OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/nss_util.h" | 5 #include "crypto/nss_util.h" |
6 #include "base/nss_util_internal.h" | 6 #include "crypto/nss_util_internal.h" |
7 | 7 |
8 #include <nss.h> | 8 #include <nss.h> |
9 #include <plarena.h> | 9 #include <plarena.h> |
10 #include <prerror.h> | 10 #include <prerror.h> |
11 #include <prinit.h> | 11 #include <prinit.h> |
12 #include <prtime.h> | 12 #include <prtime.h> |
13 #include <pk11pub.h> | 13 #include <pk11pub.h> |
14 #include <secmod.h> | 14 #include <secmod.h> |
15 | 15 |
16 #if defined(OS_LINUX) | 16 #if defined(OS_LINUX) |
17 #include <linux/nfs_fs.h> | 17 #include <linux/nfs_fs.h> |
18 #include <sys/vfs.h> | 18 #include <sys/vfs.h> |
19 #endif | 19 #endif |
20 | 20 |
21 #include <vector> | 21 #include <vector> |
22 | 22 |
23 #include "base/crypto/scoped_nss_types.h" | |
24 #include "base/environment.h" | 23 #include "base/environment.h" |
25 #include "base/file_path.h" | 24 #include "base/file_path.h" |
26 #include "base/file_util.h" | 25 #include "base/file_util.h" |
27 #include "base/lazy_instance.h" | 26 #include "base/lazy_instance.h" |
28 #include "base/logging.h" | 27 #include "base/logging.h" |
29 #include "base/memory/scoped_ptr.h" | 28 #include "base/memory/scoped_ptr.h" |
30 #include "base/native_library.h" | 29 #include "base/native_library.h" |
31 #include "base/stringprintf.h" | 30 #include "base/stringprintf.h" |
32 #include "base/threading/thread_restrictions.h" | 31 #include "base/threading/thread_restrictions.h" |
| 32 #include "crypto/scoped_nss_types.h" |
33 | 33 |
34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not | 34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not |
35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't | 35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't |
36 // use NSS for crypto or certificate verification, and we don't use the NSS | 36 // use NSS for crypto or certificate verification, and we don't use the NSS |
37 // certificate and key databases. | 37 // certificate and key databases. |
38 #if defined(USE_NSS) | 38 #if defined(USE_NSS) |
39 #include "base/crypto/crypto_module_blocking_password_delegate.h" | 39 #include "base/crypto/crypto_module_blocking_password_delegate.h" |
40 #include "base/synchronization/lock.h" | 40 #include "base/synchronization/lock.h" |
41 #endif // defined(USE_NSS) | 41 #endif // defined(USE_NSS) |
42 | 42 |
43 namespace base { | 43 namespace crypto { |
44 | 44 |
45 namespace { | 45 namespace { |
46 | 46 |
47 #if defined(OS_CHROMEOS) | 47 #if defined(OS_CHROMEOS) |
48 const char kNSSDatabaseName[] = "Real NSS database"; | 48 const char kNSSDatabaseName[] = "Real NSS database"; |
49 | 49 |
50 // Constants for loading opencryptoki. | 50 // Constants for loading opencryptoki. |
51 const char kOpencryptokiModuleName[] = "opencryptoki"; | 51 const char kOpencryptokiModuleName[] = "opencryptoki"; |
52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so"; | 52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so"; |
53 | 53 |
(...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
189 } | 189 } |
190 | 190 |
191 #endif // defined(USE_NSS) | 191 #endif // defined(USE_NSS) |
192 | 192 |
193 // A singleton to initialize/deinitialize NSPR. | 193 // A singleton to initialize/deinitialize NSPR. |
194 // Separate from the NSS singleton because we initialize NSPR on the UI thread. | 194 // Separate from the NSS singleton because we initialize NSPR on the UI thread. |
195 // Now that we're leaking the singleton, we could merge back with the NSS | 195 // Now that we're leaking the singleton, we could merge back with the NSS |
196 // singleton. | 196 // singleton. |
197 class NSPRInitSingleton { | 197 class NSPRInitSingleton { |
198 private: | 198 private: |
199 friend struct DefaultLazyInstanceTraits<NSPRInitSingleton>; | 199 friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>; |
200 | 200 |
201 NSPRInitSingleton() { | 201 NSPRInitSingleton() { |
202 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); | 202 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); |
203 } | 203 } |
204 | 204 |
205 // NOTE(willchan): We don't actually execute this code since we leak NSS to | 205 // NOTE(willchan): We don't actually execute this code since we leak NSS to |
