| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "base/nss_util.h" | 5 #include "crypto/nss_util.h" |
| 6 #include "base/nss_util_internal.h" | 6 #include "crypto/nss_util_internal.h" |
| 7 | 7 |
| 8 #include <nss.h> | 8 #include <nss.h> |
| 9 #include <plarena.h> | 9 #include <plarena.h> |
| 10 #include <prerror.h> | 10 #include <prerror.h> |
| 11 #include <prinit.h> | 11 #include <prinit.h> |
| 12 #include <prtime.h> | 12 #include <prtime.h> |
| 13 #include <pk11pub.h> | 13 #include <pk11pub.h> |
| 14 #include <secmod.h> | 14 #include <secmod.h> |
| 15 | 15 |
| 16 #if defined(OS_LINUX) | 16 #if defined(OS_LINUX) |
| 17 #include <linux/nfs_fs.h> | 17 #include <linux/nfs_fs.h> |
| 18 #include <sys/vfs.h> | 18 #include <sys/vfs.h> |
| 19 #endif | 19 #endif |
| 20 | 20 |
| 21 #include <vector> | 21 #include <vector> |
| 22 | 22 |
| 23 #include "base/crypto/scoped_nss_types.h" | |
| 24 #include "base/environment.h" | 23 #include "base/environment.h" |
| 25 #include "base/file_path.h" | 24 #include "base/file_path.h" |
| 26 #include "base/file_util.h" | 25 #include "base/file_util.h" |
| 27 #include "base/lazy_instance.h" | 26 #include "base/lazy_instance.h" |
| 28 #include "base/logging.h" | 27 #include "base/logging.h" |
| 29 #include "base/memory/scoped_ptr.h" | 28 #include "base/memory/scoped_ptr.h" |
| 30 #include "base/native_library.h" | 29 #include "base/native_library.h" |
| 31 #include "base/stringprintf.h" | 30 #include "base/stringprintf.h" |
| 32 #include "base/threading/thread_restrictions.h" | 31 #include "base/threading/thread_restrictions.h" |
| 32 #include "crypto/scoped_nss_types.h" |
| 33 | 33 |
| 34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not | 34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not |
| 35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't | 35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't |
| 36 // use NSS for crypto or certificate verification, and we don't use the NSS | 36 // use NSS for crypto or certificate verification, and we don't use the NSS |
| 37 // certificate and key databases. | 37 // certificate and key databases. |
| 38 #if defined(USE_NSS) | 38 #if defined(USE_NSS) |
| 39 #include "base/crypto/crypto_module_blocking_password_delegate.h" | 39 #include "base/crypto/crypto_module_blocking_password_delegate.h" |
| 40 #include "base/synchronization/lock.h" | 40 #include "base/synchronization/lock.h" |
| 41 #endif // defined(USE_NSS) | 41 #endif // defined(USE_NSS) |
| 42 | 42 |
| 43 namespace base { | 43 namespace crypto { |
| 44 | 44 |
| 45 namespace { | 45 namespace { |
| 46 | 46 |
| 47 #if defined(OS_CHROMEOS) | 47 #if defined(OS_CHROMEOS) |
| 48 const char kNSSDatabaseName[] = "Real NSS database"; | 48 const char kNSSDatabaseName[] = "Real NSS database"; |
| 49 | 49 |
| 50 // Constants for loading opencryptoki. | 50 // Constants for loading opencryptoki. |
| 51 const char kOpencryptokiModuleName[] = "opencryptoki"; | 51 const char kOpencryptokiModuleName[] = "opencryptoki"; |
| 52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so"; | 52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so"; |
| 53 | 53 |
| (...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 189 } | 189 } |
| 190 | 190 |
| 191 #endif // defined(USE_NSS) | 191 #endif // defined(USE_NSS) |
| 192 | 192 |
