OLD | NEW |
| (Empty) |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CONTENT_CHILD_WEBCRYPTO_NSS_UTIL_NSS_H_ | |
6 #define CONTENT_CHILD_WEBCRYPTO_NSS_UTIL_NSS_H_ | |
7 | |
8 #include <keythi.h> | |
9 #include <pkcs11t.h> | |
10 #include <seccomon.h> | |
11 #include <secmodt.h> | |
12 | |
13 #include "base/lazy_instance.h" | |
14 | |
15 namespace content { | |
16 | |
17 namespace webcrypto { | |
18 | |
19 class CryptoData; | |
20 | |
21 SECItem MakeSECItemForBuffer(const CryptoData& buffer); | |
22 enum EncryptOrDecrypt { ENCRYPT, DECRYPT }; | |
23 | |
24 CryptoData SECItemToCryptoData(const SECItem& item); | |
25 | |
26 const CK_FLAGS kAllOperationFlags = | |
27 CKF_ENCRYPT | CKF_DECRYPT | CKF_SIGN | CKF_VERIFY | CKF_WRAP | CKF_UNWRAP; | |
28 | |
29 // Signature for PK11_Encrypt and PK11_Decrypt. | |
30 typedef SECStatus (*PK11_EncryptDecryptFunction)(PK11SymKey*, | |
31 CK_MECHANISM_TYPE, | |
32 SECItem*, | |
33 unsigned char*, | |
34 unsigned int*, | |
35 unsigned int, | |
36 const unsigned char*, | |
37 unsigned int); | |
38 | |
39 // Signature for PK11_PubEncrypt | |
40 typedef SECStatus (*PK11_PubEncryptFunction)(SECKEYPublicKey*, | |
41 CK_MECHANISM_TYPE, | |
42 SECItem*, | |
43 unsigned char*, | |
44 unsigned int*, | |
45 unsigned int, | |
46 const unsigned char*, | |
47 unsigned int, | |
48 void*); | |
49 | |
50 // Signature for PK11_PrivDecrypt | |
51 typedef SECStatus (*PK11_PrivDecryptFunction)(SECKEYPrivateKey*, | |
52 CK_MECHANISM_TYPE, | |
53 SECItem*, | |
54 unsigned char*, | |
55 unsigned int*, | |
56 unsigned int, | |
57 const unsigned char*, | |
58 unsigned int); | |
59 | |
60 // Singleton that detects whether or not AES-GCM and | |
61 // RSA-OAEP are supported by the version of NSS being used. | |
62 // On non-Linux platforms, Chromium embedders ship with a | |
63 // fixed version of NSS, and these are always available. | |
64 // However, on Linux (and ChromeOS), NSS is provided by the | |
65 // system, and thus not all algorithms may be available | |
66 // or be safe to use. | |
67 class NssRuntimeSupport { | |
68 public: | |
69 bool IsAesGcmSupported() const { | |
70 return pk11_encrypt_func_ && pk11_decrypt_func_; | |
71 } | |
72 | |
73 bool IsRsaOaepSupported() const { | |
74 return pk11_pub_encrypt_func_ && pk11_priv_decrypt_func_ && | |
75 internal_slot_does_oaep_; | |
76 } | |
77 | |
78 // Returns NULL if unsupported. | |
79 PK11_EncryptDecryptFunction pk11_encrypt_func() const { | |
80 return pk11_encrypt_func_; | |
81 } | |
82 | |
83 // Returns NULL if unsupported. | |
84 PK11_EncryptDecryptFunction pk11_decrypt_func() const { | |
85 return pk11_decrypt_func_; | |
86 } | |
87 | |
88 // Returns NULL if unsupported. | |
89 PK11_PubEncryptFunction pk11_pub_encrypt_func() const { | |
90 return pk11_pub_encrypt_func_; | |
91 } | |
92 | |
93 // Returns NULL if unsupported. | |
94 PK11_PrivDecryptFunction pk11_priv_decrypt_func() const { | |
95 return pk11_priv_decrypt_func_; | |
96 } | |
97 | |
98 static NssRuntimeSupport* Get(); | |
99 | |
100 private: | |
101 friend struct base::DefaultLazyInstanceTraits<NssRuntimeSupport>; | |
102 | |
103 NssRuntimeSupport(); | |
104 | |
105 PK11_EncryptDecryptFunction pk11_encrypt_func_; | |
106 PK11_EncryptDecryptFunction pk11_decrypt_func_; | |
107 PK11_PubEncryptFunction pk11_pub_encrypt_func_; | |
108 PK11_PrivDecryptFunction pk11_priv_decrypt_func_; | |
109 bool internal_slot_does_oaep_; | |
110 }; | |
111 | |
112 } // namespace webcrypto | |
113 | |
114 } // namespace content | |
115 | |
116 #endif // CONTENT_CHILD_WEBCRYPTO_NSS_UTIL_NSS_H_ | |
OLD | NEW |