Move crypto files out of base, to a top level directory.

base/nss_util.cc

Index: base/nss_util.cc
===================================================================
--- base/nss_util.cc	(revision 80572)
+++ base/nss_util.cc	(working copy)
@@ -1,510 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/nss_util.h"
-#include "base/nss_util_internal.h"
-
-#include <nss.h>
-#include <plarena.h>
-#include <prerror.h>
-#include <prinit.h>
-#include <prtime.h>
-#include <pk11pub.h>
-#include <secmod.h>
-
-#if defined(OS_LINUX)
-#include <linux/nfs_fs.h>
-#include <sys/vfs.h>
-#endif
-
-#include <vector>
-
-#include "base/environment.h"
-#include "base/file_path.h"
-#include "base/file_util.h"
-#include "base/lazy_instance.h"
-#include "base/logging.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/native_library.h"
-#include "base/stringprintf.h"
-#include "base/threading/thread_restrictions.h"
-
-// USE_NSS means we use NSS for everything crypto-related.  If USE_NSS is not
-// defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
-// use NSS for crypto or certificate verification, and we don't use the NSS
-// certificate and key databases.
-#if defined(USE_NSS)
-#include "base/crypto/crypto_module_blocking_password_delegate.h"
-#include "base/synchronization/lock.h"
-#endif  // defined(USE_NSS)
-
-namespace base {
-
-namespace {
-
-#if defined(USE_NSS)
-FilePath GetDefaultConfigDirectory() {
-  FilePath dir = file_util::GetHomeDir();
-  if (dir.empty()) {
-    LOG(ERROR) << "Failed to get home directory.";
-    return dir;
-  }
-  dir = dir.AppendASCII(".pki").AppendASCII("nssdb");
-  if (!file_util::CreateDirectory(dir)) {
-    LOG(ERROR) << "Failed to create ~/.pki/nssdb directory.";
-    dir.clear();
-  }
-  return dir;
-}
-
-// On non-chromeos platforms, return the default config directory.
-// On chromeos, return a read-only directory with fake root CA certs for testing
-// (which will not exist on non-testing images).  These root CA certs are used
-// by the local Google Accounts server mock we use when testing our login code.
-// If this directory is not present, NSS_Init() will fail.  It is up to the
-// caller to failover to NSS_NoDB_Init() at that point.
-FilePath GetInitialConfigDirectory() {
-#if defined(OS_CHROMEOS)
-  static const FilePath::CharType kReadOnlyCertDB[] =
-      FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb");
-  return FilePath(kReadOnlyCertDB);
-#else
-  return GetDefaultConfigDirectory();
-#endif  // defined(OS_CHROMEOS)
-}
-
-// This callback for NSS forwards all requests to a caller-specified
-// CryptoModuleBlockingPasswordDelegate object.
-char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) {
-  base::CryptoModuleBlockingPasswordDelegate* delegate =
-      reinterpret_cast<base::CryptoModuleBlockingPasswordDelegate*>(arg);
-  if (delegate) {
-    bool cancelled = false;
-    std::string password = delegate->RequestPassword(PK11_GetTokenName(slot),
-                                                     retry != PR_FALSE,
-                                                     &cancelled);
-    if (cancelled)
-      return NULL;
-    char* result = PORT_Strdup(password.c_str());
-    password.replace(0, password.size(), password.size(), 0);
-    return result;
-  }
-  DLOG(ERROR) << "PK11 password requested with NULL arg";
-  return NULL;
-}
-
-// NSS creates a local cache of the sqlite database if it detects that the
-// filesystem the database is on is much slower than the local disk.  The
-// detection doesn't work with the latest versions of sqlite, such as 3.6.22
-// (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561).  So we set
-// the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's
-// detection when database_dir is on NFS.  See http://crbug.com/48585.
-//
-// TODO(wtc): port this function to other USE_NSS platforms.  It is defined
-// only for OS_LINUX simply because the statfs structure is OS-specific.
-//
-// Because this function sets an environment variable it must be run before we
-// go multi-threaded.
-void UseLocalCacheOfNSSDatabaseIfNFS(const FilePath& database_dir) {
-#if defined(OS_LINUX)
-  struct statfs buf;
-  if (statfs(database_dir.value().c_str(), &buf) == 0) {
-    if (buf.f_type == NFS_SUPER_MAGIC) {
-      scoped_ptr<Environment> env(Environment::Create());
-      const char* use_cache_env_var = "NSS_SDB_USE_CACHE";
-      if (!env->HasVar(use_cache_env_var))
-        env->SetVar(use_cache_env_var, "yes");
-    }
-  }
-#endif  // defined(OS_LINUX)
-}
-
-// Load nss's built-in root certs.