| 193 // A singleton to initialize/deinitialize NSPR. | 193 // A singleton to initialize/deinitialize NSPR. |
| 194 // Separate from the NSS singleton because we initialize NSPR on the UI thread. | 194 // Separate from the NSS singleton because we initialize NSPR on the UI thread. |
| 195 // Now that we're leaking the singleton, we could merge back with the NSS | 195 // Now that we're leaking the singleton, we could merge back with the NSS |
| 196 // singleton. | 196 // singleton. |
| 197 class NSPRInitSingleton { | 197 class NSPRInitSingleton { |
| 198 private: | 198 private: |
| 199 friend struct DefaultLazyInstanceTraits<NSPRInitSingleton>; | 199 friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>; |
| 200 | 200 |
| 201 NSPRInitSingleton() { | 201 NSPRInitSingleton() { |
| 202 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); | 202 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); |
| 203 } | 203 } |
| 204 | 204 |
| 205 // NOTE(willchan): We don't actually execute this code since we leak NSS to | 205 // NOTE(willchan): We don't actually execute this code since we leak NSS to |
| 206 // prevent non-joinable threads from using NSS after it's already been shut | 206 // prevent non-joinable threads from using NSS after it's already been shut |
| 207 // down. | 207 // down. |
| 208 ~NSPRInitSingleton() { | 208 ~NSPRInitSingleton() { |
| 209 PL_ArenaFinish(); | 209 PL_ArenaFinish(); |
| 210 PRStatus prstatus = PR_Cleanup(); | 210 PRStatus prstatus = PR_Cleanup(); |
| 211 if (prstatus != PR_SUCCESS) { | 211 if (prstatus != PR_SUCCESS) { |
| 212 LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; | 212 LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?"; |
| 213 } | 213 } |
| 214 } | 214 } |
| 215 }; | 215 }; |
| 216 | 216 |
| 217 LazyInstance<NSPRInitSingleton, LeakyLazyInstanceTraits<NSPRInitSingleton> > | 217 base::LazyInstance<NSPRInitSingleton, |
| 218 g_nspr_singleton(LINKER_INITIALIZED); | 218 base::LeakyLazyInstanceTraits<NSPRInitSingleton> > |
| 219 g_nspr_singleton(base::LINKER_INITIALIZED); |
| 219 | 220 |
| 220 class NSSInitSingleton { | 221 class NSSInitSingleton { |
| 221 public: | 222 public: |
| 222 #if defined(OS_CHROMEOS) | 223 #if defined(OS_CHROMEOS) |
| 223 void OpenPersistentNSSDB() { | 224 void OpenPersistentNSSDB() { |
| 224 if (!chromeos_user_logged_in_) { | 225 if (!chromeos_user_logged_in_) { |
| 225 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. | 226 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread. |
| 226 // Temporarily allow it until we fix http://crbug.com/70119 | 227 // Temporarily allow it until we fix http://crbug.com/70119 |
| 227 ThreadRestrictions::ScopedAllowIO allow_io; | 228 ThreadRestrictions::ScopedAllowIO allow_io; |
| 228 chromeos_user_logged_in_ = true; | 229 chromeos_user_logged_in_ = true; |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 320 } | 321 } |
| 321 #endif // defined(USE_NSS) | 322 #endif // defined(USE_NSS) |
| 322 | 323 |
| 323 // This method is used to force NSS to be initialized without a DB. | 324 // This method is used to force NSS to be initialized without a DB. |
| 324 // Call this method before NSSInitSingleton() is constructed. | 325 // Call this method before NSSInitSingleton() is constructed. |
| 325 static void ForceNoDBInit() { | 326 static void ForceNoDBInit() { |
| 326 force_nodb_init_ = true; | 327 force_nodb_init_ = true; |
