| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "base/nss_util.h" | |
| 6 #include "base/nss_util_internal.h" | |
| 7 | |
| 8 #include <nss.h> | |
| 9 #include <plarena.h> | |
| 10 #include <prerror.h> | |
| 11 #include <prinit.h> | |
| 12 #include <prtime.h> | |
| 13 #include <pk11pub.h> | |
| 14 #include <secmod.h> | |
| 15 | |
| 16 #if defined(OS_LINUX) | |
| 17 #include <linux/nfs_fs.h> | |
| 18 #include <sys/vfs.h> | |
| 19 #endif | |
| 20 | |
| 21 #include <vector> | |
| 22 | |
| 23 #include "base/crypto/scoped_nss_types.h" | |
| 24 #include "base/environment.h" | |
| 25 #include "base/file_path.h" | |
| 26 #include "base/file_util.h" | |
| 27 #include "base/lazy_instance.h" | |
| 28 #include "base/logging.h" | |
| 29 #include "base/memory/scoped_ptr.h" | |
| 30 #include "base/native_library.h" | |
| 31 #include "base/stringprintf.h" | |
| 32 #include "base/threading/thread_restrictions.h" | |
| 33 | |
| 34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not | |
| 35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't | |
| 36 // use NSS for crypto or certificate verification, and we don't use the NSS | |
| 37 // certificate and key databases. | |
| 38 #if defined(USE_NSS) | |
| 39 #include "base/crypto/crypto_module_blocking_password_delegate.h" | |
| 40 #include "base/synchronization/lock.h" | |
| 41 #endif // defined(USE_NSS) | |
| 42 | |
| 43 namespace base { | |
| 44 | |
| 45 namespace { | |
| 46 | |
| 47 #if defined(OS_CHROMEOS) | |
| 48 const char kNSSDatabaseName[] = "Real NSS database"; | |
| 49 | |
| 50 // Constants for loading opencryptoki. | |
| 51 const char kOpencryptokiModuleName[] = "opencryptoki"; | |
| 52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so"; | |
| 53 | |
| 54 // TODO(gspencer): Get these values from cryptohomed's dbus API when | |
| 55 // we ask if it has initialized the TPM yet. These should not be | |
| 56 // hard-coded here. | |
| 57 const char kTPMTokenName[] = "Initialized by CrOS"; | |
| 58 const char kTPMUserPIN[] = "111111"; | |
| 59 const char kTPMSecurityOfficerPIN[] = "000000"; | |
| 60 | |
| 61 // Fake certificate authority database used for testing. | |
| 62 static const FilePath::CharType kReadOnlyCertDB[] = | |
| 63 FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb"); | |
| 64 #endif // defined(OS_CHROMEOS) | |
| 65 | |
| 66 std::string GetNSSErrorMessage() { | |
| 67 std::string result; | |
| 68 if (PR_GetErrorTextLength()) { | |
| 69 scoped_array<char> error_text(new char[PR_GetErrorTextLength() + 1]); | |
| 70 PRInt32 copied = PR_GetErrorText(error_text.get()); | |
| 71 result = std::string(error_text.get(), copied); | |
| 72 } else { | |
| 73 result = StringPrintf("NSS error code: %d", PR_GetError()); | |
| 74 } | |
| 75 return result; | |
| 76 } | |
| 77 | |
| 78 #if defined(USE_NSS) | |
| 79 FilePath GetDefaultConfigDirectory() { | |
| 80 FilePath dir = file_util::GetHomeDir(); | |
| 81 if (dir.empty()) { | |
| 82 LOG(ERROR) << "Failed to get home directory."; | |
| 83 return dir; | |
| 84 } | |
| 85 dir = dir.AppendASCII(".pki").AppendASCII("nssdb"); | |
| 86 if (!file_util::CreateDirectory(dir)) { | |
| 87 LOG(ERROR) << "Failed to create ~/.pki/nssdb directory."; | |
| 88 dir.clear(); | |
| 89 } | |
| 90 return dir; | |
| 91 } | |
| 92 | |
| 93 // On non-chromeos platforms, return the default config directory. | |