-SECMODModule *InitDefaultRootCerts() {
-  const char* kModulePath = "libnssckbi.so";
-  char modparams[1024];
-  snprintf(modparams, sizeof(modparams),
-           "name=\"Root Certs\" library=\"%s\"", kModulePath);
-  SECMODModule *root = SECMOD_LoadUserModule(modparams, NULL, PR_FALSE);
-  if (root)
-    return root;
-
-  // Aw, snap.  Can't find/load root cert shared library.
-  // This will make it hard to talk to anybody via https.
-  NOTREACHED();
-  return NULL;
-}
-#endif  // defined(USE_NSS)
-
-// A singleton to initialize/deinitialize NSPR.
-// Separate from the NSS singleton because we initialize NSPR on the UI thread.
-// Now that we're leaking the singleton, we could merge back with the NSS
-// singleton.
-class NSPRInitSingleton {
- private:
-  friend struct DefaultLazyInstanceTraits<NSPRInitSingleton>;
-
-  NSPRInitSingleton() {
-    PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
-  }
-
-  // NOTE(willchan): We don't actually execute this code since we leak NSS to
-  // prevent non-joinable threads from using NSS after it's already been shut
-  // down.
-  ~NSPRInitSingleton() {
-    PL_ArenaFinish();
-    PRStatus prstatus = PR_Cleanup();
-    if (prstatus != PR_SUCCESS) {
-      LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
-    }
-  }
-};
-
-LazyInstance<NSPRInitSingleton, LeakyLazyInstanceTraits<NSPRInitSingleton> >
-    g_nspr_singleton(LINKER_INITIALIZED);
-
-class NSSInitSingleton {
- public:
-#if defined(OS_CHROMEOS)
-  void OpenPersistentNSSDB() {
-    if (!chromeos_user_logged_in_) {
-      // GetDefaultConfigDirectory causes us to do blocking IO on UI thread.
-      // Temporarily allow it until we fix http://crbug.com.70119
-      ThreadRestrictions::ScopedAllowIO allow_io;
-      chromeos_user_logged_in_ = true;
-      real_db_slot_ = OpenUserDB(GetDefaultConfigDirectory(),
-                                 "Real NSS database");
-    }
-  }
-#endif  // defined(OS_CHROMEOS)
-
-  bool OpenTestNSSDB(const FilePath& path, const char* description) {
-    test_db_slot_ = OpenUserDB(path, description);
-    return !!test_db_slot_;
-  }
-
-  void CloseTestNSSDB() {
-    if (test_db_slot_) {
-      SECStatus status = SECMOD_CloseUserDB(test_db_slot_);
-      if (status != SECSuccess)
-        LOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
-      PK11_FreeSlot(test_db_slot_);
-      test_db_slot_ = NULL;
-    }
-  }
-
-  PK11SlotInfo* GetDefaultKeySlot() {
-    if (test_db_slot_)
-      return PK11_ReferenceSlot(test_db_slot_);
-    if (real_db_slot_)
-      return PK11_ReferenceSlot(real_db_slot_);
-    return PK11_GetInternalKeySlot();
-  }
-
-#if defined(USE_NSS)
-  Lock* write_lock() {
-    return &write_lock_;
-  }
-#endif  // defined(USE_NSS)
-
-  // This method is used to force NSS to be initialized without a DB.
-  // Call this method before NSSInitSingleton() is constructed.
-  static void ForceNoDBInit() {
-    force_nodb_init_ = true;
-  }
-
- private:
-  friend struct DefaultLazyInstanceTraits<NSSInitSingleton>;
-
-  NSSInitSingleton()
-      : real_db_slot_(NULL),
-        test_db_slot_(NULL),
-        root_(NULL),
-        chromeos_user_logged_in_(false) {
-    EnsureNSPRInit();
-
-    // We *must* have NSS >= 3.12.3.  See bug 26448.
-    COMPILE_ASSERT(
-        (NSS_VMAJOR == 3 && NSS_VMINOR == 12 && NSS_VPATCH >= 3) ||
-        (NSS_VMAJOR == 3 && NSS_VMINOR > 12) ||
-        (NSS_VMAJOR > 3),
-        nss_version_check_failed);
-    // Also check the run-time NSS version.
-    // NSS_VersionCheck is a >= check, not strict equality.
-    if (!NSS_VersionCheck("3.12.3")) {
-      // It turns out many people have misconfigured NSS setups, where
-      // their run-time NSPR doesn't match the one their NSS was compiled
-      // against.  So rather than aborting, complain loudly.