| 327 } | 328 } |
| 328 | 329 |
| 329 private: | 330 private: |
| 330 friend struct DefaultLazyInstanceTraits<NSSInitSingleton>; | 331 friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>; |
| 331 | 332 |
| 332 NSSInitSingleton() | 333 NSSInitSingleton() |
| 333 : opencryptoki_module_(NULL), | 334 : opencryptoki_module_(NULL), |
| 334 software_slot_(NULL), | 335 software_slot_(NULL), |
| 335 test_slot_(NULL), | 336 test_slot_(NULL), |
| 336 tpm_slot_(NULL), | 337 tpm_slot_(NULL), |
| 337 root_(NULL), | 338 root_(NULL), |
| 338 chromeos_user_logged_in_(false) { | 339 chromeos_user_logged_in_(false) { |
| 339 EnsureNSPRInit(); | 340 EnsureNSPRInit(); |
| 340 | 341 |
| (...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 539 #if defined(USE_NSS) | 540 #if defined(USE_NSS) |
| 540 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 | 541 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 |
| 541 // is fixed, we will no longer need the lock. | 542 // is fixed, we will no longer need the lock. |
| 542 Lock write_lock_; | 543 Lock write_lock_; |
| 543 #endif // defined(USE_NSS) | 544 #endif // defined(USE_NSS) |
| 544 }; | 545 }; |
| 545 | 546 |
| 546 // static | 547 // static |
| 547 bool NSSInitSingleton::force_nodb_init_ = false; | 548 bool NSSInitSingleton::force_nodb_init_ = false; |
| 548 | 549 |
| 549 LazyInstance<NSSInitSingleton, LeakyLazyInstanceTraits<NSSInitSingleton> > | 550 base::LazyInstance<NSSInitSingleton, |
| 550 g_nss_singleton(LINKER_INITIALIZED); | 551 base::LeakyLazyInstanceTraits<NSSInitSingleton> > |
| 552 g_nss_singleton(base::LINKER_INITIALIZED); |
| 551 | 553 |
| 552 } // namespace | 554 } // namespace |
| 553 | 555 |
| 554 #if defined(USE_NSS) | 556 #if defined(USE_NSS) |
| 555 void EarlySetupForNSSInit() { | 557 void EarlySetupForNSSInit() { |
| 556 FilePath database_dir = GetInitialConfigDirectory(); | 558 FilePath database_dir = GetInitialConfigDirectory(); |
| 557 if (!database_dir.empty()) | 559 if (!database_dir.empty()) |
| 558 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); | 560 UseLocalCacheOfNSSDatabaseIfNFS(database_dir); |
| 559 } | 561 } |
| 560 #endif | 562 #endif |
| 561 | 563 |
| 562 void EnsureNSPRInit() { | 564 void EnsureNSPRInit() { |
| 563 g_nspr_singleton.Get(); | 565 g_nspr_singleton.Get(); |
| 564 } | 566 } |
| 565 | 567 |
| 566 void EnsureNSSInit() { | 568 void EnsureNSSInit() { |
| 567 // Initializing SSL causes us to do blocking IO. | 569 // Initializing SSL causes us to do blocking IO. |
| 568 // Temporarily allow it until we fix | 570 // Temporarily allow it until we fix |
| 569 // http://code.google.com/p/chromium/issues/detail?id=59847 | 571 // http://code.google.com/p/chromium/issues/detail?id=59847 |
| 570 ThreadRestrictions::ScopedAllowIO allow_io; | 572 base::ThreadRestrictions::ScopedAllowIO allow_io; |
| 571 g_nss_singleton.Get(); | 573 g_nss_singleton.Get(); |
| 572 } | 574 } |
| 573 | 575 |
| 574 void ForceNSSNoDBInit() { | 576 void ForceNSSNoDBInit() { |
| 575 NSSInitSingleton::ForceNoDBInit(); | 577 NSSInitSingleton::ForceNoDBInit(); |
| 576 } | 578 } |
| 577 | 579 |
| 578 void DisableNSSForkCheck() { | 580 void DisableNSSForkCheck() { |
| 579 scoped_ptr<Environment> env(Environment::Create()); | 581 scoped_ptr<base::Environment> env(base::Environment::Create()); |