| 94 // On chromeos, return a read-only directory with fake root CA certs for testing | |
| 95 // (which will not exist on non-testing images). These root CA certs are used | |
| 96 // by the local Google Accounts server mock we use when testing our login code. | |
| 97 // If this directory is not present, NSS_Init() will fail. It is up to the | |
| 98 // caller to failover to NSS_NoDB_Init() at that point. | |
| 99 FilePath GetInitialConfigDirectory() { | |
| 100 #if defined(OS_CHROMEOS) | |
| 101 return FilePath(kReadOnlyCertDB); | |
| 102 #else | |
| 103 return GetDefaultConfigDirectory(); | |
| 104 #endif // defined(OS_CHROMEOS) | |
| 105 } | |
| 106 | |
| 107 // This callback for NSS forwards all requests to a caller-specified | |
| 108 // CryptoModuleBlockingPasswordDelegate object. | |
| 109 char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) { | |
| 110 #if defined(OS_CHROMEOS) | |
| 111 // If we get asked for a password for the TPM, then return the | |
| 112 // static password we use. | |
| 113 if (PK11_GetTokenName(slot) == base::GetTPMTokenName()) | |
| 114 return PORT_Strdup(kTPMUserPIN); | |
| 115 #endif | |
| 116 base::CryptoModuleBlockingPasswordDelegate* delegate = | |
| 117 reinterpret_cast<base::CryptoModuleBlockingPasswordDelegate*>(arg); | |
| 118 if (delegate) { | |
| 119 bool cancelled = false; | |
| 120 std::string password = delegate->RequestPassword(PK11_GetTokenName(slot), | |
| 121 retry != PR_FALSE, | |
| 122 &cancelled); | |
| 123 if (cancelled) | |
| 124 return NULL; | |
| 125 char* result = PORT_Strdup(password.c_str()); | |
| 126 password.replace(0, password.size(), password.size(), 0); | |
| 127 return result; | |
| 128 } | |
| 129 DLOG(ERROR) << "PK11 password requested with NULL arg"; | |
| 130 return NULL; | |
| 131 } | |
| 132 | |
| 133 // NSS creates a local cache of the sqlite database if it detects that the | |
| 134 // filesystem the database is on is much slower than the local disk. The | |
| 135 // detection doesn't work with the latest versions of sqlite, such as 3.6.22 | |
| 136 // (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561). So we set | |
| 137 // the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's | |
| 138 // detection when database_dir is on NFS. See http://crbug.com/48585. | |
| 139 // | |
| 140 // TODO(wtc): port this function to other USE_NSS platforms. It is defined | |
| 141 // only for OS_LINUX simply because the statfs structure is OS-specific. | |
| 142 // | |
| 143 // Because this function sets an environment variable it must be run before we | |
| 144 // go multi-threaded. | |
| 145 void UseLocalCacheOfNSSDatabaseIfNFS(const FilePath& database_dir) { | |
| 146 #if defined(OS_LINUX) | |
| 147 struct statfs buf; | |
| 148 if (statfs(database_dir.value().c_str(), &buf) == 0) { | |
| 149 if (buf.f_type == NFS_SUPER_MAGIC) { | |
| 150 scoped_ptr<Environment> env(Environment::Create()); | |
| 151 const char* use_cache_env_var = "NSS_SDB_USE_CACHE"; | |
| 152 if (!env->HasVar(use_cache_env_var)) | |
| 153 env->SetVar(use_cache_env_var, "yes"); | |
| 154 } | |
| 155 } | |
| 156 #endif // defined(OS_LINUX) | |
| 157 } | |
| 158 | |
| 159 // A helper class that acquires the SECMOD list read lock while the | |
| 160 // AutoSECMODListReadLock is in scope. | |
| 161 class AutoSECMODListReadLock { | |
| 162 public: | |
