dart:io | Fix SecureSocket client certificate problem with database password.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 507 matching lines @@
 }
 
 
 void SSLFilter::RegisterBadCertificateCallback(Dart_Handle callback) {
   ASSERT(bad_certificate_callback_ != NULL);
   Dart_DeletePersistentHandle(bad_certificate_callback_);
   bad_certificate_callback_ = Dart_NewPersistentHandle(callback);
   ASSERT(bad_certificate_callback_ != NULL);
 }
 
+
+char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
+  if (!retry) {
+    return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.

[Anders Johnsen, 2013/07/11 08:17:43]

Why PL_strdup here but strdup below?

+  }
+  return NULL;
+}
+
+
 static const char* builtin_roots_module =
 #if defined(TARGET_OS_LINUX) || defined(TARGET_OS_ANDROID)
     "name=\"Root Certs\" library=\"libnssckbi.so\"";
 #elif defined(TARGET_OS_MACOS)
     "name=\"Root Certs\" library=\"libnssckbi.dylib\"";
 #elif defined(TARGET_OS_WINDOWS)
     "name=\"Root Certs\" library=\"nssckbi.dll\"";
 #else
 #error Automatic target os detection failed.
 #endif
 
 
 
 void SSLFilter::InitializeLibrary(const char* certificate_database,
                                   const char* password,
                                   bool use_builtin_root_certificates,
                                   bool report_duplicate_initialization) {
   MutexLocker locker(mutex_);
   SECStatus status;
   if (!library_initialized_) {
-    password_ = strdup(password);  // This one copy persists until Dart exits.
     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
     // TODO(whesse): Verify there are no UTF-8 issues here.
     if (certificate_database == NULL || certificate_database[0] == '\0') {
       status = NSS_NoDB_Init(NULL);
       if (status != SECSuccess) {
         mutex_->Unlock();  // MutexLocker destructor not called when throwing.
         ThrowPRException("TlsException",
                          "Failed NSS_NoDB_Init call.");
       }
       if (use_builtin_root_certificates) {
@@ skipping 13 matching lines @@
       status = NSS_Initialize(certificate_database,
                               "",
                               "",
                               SECMOD_DB,
                               init_flags);
       if (status != SECSuccess) {
         mutex_->Unlock();  // MutexLocker destructor not called when throwing.
         ThrowPRException("TlsException",
                          "Failed NSS_Init call.");
       }
+      password_ = strdup(password);  // This one copy persists until Dart exits.

[Anders Johnsen, 2013/07/11 08:17:43]

Dart exits or leaving the current Dart Scope?

[Bill Hesse, 2013/07/11 09:24:46]

Until Dart exits (the process terminates).  This initialization occurs once per
process.

We use strdup because this is our copy, that is never freed.  PR_strdup
allocates within the heap managed by NSS.

 We use PR_strdup in the password callback because there is a corresponding
PR_free inside the code that calls this callback.

+      PK11_SetPasswordFunc(PasswordCallback);
     }
     library_initialized_ = true;
 
     status = NSS_SetDomesticPolicy();
     if (status != SECSuccess) {
       mutex_->Unlock();  // MutexLocker destructor not called when throwing.
       ThrowPRException("TlsException",
                        "Failed NSS_SetDomesticPolicy call.");
     }
     // Enable TLS, as well as SSL3 and SSL2.
@@ skipping 13 matching lines @@
   } else if (report_duplicate_initialization) {
     mutex_->Unlock();  // MutexLocker destructor not called when throwing.
     // Like ThrowPRException, without adding an OSError.
     Dart_ThrowException(DartUtils::NewDartIOException("TlsException",
         "Called SecureSocket.initialize more than once",
         Dart_Null()));
   }
 }
 
 
-char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
-  if (!retry) {
-    return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.
-  }
-  return NULL;
-}
-
-
 SECStatus BadCertificateCallback(void* filter, PRFileDesc* fd) {
   SSLFilter* ssl_filter = static_cast<SSLFilter*>(filter);
   Dart_Handle callback = ssl_filter->bad_certificate_callback();
   if (Dart_IsNull(callback)) return SECFailure;
 
   Dart_EnterScope();
   Dart_Handle x509_object = ssl_filter->PeerCertificate();
   Dart_Handle result =
       ThrowIfError(Dart_InvokeClosure(callback, 1, &x509_object));
   bool c_result = Dart_IsBoolean(result) && DartUtils::GetBooleanValue(result);
@@ skipping 33 matching lines @@
     ThrowPRException("TlsException", "Failed SSL_ImportFD call");
   }
 
   SSLVersionRange vrange;
   vrange.min = SSL_LIBRARY_VERSION_3_0;
   vrange.max = SSL_LIBRARY_VERSION_TLS_1_1;
   SSL_VersionRangeSet(filter_, &vrange);
 
   SECStatus status;
   if (is_server) {
-    PK11_SetPasswordFunc(PasswordCallback);
-
     CERTCertificate* certificate = NULL;
     if (strstr(certificate_name, "CN=") != NULL) {
       // Look up certificate using the distinguished name (DN) certificate_name.
       CERTCertDBHandle* certificate_database = CERT_GetDefaultCertDB();
       if (certificate_database == NULL) {
         ThrowPRException("CertificateException",
                          "Certificate database cannot be loaded");
       }
       certificate = CERT_FindCertByNameString(certificate_database,
           const_cast<char*>(certificate_name));
@@ skipping 60 matching lines @@
     // This disables the SSL session cache for client connections.
     // This resolves issue 7208, but degrades performance.
     // TODO(7230): Reenable session cache, without breaking client connections.
     status = SSL_OptionSet(filter_, SSL_NO_CACHE, PR_TRUE);
     if (status != SECSuccess) {
       ThrowPRException("TlsException",
                        "Failed SSL_OptionSet(NO_CACHE) call");
     }
 
     if (send_client_certificate) {
+      SSL_SetPKCS11PinArg(filter_, const_cast<char*>(password_));

[Anders Johnsen, 2013/07/11 08:17:43]

delete password_ in destructor?

[Bill Hesse, 2013/07/11 09:24:46]

No, password_ is a static.

       status = SSL_GetClientAuthDataHook(
           filter_,
           NSS_GetClientAuthData,
           static_cast<void*>(client_certificate_name_));
       if (status != SECSuccess) {
         ThrowPRException("TlsException",
                          "Failed SSL_GetClientAuthDataHook call");
       }
     }
   }
@@ skipping 173 matching lines @@
     // Return a send port for the service port.
     Dart_Handle send_port = Dart_NewSendPort(service_port);
     Dart_SetReturnValue(args, send_port);
   }
   Dart_ExitScope();
 }
 
 
 }  // namespace bin
 }  // namespace dart