSDB() { 7845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().OpenPersistentNSSDB(); 7855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void EnableTPMTokenForNSS() { 7885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().EnableTPMTokenForNSS(); 7895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) { 7925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_nss_singleton.Get().GetTPMTokenInfo(token_name, user_pin); 7935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool IsTPMTokenReady() { 7965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().IsTPMTokenReady(); 7975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool InitializeTPMToken(const std::string& token_name, 8005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& user_pin) { 8015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().InitializeTPMToken(token_name, user_pin); 8025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)SymmetricKey* GetSupplementalUserKey() { 8055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().GetSupplementalUserKey(); 8065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 8085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::Time PRTimeToBaseTime(PRTime prtime) { 8105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return base::Time::FromInternalValue( 8115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) prtime + base::Time::UnixEpoch().ToInternalValue()); 8125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PRTime BaseTimeToPRTime(base::Time time) { 8155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue(); 8165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PK11SlotInfo* GetPublicNSSKeySlot() { 8195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().GetPublicNSSKeySlot(); 8205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)PK11SlotInfo* GetPrivateNSSKeySlot() { 8235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return g_nss_singleton.Get().GetPrivateNSSKeySlot(); 8245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 8255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace crypto 827