| 163 AutoSECMODListReadLock() | |
| 164 : lock_(SECMOD_GetDefaultModuleListLock()) { | |
| 165 SECMOD_GetReadLock(lock_); | |
| 166 } | |
| 167 | |
| 168 ~AutoSECMODListReadLock() { | |
| 169 SECMOD_ReleaseReadLock(lock_); | |
| 170 } | |
| 171 | |
| 172 private: | |
| 173 SECMODListLock* lock_; | |
| 174 DISALLOW_COPY_AND_ASSIGN(AutoSECMODListReadLock); | |
| 175 }; | |
| 176 | |
| 177 PK11SlotInfo* FindSlotWithTokenName(const std::string& token_name) { | |
| 178 AutoSECMODListReadLock auto_lock; | |
| 179 SECMODModuleList* head = SECMOD_GetDefaultModuleList(); | |
| 180 for (SECMODModuleList* item = head; item != NULL; item = item->next) { | |
| 181 int slot_count = item->module->loaded ? item->module->slotCount : 0; | |
| 182 for (int i = 0; i < slot_count; i++) { | |
| 183 PK11SlotInfo* slot = item->module->slots[i]; | |
| 184 if (PK11_GetTokenName(slot) == token_name) | |
| 185 return PK11_ReferenceSlot(slot); | |
| 186 } | |
| 187 } | |
| 188 return NULL; | |
| 189 } | |
| 190 | |
| 191 #endif // defined(USE_NSS) | |
| 192 | |
| 193 // A singleton to initialize/deinitialize NSPR. | |
| 194 // Separate from the NSS singleton because we initialize NSPR on the UI thread. | |
| 195 // Now that we're leaking the singleton, we could merge back with the NSS | |
| 196 // singleton. | |
| 197 class NSPRInitSingleton { | |
| 198 private: | |
| 199 friend struct DefaultLazyInstanceTraits<NSPRInitSingleton>; | |
| 200 | |
| 201 NSPRInitSingleton() { | |
| 202 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); | |
| 203 } | |
| 204 | |
| 205 // NOTE(willchan): We don't actually execute this code since we leak NSS to | |
| 206 // prevent non-joinable threads from using NSS after it's already been shut | |
| 207 // down. | |
| 208 ~NSPRInitSingleton() { | |
| 209 PL_ArenaFinish(); | |
| 210 PRStatus prstatus = PR_Cleanup(); | |
| 211 if (prstatus != PR_SUCCESS) { | |
| 212 LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; | |
| 213 } | |
| 214 } | |
| 215 }; | |
| 216 | |
| 217 LazyInstance<NSPRInitSingleton, LeakyLazyInstanceTraits<NSPRInitSingleton> > | |
| 218 g_nspr_singleton(LINKER_INITIALIZED); | |
| 219 | |
| 220 class NSSInitSingleton { | |
| 221 public: | |
| 222 #if defined(OS_CHROMEOS) | |
| 223 void OpenPersistentNSSDB() { | |
| 224 if (!chromeos_user_logged_in_) { | |
| 225 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. | |
| 226 // Temporarily allow it until we fix http://crbug.com/70119 | |
| 227 ThreadRestrictions::ScopedAllowIO allow_io; | |
| 228 chromeos_user_logged_in_ = true; | |
| 229 | |
| 230 // This creates another DB slot in NSS that is read/write, unlike | |
| 231 // the fake root CA cert DB and the "default" crypto key | |
| 232 // provider, which are still read-only (because we initialized | |
| 233 // NSS before we had a cryptohome mounted). | |
| 234 software_slot_ = OpenUserDB(GetDefaultConfigDirectory(), | |
| 235 kNSSDatabaseName); | |
| 236 } | |
| 237 } | |
| 238 | |
| 239 bool EnableTPMForNSS() { | |
| 240 if (!opencryptoki_module_) { | |
| 241 // This loads the opencryptoki module so we can talk to the | |
| 242 // hardware TPM. | |
| 243 opencryptoki_module_ = LoadModule( | |
| 244 kOpencryptokiModuleName, | |
| 245 kOpencryptokiPath, | |
| 246 // trustOrder=100 -- means it'll select this as the most | |
| 247 // trusted slot for the mechanisms it provides. | |