-      LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed.  "
-                    "We depend on NSS >= 3.12.3, and this error is not fatal "
-                    "only because many people have busted NSS setups (for "
-                    "example, using the wrong version of NSPR). "
-                    "Please upgrade to the latest NSS and NSPR, and if you "
-                    "still get this error, contact your distribution "
-                    "maintainer.";
-    }
-
-    SECStatus status = SECFailure;
-    bool nodb_init = force_nodb_init_;
-
-#if !defined(USE_NSS)
-    // Use the system certificate store, so initialize NSS without database.
-    nodb_init = true;
-#endif
-
-    if (nodb_init) {
-      status = NSS_NoDB_Init(NULL);
-      if (status != SECSuccess) {
-        LOG(ERROR) << "Error initializing NSS without a persistent "
-            "database: NSS error code " << PR_GetError();
-      }
-    } else {
-#if defined(USE_NSS)
-      FilePath database_dir = GetInitialConfigDirectory();
-      if (!database_dir.empty()) {
-        // This duplicates the work which should have been done in
-        // EarlySetupForNSSInit. However, this function is idempotent so
-        // there's no harm done.
-        UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
-
-        // Initialize with a persistent database (likely, ~/.pki/nssdb).
-        // Use "sql:" which can be shared by multiple processes safely.
-        std::string nss_config_dir =
-            StringPrintf("sql:%s", database_dir.value().c_str());
-#if defined(OS_CHROMEOS)
-        status = NSS_Init(nss_config_dir.c_str());
-#else
-        status = NSS_InitReadWrite(nss_config_dir.c_str());
-#endif
-        if (status != SECSuccess) {
-          LOG(ERROR) << "Error initializing NSS with a persistent "
-                        "database (" << nss_config_dir
-                     << "): NSS error code " << PR_GetError();
-        }
-      }
-      if (status != SECSuccess) {
-        LOG(WARNING) << "Initialize NSS without a persistent database "
-                        "(~/.pki/nssdb).";
-        status = NSS_NoDB_Init(NULL);
-        if (status != SECSuccess) {
-          LOG(ERROR) << "Error initializing NSS without a persistent "
-              "database: NSS error code " << PR_GetError();
-          return;
-        }
-      }
-
-      PK11_SetPasswordFunc(PKCS11PasswordFunc);
-
-      // If we haven't initialized the password for the NSS databases,
-      // initialize an empty-string password so that we don't need to
-      // log in.
-      PK11SlotInfo* slot = PK11_GetInternalKeySlot();
-      if (slot) {
-        // PK11_InitPin may write to the keyDB, but no other thread can use NSS
-        // yet, so we don't need to lock.
-        if (PK11_NeedUserInit(slot))
-          PK11_InitPin(slot, NULL, NULL);
-        PK11_FreeSlot(slot);
-      }
-
-      root_ = InitDefaultRootCerts();
-#endif  // defined(USE_NSS)
-    }
-  }
-
-  // NOTE(willchan): We don't actually execute this code since we leak NSS to
-  // prevent non-joinable threads from using NSS after it's already been shut
-  // down.
-  ~NSSInitSingleton() {
-    if (real_db_slot_) {
-      SECMOD_CloseUserDB(real_db_slot_);
-      PK11_FreeSlot(real_db_slot_);
-      real_db_slot_ = NULL;
-    }
-    CloseTestNSSDB();
-    if (root_) {
-      SECMOD_UnloadUserModule(root_);
-      SECMOD_DestroyModule(root_);
-      root_ = NULL;
-    }
-
-    SECStatus status = NSS_Shutdown();
-    if (status != SECSuccess) {
-      // We VLOG(1) because this failure is relatively harmless (leaking, but
-      // we're shutting down anyway).
-      VLOG(1) << "NSS_Shutdown failed; see "
-                 "http://code.google.com/p/chromium/issues/detail?id=4609";
-    }
-  }
-
-  static PK11SlotInfo* OpenUserDB(const FilePath& path,
-                                  const char* description) {
-    const std::string modspec =
-        StringPrintf("configDir='sql:%s' tokenDescription='%s'",
-                     path.value().c_str(), description);
-    PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str());
-    if (db_slot) {
-      if (PK11_NeedUserInit(db_slot))
-        PK11_InitPin(db_slot, NULL, NULL);
-    }
-    else {
-      LOG(ERROR) << "Error opening persistent database (" << modspec
-                 << "): NSS error code " << PR_GetError();
-    }
-    return db_slot;
-  }
-
-  // If this is set to true NSS is forced to be initialized without a DB.
-  static bool force_nodb_init_;
-
-  PK11SlotInfo* real_db_slot_;  // Overrides internal key slot if non-NULL.
-  PK11SlotInfo* test_db_slot_;  // Overrides internal key slot and real_db_slot_
-  SECMODModule *root_;
-  bool chromeos_user_logged_in_;
-#if defined(USE_NSS)
-  // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
-  // is fixed, we will no longer need the lock.