| 580 env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); | 582 env->SetVar("NSS_STRICT_NOFORK", "DISABLED"); |
| 581 } | 583 } |
| 582 | 584 |
| 583 void LoadNSSLibraries() { | 585 void LoadNSSLibraries() { |
| 584 // Some NSS libraries are linked dynamically so load them here. | 586 // Some NSS libraries are linked dynamically so load them here. |
| 585 #if defined(USE_NSS) | 587 #if defined(USE_NSS) |
| 586 // Try to search for multiple directories to load the libraries. | 588 // Try to search for multiple directories to load the libraries. |
| 587 std::vector<FilePath> paths; | 589 std::vector<FilePath> paths; |
| 588 | 590 |
| 589 // Use relative path to Search PATH for the library files. | 591 // Use relative path to Search PATH for the library files. |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 664 return g_nss_singleton.Get().EnableTPMForNSS(); | 666 return g_nss_singleton.Get().EnableTPMForNSS(); |
| 665 } | 667 } |
| 666 | 668 |
| 667 std::string GetTPMTokenName() { | 669 std::string GetTPMTokenName() { |
| 668 return g_nss_singleton.Get().GetTPMTokenName(); | 670 return g_nss_singleton.Get().GetTPMTokenName(); |
| 669 } | 671 } |
| 670 #endif // defined(OS_CHROMEOS) | 672 #endif // defined(OS_CHROMEOS) |
| 671 | 673 |
| 672 // TODO(port): Implement this more simply. We can convert by subtracting an | 674 // TODO(port): Implement this more simply. We can convert by subtracting an |
| 673 // offset (the difference between NSPR's and base::Time's epochs). | 675 // offset (the difference between NSPR's and base::Time's epochs). |
| 674 Time PRTimeToBaseTime(PRTime prtime) { | 676 base::Time PRTimeToBaseTime(PRTime prtime) { |
| 675 PRExplodedTime prxtime; | 677 PRExplodedTime prxtime; |
| 676 PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime); | 678 PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime); |
| 677 | 679 |
| 678 Time::Exploded exploded; | 680 base::Time::Exploded exploded; |
| 679 exploded.year = prxtime.tm_year; | 681 exploded.year = prxtime.tm_year; |
| 680 exploded.month = prxtime.tm_month + 1; | 682 exploded.month = prxtime.tm_month + 1; |
| 681 exploded.day_of_week = prxtime.tm_wday; | 683 exploded.day_of_week = prxtime.tm_wday; |
| 682 exploded.day_of_month = prxtime.tm_mday; | 684 exploded.day_of_month = prxtime.tm_mday; |
| 683 exploded.hour = prxtime.tm_hour; | 685 exploded.hour = prxtime.tm_hour; |
| 684 exploded.minute = prxtime.tm_min; | 686 exploded.minute = prxtime.tm_min; |
| 685 exploded.second = prxtime.tm_sec; | 687 exploded.second = prxtime.tm_sec; |
| 686 exploded.millisecond = prxtime.tm_usec / 1000; | 688 exploded.millisecond = prxtime.tm_usec / 1000; |
| 687 | 689 |
| 688 return Time::FromUTCExploded(exploded); | 690 return base::Time::FromUTCExploded(exploded); |
| 689 } | 691 } |
| 690 | 692 |
| 691 PK11SlotInfo* GetPublicNSSKeySlot() { | 693 PK11SlotInfo* GetPublicNSSKeySlot() { |
| 692 return g_nss_singleton.Get().GetPublicNSSKeySlot(); | 694 return g_nss_singleton.Get().GetPublicNSSKeySlot(); |
| 693 } | 695 } |
| 694 | 696 |
| 695 PK11SlotInfo* GetPrivateNSSKeySlot() { | 697 PK11SlotInfo* GetPrivateNSSKeySlot() { |
| 696 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); | 698 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); |
| 697 } | 699 } |
| 698 | 700 |
| 699 } // namespace base | 701 } // namespace crypto |
| OLD | NEW |