| 248 // slotParams=... -- selects RSA as only mechanism, and only | |
| 249 // asks for the password when necessary (instead of every | |
| 250 // time, or after a timeout). | |
| 251 "trustOrder=100 slotParams=(1={slotFlags=[RSA] askpw=only})"); | |
| 252 if (opencryptoki_module_) { | |
| 253 // We shouldn't need to initialize the TPM PIN here because | |
| 254 // it'll be taken care of by cryptohomed, but we have to make | |
| 255 // sure that it is initialized. | |
| 256 | |
| 257 // TODO(gspencer): replace this with a dbus call that will | |
| 258 // check to see that cryptohomed has initialized the PINs, and | |
| 259 // will fetch the token name and PINs for accessing the TPM. | |
| 260 EnsureTPMInit(); | |
| 261 | |
| 262 // If this is set, then we'll use the TPM by default. | |
| 263 tpm_slot_ = GetTPMSlot(); | |
| 264 return true; | |
| 265 } | |
| 266 } | |
| 267 return false; | |
| 268 } | |
| 269 | |
| 270 std::string GetTPMTokenName() { | |
| 271 // TODO(gspencer): This should come from the dbus interchange with | |
| 272 // cryptohomed instead of being hard-coded. | |
| 273 return std::string(kTPMTokenName); | |
| 274 } | |
| 275 | |
| 276 PK11SlotInfo* GetTPMSlot() { | |
| 277 return FindSlotWithTokenName(GetTPMTokenName()); | |
| 278 } | |
| 279 #endif // defined(OS_CHROMEOS) | |
| 280 | |
| 281 | |
| 282 bool OpenTestNSSDB(const FilePath& path, const char* description) { | |
| 283 test_slot_ = OpenUserDB(path, description); | |
| 284 return !!test_slot_; | |
| 285 } | |
| 286 | |
| 287 void CloseTestNSSDB() { | |
| 288 if (test_slot_) { | |
| 289 SECStatus status = SECMOD_CloseUserDB(test_slot_); | |
| 290 if (status != SECSuccess) | |
| 291 LOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError(); | |
| 292 PK11_FreeSlot(test_slot_); | |
| 293 test_slot_ = NULL; | |
| 294 } | |
| 295 } | |
| 296 | |
| 297 PK11SlotInfo* GetPublicNSSKeySlot() { | |
| 298 if (test_slot_) | |
| 299 return PK11_ReferenceSlot(test_slot_); | |
| 300 if (software_slot_) | |
| 301 return PK11_ReferenceSlot(software_slot_); | |
| 302 return PK11_GetInternalKeySlot(); | |
| 303 } | |
| 304 | |
| 305 PK11SlotInfo* GetPrivateNSSKeySlot() { | |
| 306 if (test_slot_) | |
| 307 return PK11_ReferenceSlot(test_slot_); | |
| 308 // If the TPM slot has been opened, then return that one. | |
| 309 if (tpm_slot_) | |
| 310 return PK11_ReferenceSlot(tpm_slot_); | |
| 311 // If it hasn't, then return the software slot. | |
| 312 if (software_slot_) | |
| 313 return PK11_ReferenceSlot(software_slot_); | |
| 314 return PK11_GetInternalKeySlot(); | |
| 315 } | |
| 316 | |
| 317 #if defined(USE_NSS) | |
| 318 Lock* write_lock() { | |
| 319 return &write_lock_; | |
| 320 } | |
| 321 #endif // defined(USE_NSS) | |
| 322 | |
| 323 // This method is used to force NSS to be initialized without a DB. | |
| 324 // Call this method before NSSInitSingleton() is constructed. | |
| 325 static void ForceNoDBInit() { | |
| 326 force_nodb_init_ = true; | |
| 327 } | |
| 328 | |
| 329 private: | |
| 330 friend struct DefaultLazyInstanceTraits<NSSInitSingleton>; | |
| 331 | |
| 332 NSSInitSingleton() | |
| 333 : opencryptoki_module_(NULL), | |
| 334 software_slot_(NULL), | |
| 335 test_slot_(NULL), | |
| 336 tpm_slot_(NULL), | |
| 337 root_(NULL), | |
| 338 chromeos_user_logged_in_(false) { | |
| 339 EnsureNSPRInit(); | |
| 340 | |
