| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CRYPTO_NSS_UTIL_H_ | 5 #ifndef CRYPTO_NSS_UTIL_H_ |
| 6 #define CRYPTO_NSS_UTIL_H_ | 6 #define CRYPTO_NSS_UTIL_H_ |
| 7 #pragma once | 7 #pragma once |
| 8 | 8 |
| 9 #include <string> | 9 #include <string> |
| 10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
| 11 #include "base/callback.h" | |
| 12 #include "crypto/crypto_export.h" | 11 #include "crypto/crypto_export.h" |
| 13 | 12 |
| 14 #if defined(USE_NSS) | 13 #if defined(USE_NSS) |
| 15 class FilePath; | 14 class FilePath; |
| 16 #endif // defined(USE_NSS) | 15 #endif // defined(USE_NSS) |
| 17 | 16 |
| 18 namespace base { | 17 namespace base { |
| 19 class Lock; | 18 class Lock; |
| 20 class Time; | 19 class Time; |
| 21 } // namespace base | 20 } // namespace base |
| 22 | 21 |
| 23 // This file specifically doesn't depend on any NSS or NSPR headers because it | 22 // This file specifically doesn't depend on any NSS or NSPR headers because it |
| 24 // is included by various (non-crypto) parts of chrome to call the | 23 // is included by various (non-crypto) parts of chrome to call the |
| 25 // initialization functions. | 24 // initialization functions. |
| 26 namespace crypto { | 25 namespace crypto { |
| 27 | 26 |
| 28 class SymmetricKey; | 27 class SymmetricKey; |
| 29 | 28 |
| 30 // A callback to handle the result of InitializeTPMToken. | |
| 31 typedef base::Callback<void(bool result)> InitializeTPMTokenCallback; | |
| 32 | |
| 33 #if defined(USE_NSS) | 29 #if defined(USE_NSS) |
| 34 // EarlySetupForNSSInit performs lightweight setup which must occur before the | 30 // EarlySetupForNSSInit performs lightweight setup which must occur before the |
| 35 // process goes multithreaded. This does not initialise NSS. For test, see | 31 // process goes multithreaded. This does not initialise NSS. For test, see |
| 36 // EnsureNSSInit. | 32 // EnsureNSSInit. |
| 37 CRYPTO_EXPORT void EarlySetupForNSSInit(); | 33 CRYPTO_EXPORT void EarlySetupForNSSInit(); |
| 38 #endif | 34 #endif |
| 39 | 35 |
| 40 // Initialize NRPR if it isn't already initialized. This function is | 36 // Initialize NRPR if it isn't already initialized. This function is |
| 41 // thread-safe, and NSPR will only ever be initialized once. | 37 // thread-safe, and NSPR will only ever be initialized once. |
| 42 CRYPTO_EXPORT void EnsureNSPRInit(); | 38 CRYPTO_EXPORT void EnsureNSPRInit(); |
| (...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 86 // Check if the current NSS version is greater than or equals to |version|. | 82 // Check if the current NSS version is greater than or equals to |version|. |
| 87 // A sample version string is "3.12.3". | 83 // A sample version string is "3.12.3". |
| 88 bool CheckNSSVersion(const char* version); | 84 bool CheckNSSVersion(const char* version); |
| 89 | 85 |
| 90 #if defined(OS_CHROMEOS) | 86 #if defined(OS_CHROMEOS) |
| 91 // Open the r/w nssdb that's stored inside the user's encrypted home | 87 // Open the r/w nssdb that's stored inside the user's encrypted home |
| 92 // directory. This is the default slot returned by | 88 // directory. This is the default slot returned by |
| 93 // GetPublicNSSKeySlot(). | 89 // GetPublicNSSKeySlot(). |
| 94 CRYPTO_EXPORT void OpenPersistentNSSDB(); | 90 CRYPTO_EXPORT void OpenPersistentNSSDB(); |
| 95 | 91 |
| 96 // A delegate class that we can use to access the cros API for | |
| 97 // communication with cryptohomed and the TPM. | |
| 98 class CRYPTO_EXPORT TPMTokenInfoDelegate { | |
| 99 public: | |
| 100 // A callback to handle the result of RequestIsTokenReady. | |
| 101 typedef base::Callback<void(bool result)> RequestIsTokenReadyCallback; | |
| 102 | |
| 103 TPMTokenInfoDelegate(); | |
| 104 virtual ~TPMTokenInfoDelegate(); | |
| 105 | |
| 106 // Runs |callback| with true if the TPM and PKCS#11 token slot is ready to be | |
| 107 // used. | |
| 108 // If IsTokenAvailable() is false this should run |callback| with false. | |
| 109 // If IsTokenAvailable() is true, this should eventually run |callback| with | |
| 110 // true. | |
| 111 virtual void RequestIsTokenReady(RequestIsTokenReadyCallback callback) const | |
| 112 = 0; | |