206 // prevent non-joinable threads from using NSS after it's already been shut | 206 // prevent non-joinable threads from using NSS after it's already been shut |
207 // down. | 207 // down. |
208 ~NSPRInitSingleton() { | 208 ~NSPRInitSingleton() { |
209 PL_ArenaFinish(); | 209 PL_ArenaFinish(); |
210 PRStatus prstatus = PR_Cleanup(); | 210 PRStatus prstatus = PR_Cleanup(); |
211 if (prstatus != PR_SUCCESS) { | 211 if (prstatus != PR_SUCCESS) { |
212 LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; | 212 LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; |
213 } | 213 } |
214 } | 214 } |
215 }; | 215 }; |
216 | 216 |
217 LazyInstance<NSPRInitSingleton, LeakyLazyInstanceTraits<NSPRInitSingleton> > | 217 base::LazyInstance<NSPRInitSingleton, |
218 g_nspr_singleton(LINKER_INITIALIZED); | 218 base::LeakyLazyInstanceTraits<NSPRInitSingleton> > |
| 219 g_nspr_singleton(base::LINKER_INITIALIZED); |
219 | 220 |
220 class NSSInitSingleton { | 221 class NSSInitSingleton { |
221 public: | 222 public: |
222 #if defined(OS_CHROMEOS) | 223 #if defined(OS_CHROMEOS) |
223 void OpenPersistentNSSDB() { | 224 void OpenPersistentNSSDB() { |
224 if (!chromeos_user_logged_in_) { | 225 if (!chromeos_user_logged_in_) { |
225 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. | 226 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. |
226 // Temporarily allow it until we fix http://crbug.com/70119 | 227 // Temporarily allow it until we fix http://crbug.com/70119 |
227 ThreadRestrictions::ScopedAllowIO allow_io; | 228 ThreadRestrictions::ScopedAllowIO allow_io; |
228 chromeos_user_logged_in_ = true; | 229 chromeos_user_logged_in_ = true; |
(...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
320 } | 321 } |
321 #endif // defined(USE_NSS) | 322 #endif // defined(USE_NSS) |
322 | 323 |
323 // This method is used to force NSS to be initialized without a DB. | 324 // This method is used to force NSS to be initialized without a DB. |
324 // Call this method before NSSInitSingleton() is constructed. | 325 // Call this method before NSSInitSingleton() is constructed. |
325 static void ForceNoDBInit() { | 326 static void ForceNoDBInit() { |
326 force_nodb_init_ = true; | 327 force_nodb_init_ = true; |
327 } | 328 } |
328 | 329 |
329 private: | 330 private: |
330 friend struct DefaultLazyInstanceTraits<NSSInitSingleton>; | 331 friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>; |
331 | 332 |
332 NSSInitSingleton() | 333 NSSInitSingleton() |
333 : opencryptoki_module_(NULL), | 334 : opencryptoki_module_(NULL), |
334 software_slot_(NULL), | 335 software_slot_(NULL), |
335 test_slot_(NULL), | 336 test_slot_(NULL), |
336 tpm_slot_(NULL), | 337 tpm_slot_(NULL), |
337 root_(NULL), | 338 root_(NULL), |
338 chromeos_user_logged_in_(false) { | 339 chromeos_user_logged_in_(false) { |
339 EnsureNSPRInit(); | 340 EnsureNSPRInit(); |
340 | 341 |
(...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
539 #if defined(USE_NSS) | 540 #if defined(USE_NSS) |
540 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 | 541 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 |
541 // is fixed, we will no longer need the lock. | 542 // is fixed, we will no longer need the lock. |
542 Lock write_lock_; | 543 Lock write_lock_; |
543 #endif // defined(USE_NSS) | 544 #endif // defined(USE_NSS) |
544 }; | 545 }; |
545 | 546 |
546 // static | 547 // static |
547 bool NSSInitSingleton::force_nodb_init_ = false; | 548 bool NSSInitSingleton::force_nodb_init_ = false; |
548 | 549 |
549 LazyInstance<NSSInitSingleton, LeakyLazyInstanceTraits<NSSInitSingleton> > | 550 base::LazyInstance<NSSInitSingleton, |
550 g_nss_singleton(LINKER_INITIALIZED); | 551 base::LeakyLazyInstanceTraits<NSSInitSingleton> > |
| 552 g_nss_singleton(base::LINKER_INITIALIZED); |
551 | 553 |
552 } // namespace | 554 } // namespace |
553 | 555 |
554 #if defined(USE_NSS) | 556 #if defined(USE_NSS) |
555 void EarlySetupForNSSInit() { | 557 void EarlySetupForNSSInit() { |
556 FilePath database_dir = GetInitialConfigDirectory(); | 558 FilePath database_dir = GetInitialConfigDirectory(); |
557 if (!database_dir.empty()) | 559 if (!database_dir.empty()) |
558 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); | 560 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); |
559 } | 561 } |
560 #endif | 562 #endif |
561 | 563 |
562 void EnsureNSPRInit() { | 564 void EnsureNSPRInit() { |