| 341 // We *must* have NSS >= 3.12.3. See bug 26448. | |
| 342 COMPILE_ASSERT( | |
| 343 (NSS_VMAJOR == 3 && NSS_VMINOR == 12 && NSS_VPATCH >= 3) || | |
| 344 (NSS_VMAJOR == 3 && NSS_VMINOR > 12) || | |
| 345 (NSS_VMAJOR > 3), | |
| 346 nss_version_check_failed); | |
| 347 // Also check the run-time NSS version. | |
| 348 // NSS_VersionCheck is a >= check, not strict equality. | |
| 349 if (!NSS_VersionCheck("3.12.3")) { | |
| 350 // It turns out many people have misconfigured NSS setups, where | |
| 351 // their run-time NSPR doesn't match the one their NSS was compiled | |
| 352 // against. So rather than aborting, complain loudly. | |
| 353 LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed. " | |
| 354 "We depend on NSS >= 3.12.3, and this error is not fatal " | |
| 355 "only because many people have busted NSS setups (for " | |
| 356 "example, using the wrong version of NSPR). " | |
| 357 "Please upgrade to the latest NSS and NSPR, and if you " | |
| 358 "still get this error, contact your distribution " | |
| 359 "maintainer."; | |
| 360 } | |
| 361 | |
| 362 SECStatus status = SECFailure; | |
| 363 bool nodb_init = force_nodb_init_; | |
| 364 | |
| 365 #if !defined(USE_NSS) | |
| 366 // Use the system certificate store, so initialize NSS without database. | |
| 367 nodb_init = true; | |
| 368 #endif | |
| 369 | |
| 370 if (nodb_init) { | |
| 371 status = NSS_NoDB_Init(NULL); | |
| 372 if (status != SECSuccess) { | |
| 373 LOG(ERROR) << "Error initializing NSS without a persistent " | |
| 374 "database: " << GetNSSErrorMessage(); | |
| 375 } | |
| 376 } else { | |
| 377 #if defined(USE_NSS) | |
| 378 FilePath database_dir = GetInitialConfigDirectory(); | |
| 379 if (!database_dir.empty()) { | |
| 380 // This duplicates the work which should have been done in | |
| 381 // EarlySetupForNSSInit. However, this function is idempotent so | |
| 382 // there's no harm done. | |
| 383 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); | |
| 384 | |
| 385 // Initialize with a persistent database (likely, ~/.pki/nssdb). | |
| 386 // Use "sql:" which can be shared by multiple processes safely. | |
| 387 std::string nss_config_dir = | |
| 388 StringPrintf("sql:%s", database_dir.value().c_str()); | |
| 389 #if defined(OS_CHROMEOS) | |
| 390 status = NSS_Init(nss_config_dir.c_str()); | |
| 391 #else | |
| 392 status = NSS_InitReadWrite(nss_config_dir.c_str()); | |
| 393 #endif | |
| 394 if (status != SECSuccess) { | |
| 395 LOG(ERROR) << "Error initializing NSS with a persistent " | |
| 396 "database (" << nss_config_dir | |
| 397 << "): " << GetNSSErrorMessage(); | |
| 398 } | |
| 399 } | |
| 400 if (status != SECSuccess) { | |
| 401 VLOG(1) << "Initializing NSS without a persistent database."; | |
| 402 status = NSS_NoDB_Init(NULL); | |
| 403 if (status != SECSuccess) { | |
| 404 LOG(ERROR) << "Error initializing NSS without a persistent " | |
| 405 "database: " << GetNSSErrorMessage(); | |
| 406 return; | |
| 407 } | |
| 408 } | |
| 409 | |
| 410 PK11_SetPasswordFunc(PKCS11PasswordFunc); | |
| 411 | |
| 412 // If we haven't initialized the password for the NSS databases, | |
| 413 // initialize an empty-string password so that we don't need to | |
| 414 // log in. | |
| 415 PK11SlotInfo* slot = PK11_GetInternalKeySlot(); | |
| 416 if (slot) { | |
| 417 // PK11_InitPin may write to the keyDB, but no other thread can use NSS | |
