15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifndef CRYPTO_NSS_UTIL_INTERNAL_H_ 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define CRYPTO_NSS_UTIL_INTERNAL_H_ 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <secmodt.h> 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 10a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "base/callback.h" 11a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "base/compiler_specific.h" 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "crypto/crypto_export.h" 13a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "crypto/scoped_nss_types.h" 14a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 15a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)namespace base { 16a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)class FilePath; 17a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// These functions return a type defined in an NSS header, and so cannot be 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// declared in nss_util.h. Hence, they are declared here. 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace crypto { 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Opens an NSS software database in folder |path|, with the (potentially) 255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// user-visible description |description|. Returns the slot for the opened 265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// database, or NULL if the database could not be opened. 275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)CRYPTO_EXPORT_PRIVATE ScopedPK11Slot 285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) OpenSoftwareNSSDB(const base::FilePath& path, 295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& description); 305f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 315f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#if !defined(OS_CHROMEOS) 32116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Returns a reference to the default NSS key slot for storing persistent data. 33116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Caller must release returned reference with PK11_FreeSlot. 34116680a4aac90f2aa7413d9095a592090648e557Ben MurdochCRYPTO_EXPORT PK11SlotInfo* GetPersistentNSSKeySlot() WARN_UNUSED_RESULT; 355f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#endif 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A helper class that acquires the SECMOD list read lock while the 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// AutoSECMODListReadLock is in scope. 395d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)class CRYPTO_EXPORT AutoSECMODListReadLock { 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) AutoSECMODListReadLock(); 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~AutoSECMODListReadLock(); 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SECMODListLock* lock_; 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DISALLOW_COPY_AND_ASSIGN(AutoSECMODListReadLock); 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 49a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#if defined(OS_CHROMEOS) 505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Returns a reference to the system-wide TPM slot if it is loaded. If it is not 515f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// loaded and |callback| is non-null, the |callback| will be run once the slot 525f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// is loaded. 535f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)CRYPTO_EXPORT ScopedPK11Slot GetSystemNSSKeySlot( 545f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) WARN_UNUSED_RESULT; 555f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 565f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Sets the test system slot to |slot|, which means that |slot| will be exposed 575f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// through |GetSystemNSSKeySlot| and |IsTPMTokenReady| will return true. 585f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// |InitializeTPMTokenAndSystemSlot|, which triggers the TPM initialization, 595f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// does not have to be called if the test system slot is set. 605f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// This must must not be called consecutively with a |slot| != NULL. If |slot| 615f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// is NULL, the test system slot is unset. 625f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)CRYPTO_EXPORT_PRIVATE void SetSystemKeySlotForTesting(ScopedPK11Slot slot); 63116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 64a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Prepare per-user NSS slot mapping. It is safe to call this function multiple 65a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// times. Returns true if the user was added, or false if it already existed. 66a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)CRYPTO_EXPORT bool InitializeNSSForChromeOSUser( 67a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 68116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const base::FilePath& path); 69116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 70116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Returns whether TPM for ChromeOS user still needs initialization. If 71116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// true is returned, the caller can proceed to initialize TPM slot for the 72116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// user, but should call |WillInitializeTPMForChromeOSUser| first. 73116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// |InitializeNSSForChromeOSUser| must have been called first. 74116680a4aac90f2aa7413d9095a592090648e557Ben MurdochCRYPTO_EXPORT bool ShouldInitializeTPMForChromeOSUser( 75116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const std::string& username_hash) WARN_UNUSED_RESULT; 76116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 77116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Makes |ShouldInitializeTPMForChromeOSUser| start returning false. 78116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Should be called before starting TPM initialization for the user. 79116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch// Assumes |InitializeNSSForChromeOSUser| had already been called. 80116680a4aac90f2aa7413d9095a592090648e557Ben MurdochCRYPTO_EXPORT void WillInitializeTPMForChromeOSUser( 81116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch const std::string& username_hash); 82a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 83a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Use TPM slot |slot_id| for user. InitializeNSSForChromeOSUser must have been 84a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// called first. 85a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)CRYPTO_EXPORT void InitializeTPMForChromeOSUser( 86a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 87a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CK_SLOT_ID slot_id); 88a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 89a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Use the software slot as the private slot for user. 90a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// InitializeNSSForChromeOSUser must have been called first. 91a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)CRYPTO_EXPORT void InitializePrivateSoftwareSlotForChromeOSUser( 92a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash); 93a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 94a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Returns a reference to the public slot for user. 95a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)CRYPTO_EXPORT ScopedPK11Slot GetPublicSlotForChromeOSUser( 96a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash) WARN_UNUSED_RESULT; 97a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 98a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Returns the private slot for |username_hash| if it is loaded. If it is not 99a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// loaded and |callback| is non-null, the |callback| will be run once the slot 100a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// is loaded. 101a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)CRYPTO_EXPORT ScopedPK11Slot GetPrivateSlotForChromeOSUser( 102a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const std::string& username_hash, 103a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) const base::Callback<void(ScopedPK11Slot)>& callback) WARN_UNUSED_RESULT; 1045f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 1055f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// Closes the NSS DB for |username_hash| that was previously opened by the 1065f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// *Initialize*ForChromeOSUser functions. 1075f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)CRYPTO_EXPORT_PRIVATE void CloseChromeOSUserForTesting( 1085f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const std::string& username_hash); 109a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#endif // defined(OS_CHROMEOS) 110a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace crypto 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // CRYPTO_NSS_UTIL_INTERNAL_H_ 114