563 g_nspr_singleton.Get(); | 565 g_nspr_singleton.Get(); |
564 } | 566 } |
565 | 567 |
566 void EnsureNSSInit() { | 568 void EnsureNSSInit() { |
567 // Initializing SSL causes us to do blocking IO. | 569 // Initializing SSL causes us to do blocking IO. |
568 // Temporarily allow it until we fix | 570 // Temporarily allow it until we fix |
569 // http://code.google.com/p/chromium/issues/detail?id=59847 | 571 // http://code.google.com/p/chromium/issues/detail?id=59847 |
570 ThreadRestrictions::ScopedAllowIO allow_io; | 572 base::ThreadRestrictions::ScopedAllowIO allow_io; |
571 g_nss_singleton.Get(); | 573 g_nss_singleton.Get(); |
572 } | 574 } |
573 | 575 |
574 void ForceNSSNoDBInit() { | 576 void ForceNSSNoDBInit() { |
575 NSSInitSingleton::ForceNoDBInit(); | 577 NSSInitSingleton::ForceNoDBInit(); |
576 } | 578 } |
577 | 579 |
578 void DisableNSSForkCheck() { | 580 void DisableNSSForkCheck() { |
579 scoped_ptr<Environment> env(Environment::Create()); | 581 scoped_ptr<base::Environment> env(base::Environment::Create()); |
580 env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); | 582 env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); |
581 } | 583 } |
582 | 584 |
583 void LoadNSSLibraries() { | 585 void LoadNSSLibraries() { |
584 // Some NSS libraries are linked dynamically so load them here. | 586 // Some NSS libraries are linked dynamically so load them here. |
585 #if defined(USE_NSS) | 587 #if defined(USE_NSS) |
586 // Try to search for multiple directories to load the libraries. | 588 // Try to search for multiple directories to load the libraries. |
587 std::vector<FilePath> paths; | 589 std::vector<FilePath> paths; |
588 | 590 |
589 // Use relative path to Search PATH for the library files. | 591 // Use relative path to Search PATH for the library files. |
(...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
664 return g_nss_singleton.Get().EnableTPMForNSS(); | 666 return g_nss_singleton.Get().EnableTPMForNSS(); |
665 } | 667 } |
666 | 668 |
667 std::string GetTPMTokenName() { | 669 std::string GetTPMTokenName() { |
668 return g_nss_singleton.Get().GetTPMTokenName(); | 670 return g_nss_singleton.Get().GetTPMTokenName(); |
669 } | 671 } |
670 #endif // defined(OS_CHROMEOS) | 672 #endif // defined(OS_CHROMEOS) |
671 | 673 |
672 // TODO(port): Implement this more simply. We can convert by subtracting an | 674 // TODO(port): Implement this more simply. We can convert by subtracting an |
673 // offset (the difference between NSPR's and base::Time's epochs). | 675 // offset (the difference between NSPR's and base::Time's epochs). |
674 Time PRTimeToBaseTime(PRTime prtime) { | 676 base::Time PRTimeToBaseTime(PRTime prtime) { |
675 PRExplodedTime prxtime; | 677 PRExplodedTime prxtime; |
676 PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime); | 678 PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime); |
677 | 679 |
678 Time::Exploded exploded; | 680 base::Time::Exploded exploded; |
679 exploded.year = prxtime.tm_year; | 681 exploded.year = prxtime.tm_year; |
680 exploded.month = prxtime.tm_month + 1; | 682 exploded.month = prxtime.tm_month + 1; |
681 exploded.day_of_week = prxtime.tm_wday; | 683 exploded.day_of_week = prxtime.tm_wday; |
682 exploded.day_of_month = prxtime.tm_mday; | 684 exploded.day_of_month = prxtime.tm_mday; |
683 exploded.hour = prxtime.tm_hour; | 685 exploded.hour = prxtime.tm_hour; |
684 exploded.minute = prxtime.tm_min; | 686 exploded.minute = prxtime.tm_min; |
685 exploded.second = prxtime.tm_sec; | 687 exploded.second = prxtime.tm_sec; |
686 exploded.millisecond = prxtime.tm_usec / 1000; | 688 exploded.millisecond = prxtime.tm_usec / 1000; |
687 | 689 |
688 return Time::FromUTCExploded(exploded); | 690 return base::Time::FromUTCExploded(exploded); |
689 } | 691 } |
690 | 692 |
691 PK11SlotInfo* GetPublicNSSKeySlot() { | 693 PK11SlotInfo* GetPublicNSSKeySlot() { |
692 return g_nss_singleton.Get().GetPublicNSSKeySlot(); | 694 return g_nss_singleton.Get().GetPublicNSSKeySlot(); |
693 } | 695 } |
694 | 696 |
695 PK11SlotInfo* GetPrivateNSSKeySlot() { | 697 PK11SlotInfo* GetPrivateNSSKeySlot() { |
696 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); | 698 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); |
697 } | 699 } |
698 | 700 |
699 } // namespace base | 701 } // namespace crypto |
OLD | NEW |