| 418 // yet, so we don't need to lock. | |
| 419 if (PK11_NeedUserInit(slot)) | |
| 420 PK11_InitPin(slot, NULL, NULL); | |
| 421 PK11_FreeSlot(slot); | |
| 422 } | |
| 423 | |
| 424 root_ = InitDefaultRootCerts(); | |
| 425 #endif // defined(USE_NSS) | |
| 426 } | |
| 427 } | |
| 428 | |
| 429 // NOTE(willchan): We don't actually execute this code since we leak NSS to | |
| 430 // prevent non-joinable threads from using NSS after it's already been shut | |
| 431 // down. | |
| 432 ~NSSInitSingleton() { | |
| 433 if (tpm_slot_) { | |
| 434 PK11_FreeSlot(tpm_slot_); | |
| 435 tpm_slot_ = NULL; | |
| 436 } | |
| 437 if (software_slot_) { | |
| 438 SECMOD_CloseUserDB(software_slot_); | |
| 439 PK11_FreeSlot(software_slot_); | |
| 440 software_slot_ = NULL; | |
| 441 } | |
| 442 CloseTestNSSDB(); | |
| 443 if (root_) { | |
| 444 SECMOD_UnloadUserModule(root_); | |
| 445 SECMOD_DestroyModule(root_); | |
| 446 root_ = NULL; | |
| 447 } | |
| 448 if (opencryptoki_module_) { | |
| 449 SECMOD_UnloadUserModule(opencryptoki_module_); | |
| 450 SECMOD_DestroyModule(opencryptoki_module_); | |
| 451 opencryptoki_module_ = NULL; | |
| 452 } | |
| 453 | |
| 454 SECStatus status = NSS_Shutdown(); | |
| 455 if (status != SECSuccess) { | |
| 456 // We VLOG(1) because this failure is relatively harmless (leaking, but | |
| 457 // we're shutting down anyway). | |
| 458 VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609"; | |
| 459 } | |
| 460 } | |
| 461 | |
| 462 #if defined(USE_NSS) | |
| 463 // Load nss's built-in root certs. | |
| 464 SECMODModule* InitDefaultRootCerts() { | |
| 465 SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL); | |
| 466 if (root) | |
| 467 return root; | |
| 468 | |
| 469 // Aw, snap. Can't find/load root cert shared library. | |
| 470 // This will make it hard to talk to anybody via https. | |
| 471 NOTREACHED(); | |
| 472 return NULL; | |
| 473 } | |
| 474 | |
| 475 // Load the given module for this NSS session. | |
| 476 SECMODModule* LoadModule(const char* name, | |
| 477 const char* library_path, | |
| 478 const char* params) { | |
| 479 std::string modparams = StringPrintf( | |
| 480 "name=\"%s\" library=\"%s\" %s", | |
| 481 name, library_path, params ? params : ""); | |
| 482 | |
| 483 // Shouldn't need to const_cast here, but SECMOD doesn't properly | |
| 484 // declare input string arguments as const. Bug | |
| 485 // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed | |
| 486 // on NSS codebase to address this. | |
| 487 SECMODModule* module = SECMOD_LoadUserModule( | |
| 488 const_cast<char*>(modparams.c_str()), NULL, PR_FALSE); | |
| 489 if (!module) { | |
| 490 LOG(ERROR) << "Error loading " << name << " module into NSS: " | |
| 491 << GetNSSErrorMessage(); | |
| 492 return NULL; | |
| 493 } | |
| 494 return module; | |
| 495 } | |
| 496 #endif | |
| 497 | |
| 498 #if defined(OS_CHROMEOS) | |
| 499 void EnsureTPMInit() { | |
| 500 base::ScopedPK11Slot tpm_slot(GetTPMSlot()); | |
| 501 if (tpm_slot.get()) { | |
| 502 // TODO(gspencer): Remove this in favor of the dbus API for | |
| 503 // cryptohomed when that is available. | |
| 504 if (PK11_NeedUserInit(tpm_slot.get())) { | |
| 505 PK11_InitPin(tpm_slot.get(), | |
| 506 kTPMSecurityOfficerPIN, | |
| 507 kTPMUserPIN); | |
| 508 } | |
| 509 } | |
| 510 } | |
| 511 #endif | |