| 113 | |
| 114 // Fetches token properties. TODO(stevenjb): make this interface asynchronous | |
| 115 // so that the implementation does not have to be blocking. | |
| 116 virtual void GetTokenInfo(std::string* token_name, | |
| 117 std::string* user_pin) const = 0; | |
| 118 }; | |
| 119 | |
| 120 // Indicates that NSS should load the Chaps library so that we | 92 // Indicates that NSS should load the Chaps library so that we |
| 121 // can access the TPM through NSS. Once this is called, | 93 // can access the TPM through NSS. Once this is called, |
| 122 // GetPrivateNSSKeySlot() will return the TPM slot if one was found. | 94 // GetPrivateNSSKeySlot() will return the TPM slot if one was found. |
| 123 // Takes ownership of the passed-in delegate object so it can access | 95 CRYPTO_EXPORT void EnableTPMTokenForNSS(); |
| 124 // the cros library to talk to cryptohomed. | |
| 125 CRYPTO_EXPORT void EnableTPMTokenForNSS(TPMTokenInfoDelegate* delegate); | |
| 126 | 96 |
| 127 // Get name and user PIN for the built-in TPM token on ChromeOS. | 97 // Get name and user PIN for the built-in TPM token on ChromeOS. |
| 128 // Either one can safely be NULL. Should only be called after | 98 // Either one can safely be NULL. Should only be called after |
| 129 // EnableTPMTokenForNSS has been called with a non-null delegate. | 99 // EnableTPMTokenForNSS has been called with a non-null delegate. |
| 130 CRYPTO_EXPORT void GetTPMTokenInfo(std::string* token_name, | 100 CRYPTO_EXPORT void GetTPMTokenInfo(std::string* token_name, |
| 131 std::string* user_pin); | 101 std::string* user_pin); |
| 132 | 102 |
| 133 // Returns true if the TPM is owned and PKCS#11 initialized with the | 103 // Returns true if the TPM is owned and PKCS#11 initialized with the |
| 134 // user and security officer PINs, and has been enabled in NSS by | 104 // user and security officer PINs, and has been enabled in NSS by |
| 135 // calling EnableTPMForNSS, and Chaps has been successfully | 105 // calling EnableTPMForNSS, and Chaps has been successfully |
| 136 // loaded into NSS. | 106 // loaded into NSS. |
| 137 CRYPTO_EXPORT bool IsTPMTokenReady(); | 107 CRYPTO_EXPORT bool IsTPMTokenReady(); |
| 138 | 108 |
| 139 // Initialize the TPM token. Does nothing if it is already initialized. | 109 // Initialize the TPM token. Does nothing if it is already initialized. |
| 140 CRYPTO_EXPORT void InitializeTPMToken(InitializeTPMTokenCallback callback); | 110 CRYPTO_EXPORT bool InitializeTPMToken(const std::string& token_name, |
| 111 const std::string& user_pin); |
| 141 | 112 |
| 142 // Gets supplemental user key. Creates one in NSS database if it does not exist. | 113 // Gets supplemental user key. Creates one in NSS database if it does not exist. |
| 143 // The supplemental user key is used for AES encryption of user data that is | 114 // The supplemental user key is used for AES encryption of user data that is |
| 144 // stored and protected by cryptohome. This additional layer of encryption of | 115 // stored and protected by cryptohome. This additional layer of encryption of |
| 145 // provided to ensure that sensitive data wouldn't be exposed in plain text in | 116 // provided to ensure that sensitive data wouldn't be exposed in plain text in |
| 146 // case when an attacker would somehow gain access to all content within | 117 // case when an attacker would somehow gain access to all content within |
| 147 // cryptohome. | 118 // cryptohome. |
| 148 CRYPTO_EXPORT SymmetricKey* GetSupplementalUserKey(); | 119 CRYPTO_EXPORT SymmetricKey* GetSupplementalUserKey(); |
| 149 #endif | 120 #endif |
| 150 | 121 |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 183 private: | 154 private: |
| 184 base::Lock *lock_; | 155 base::Lock *lock_; |
| 185 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); | 156 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); |
| 186 }; | 157 }; |
| 187 | 158 |
| 188 #endif // defined(USE_NSS) | 159 #endif // defined(USE_NSS) |
| 189 | 160 |
| 190 } // namespace crypto | 161 } // namespace crypto |
| 191 | 162 |
| 192 #endif // CRYPTO_NSS_UTIL_H_ | 163 #endif // CRYPTO_NSS_UTIL_H_ |
| OLD | NEW |