-  Lock write_lock_;
-#endif  // defined(USE_NSS)
-};
-
-// static
-bool NSSInitSingleton::force_nodb_init_ = false;
-
-LazyInstance<NSSInitSingleton, LeakyLazyInstanceTraits<NSSInitSingleton> >
-    g_nss_singleton(LINKER_INITIALIZED);
-
-}  // namespace
-
-#if defined(USE_NSS)
-void EarlySetupForNSSInit() {
-  FilePath database_dir = GetInitialConfigDirectory();
-  if (!database_dir.empty())
-    UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
-}
-#endif
-
-void EnsureNSPRInit() {
-  g_nspr_singleton.Get();
-}
-
-void EnsureNSSInit() {
-  // Initializing SSL causes us to do blocking IO.
-  // Temporarily allow it until we fix
-  //   http://code.google.com/p/chromium/issues/detail?id=59847
-  ThreadRestrictions::ScopedAllowIO allow_io;
-  g_nss_singleton.Get();
-}
-
-void ForceNSSNoDBInit() {
-  NSSInitSingleton::ForceNoDBInit();
-}
-
-void DisableNSSForkCheck() {
-  scoped_ptr<Environment> env(Environment::Create());
-  env->SetVar("NSS_STRICT_NOFORK", "DISABLED");
-}
-
-void LoadNSSLibraries() {
-  // Some NSS libraries are linked dynamically so load them here.
-#if defined(USE_NSS)
-  // Try to search for multiple directories to load the libraries.
-  std::vector<FilePath> paths;
-
-  // Use relative path to Search PATH for the library files.
-  paths.push_back(FilePath());
-
-  // For Debian derivaties NSS libraries are located here.
-  paths.push_back(FilePath("/usr/lib/nss"));
-
-  // A list of library files to load.
-  std::vector<std::string> libs;
-  libs.push_back("libsoftokn3.so");
-  libs.push_back("libfreebl3.so");
-
-  // For each combination of library file and path, check for existence and
-  // then load.
-  size_t loaded = 0;
-  for (size_t i = 0; i < libs.size(); ++i) {
-    for (size_t j = 0; j < paths.size(); ++j) {
-      FilePath path = paths[j].Append(libs[i]);
-      if (file_util::PathExists(path)) {
-        NativeLibrary lib = base::LoadNativeLibrary(path);
-        if (lib) {
-          ++loaded;
-          break;
-        }
-      }
-    }
-  }
-
-  if (loaded == libs.size()) {
-    VLOG(3) << "NSS libraries loaded.";
-  } else {
-    LOG(WARNING) << "Failed to load NSS libraries.";
-  }
-#endif
-}
-
-bool CheckNSSVersion(const char* version) {
-  return !!NSS_VersionCheck(version);
-}
-
-#if defined(USE_NSS)
-bool OpenTestNSSDB(const FilePath& path, const char* description) {
-  return g_nss_singleton.Get().OpenTestNSSDB(path, description);
-}
-
-void CloseTestNSSDB() {
-  g_nss_singleton.Get().CloseTestNSSDB();
-}
-
-Lock* GetNSSWriteLock() {
-  return g_nss_singleton.Get().write_lock();
-}
-
-AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) {
-  // May be NULL if the lock is not needed in our version of NSS.
-  if (lock_)
-    lock_->Acquire();
-}
-
-AutoNSSWriteLock::~AutoNSSWriteLock() {
-  if (lock_) {
-    lock_->AssertAcquired();
-    lock_->Release();
-  }
-}
-#endif  // defined(USE_NSS)
-
-#if defined(OS_CHROMEOS)
-void OpenPersistentNSSDB() {
-  g_nss_singleton.Get().OpenPersistentNSSDB();
-}
-#endif
-
-// TODO(port): Implement this more simply.  We can convert by subtracting an
-// offset (the difference between NSPR's and base::Time's epochs).
-Time PRTimeToBaseTime(PRTime prtime) {
-  PRExplodedTime prxtime;
-  PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime);
-
-  Time::Exploded exploded;
-  exploded.year         = prxtime.tm_year;
-  exploded.month        = prxtime.tm_month + 1;
-  exploded.day_of_week  = prxtime.tm_wday;
-  exploded.day_of_month = prxtime.tm_mday;
-  exploded.hour         = prxtime.tm_hour;
-  exploded.minute       = prxtime.tm_min;
-  exploded.second       = prxtime.tm_sec;
-  exploded.millisecond  = prxtime.tm_usec / 1000;
-
-  return Time::FromUTCExploded(exploded);
-}
-
-PK11SlotInfo* GetDefaultNSSKeySlot() {
-  return g_nss_singleton.Get().GetDefaultKeySlot();
-}
-
-}  // namespace base