| 512 | |
| 513 static PK11SlotInfo* OpenUserDB(const FilePath& path, | |
| 514 const char* description) { | |
| 515 const std::string modspec = | |
| 516 StringPrintf("configDir='sql:%s' tokenDescription='%s'", | |
| 517 path.value().c_str(), description); | |
| 518 PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str()); | |
| 519 if (db_slot) { | |
| 520 if (PK11_NeedUserInit(db_slot)) | |
| 521 PK11_InitPin(db_slot, NULL, NULL); | |
| 522 } | |
| 523 else { | |
| 524 LOG(ERROR) << "Error opening persistent database (" << modspec | |
| 525 << "): " << GetNSSErrorMessage(); | |
| 526 } | |
| 527 return db_slot; | |
| 528 } | |
| 529 | |
| 530 // If this is set to true NSS is forced to be initialized without a DB. | |
| 531 static bool force_nodb_init_; | |
| 532 | |
| 533 SECMODModule* opencryptoki_module_; | |
| 534 PK11SlotInfo* software_slot_; | |
| 535 PK11SlotInfo* test_slot_; | |
| 536 PK11SlotInfo* tpm_slot_; | |
| 537 SECMODModule* root_; | |
| 538 bool chromeos_user_logged_in_; | |
| 539 #if defined(USE_NSS) | |
| 540 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 | |
| 541 // is fixed, we will no longer need the lock. | |
| 542 Lock write_lock_; | |
| 543 #endif // defined(USE_NSS) | |
| 544 }; | |
| 545 | |
| 546 // static | |
| 547 bool NSSInitSingleton::force_nodb_init_ = false; | |
| 548 | |
| 549 LazyInstance<NSSInitSingleton, LeakyLazyInstanceTraits<NSSInitSingleton> > | |
| 550 g_nss_singleton(LINKER_INITIALIZED); | |
| 551 | |
| 552 } // namespace | |
| 553 | |
| 554 #if defined(USE_NSS) | |
| 555 void EarlySetupForNSSInit() { | |
| 556 FilePath database_dir = GetInitialConfigDirectory(); | |
| 557 if (!database_dir.empty()) | |
| 558 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); | |
| 559 } | |
| 560 #endif | |
| 561 | |
| 562 void EnsureNSPRInit() { | |
| 563 g_nspr_singleton.Get(); | |
| 564 } | |
| 565 | |
| 566 void EnsureNSSInit() { | |
| 567 // Initializing SSL causes us to do blocking IO. | |
| 568 // Temporarily allow it until we fix | |
| 569 // http://code.google.com/p/chromium/issues/detail?id=59847 | |
| 570 ThreadRestrictions::ScopedAllowIO allow_io; | |
| 571 g_nss_singleton.Get(); | |
| 572 } | |
| 573 | |
| 574 void ForceNSSNoDBInit() { | |
| 575 NSSInitSingleton::ForceNoDBInit(); | |
| 576 } | |
| 577 | |
| 578 void DisableNSSForkCheck() { | |
| 579 scoped_ptr<Environment> env(Environment::Create()); | |
| 580 env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); | |
| 581 } | |
| 582 | |
| 583 void LoadNSSLibraries() { | |
| 584 // Some NSS libraries are linked dynamically so load them here. | |
| 585 #if defined(USE_NSS) | |
| 586 // Try to search for multiple directories to load the libraries. | |
| 587 std::vector<FilePath> paths; | |
| 588 | |
| 589 // Use relative path to Search PATH for the library files. | |
| 590 paths.push_back(FilePath()); | |
| 591 | |
| 592 // For Debian derivaties NSS libraries are located here. | |
| 593 paths.push_back(FilePath("/usr/lib/nss")); | |
| 594 | |
| 595 // For other distros use this path. | |
| 596 paths.push_back(FilePath("/usr/lib")); | |
| 597 | |
| 598 // A list of library files to load. | |
| 599 std::vector<std::string> libs; | |
| 600 libs.push_back("libsoftokn3.so"); | |
| 601 libs.push_back("libfreebl3.so"); | |
| 602 | |
| 603 // For each combination of library file and path, check for existence and | |
| 604 // then load. | |
| 605 size_t loaded = 0; | |
| 606 for (size_t i = 0; i < libs.size(); ++i) { | |
| 607 for (size_t j = 0; j < paths.size(); ++j) { | |
| 608 FilePath path = paths[j].Append(libs[i]); | |
| 609 if (file_util::PathExists(path)) { | |
| 610 NativeLibrary lib = base::LoadNativeLibrary(path); | |
| 611 if (lib) { | |
| 612 ++loaded; | |
| 613 break; | |
| 614 } | |
| 615 } | |
| 616 } | |
| 617 } | |
| 618 | |
| 619 if (loaded == libs.size()) { | |
| 620 VLOG(3) << "NSS libraries loaded."; | |
| 621 } else { | |
| 622 LOG(WARNING) << "Failed to load NSS libraries."; | |
| 623 } | |
| 624 #endif | |
| 625 } | |
| 626 | |
| 627 bool CheckNSSVersion(const char* version) { | |
| 628 return !!NSS_VersionCheck(version); | |
| 629 } | |
| 630 | |
| 631 #if defined(USE_NSS) | |
| 632 bool OpenTestNSSDB(const FilePath& path, const char* description) { | |
| 633 return g_nss_singleton.Get().OpenTestNSSDB(path, description); | |
| 634 } | |
| 635 | |
| 636 void CloseTestNSSDB() { | |
| 637 g_nss_singleton.Get().CloseTestNSSDB(); | |
| 638 } | |
| 639 | |
| 640 Lock* GetNSSWriteLock() { | |
| 641 return g_nss_singleton.Get().write_lock(); | |
| 642 } | |
| 643 | |
| 644 AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) { | |
| 645 // May be NULL if the lock is not needed in our version of NSS. | |
| 646 if (lock_) | |
| 647 lock_->Acquire(); | |
| 648 } | |
| 649 | |
| 650 AutoNSSWriteLock::~AutoNSSWriteLock() { | |
| 651 if (lock_) { | |
| 652 lock_->AssertAcquired(); | |
| 653 lock_->Release(); | |
| 654 } | |
| 655 } | |
| 656 #endif // defined(USE_NSS) | |
| 657 | |
| 658 #if defined(OS_CHROMEOS) | |
| 659 void OpenPersistentNSSDB() { | |
| 660 g_nss_singleton.Get().OpenPersistentNSSDB(); | |
| 661 } | |
| 662 | |
| 663 bool EnableTPMForNSS() { | |
| 664 return g_nss_singleton.Get().EnableTPMForNSS(); | |
| 665 } | |
| 666 | |
| 667 std::string GetTPMTokenName() { | |
| 668 return g_nss_singleton.Get().GetTPMTokenName(); | |
| 669 } | |
| 670 #endif // defined(OS_CHROMEOS) | |
| 671 | |
| 672 // TODO(port): Implement this more simply. We can convert by subtracting an | |
| 673 // offset (the difference between NSPR's and base::Time's epochs). | |
| 674 Time PRTimeToBaseTime(PRTime prtime) { | |
| 675 PRExplodedTime prxtime; | |
| 676 PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime); | |
| 677 | |
| 678 Time::Exploded exploded; | |
| 679 exploded.year = prxtime.tm_year; | |
| 680 exploded.month = prxtime.tm_month + 1; | |
| 681 exploded.day_of_week = prxtime.tm_wday; | |
| 682 exploded.day_of_month = prxtime.tm_mday; | |
| 683 exploded.hour = prxtime.tm_hour; | |
| 684 exploded.minute = prxtime.tm_min; | |
| 685 exploded.second = prxtime.tm_sec; | |
| 686 exploded.millisecond = prxtime.tm_usec / 1000; | |
| 687 | |
| 688 return Time::FromUTCExploded(exploded); | |
| 689 } | |
| 690 | |
| 691 PK11SlotInfo* GetPublicNSSKeySlot() { | |
| 692 return g_nss_singleton.Get().GetPublicNSSKeySlot(); | |
| 693 } | |
| 694 | |
| 695 PK11SlotInfo* GetPrivateNSSKeySlot() { | |
| 696 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); | |
| 697 } | |
| 698 | |
| 699 } // namespace base | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 6805019:
Move crypto files out of base, to a top level directory. (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src/