crypto/nss_util: Get TPM slot id, do lookup by id instead of by name.

crypto/nss_util.cc

Index: crypto/nss_util.cc
diff --git a/crypto/nss_util.cc b/crypto/nss_util.cc
index 80191b3366f4b4c29eb478560c759cdda3d92669..d4dd50f607b7b48cc29988e4f117e0ff1e777a26 100644
--- a/crypto/nss_util.cc
+++ b/crypto/nss_util.cc
@@ -24,6 +24,7 @@
 #include <vector>
 
 #include "base/debug/alias.h"
+#include "base/debug/stack_trace.h"
 #include "base/environment.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
@@ -168,20 +169,6 @@ void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) {
 #endif  // defined(OS_LINUX) || defined(OS_OPENBSD)
 }
 
-PK11SlotInfo* FindSlotWithTokenName(const std::string& token_name) {
-  AutoSECMODListReadLock auto_lock;
-  SECMODModuleList* head = SECMOD_GetDefaultModuleList();
-  for (SECMODModuleList* item = head; item != NULL; item = item->next) {
-    int slot_count = item->module->loaded ? item->module->slotCount : 0;
-    for (int i = 0; i < slot_count; i++) {
-      PK11SlotInfo* slot = item->module->slots[i];
-      if (PK11_GetTokenName(slot) == token_name)
-        return PK11_ReferenceSlot(slot);
-    }
-  }
-  return NULL;
-}
-
 #endif  // defined(USE_NSS)
 
 // A singleton to initialize/deinitialize NSPR.
@@ -247,11 +234,15 @@ class NSSInitSingleton {
   }
 
   void EnableTPMTokenForNSS() {
+    // If this gets set, then we'll use the TPM for certs with
+    // private keys, otherwise we'll fall back to the software
+    // implementation.
     tpm_token_enabled_for_nss_ = true;
   }
 
   bool InitializeTPMToken(const std::string& token_name,
-                          const std::string& user_pin) {
+                          const std::string& user_pin,
+                          int token_slot_id) {
     // If EnableTPMTokenForNSS hasn't been called, return false.
     if (!tpm_token_enabled_for_nss_)
       return false;
@@ -275,12 +266,15 @@ class NSSInitSingleton {
           //   read from this slot without requiring a call to C_Login.
           // askpw=only -- Only authenticate to the token when necessary.
           "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\"");
+      if (!chaps_module_ && test_slot_) {
+        // chromeos_unittests try to test the TPM initialization process. If we
+        // have a test DB open, pretend that it is the TPM slot.
+        tpm_slot_ = PK11_ReferenceSlot(test_slot_);
+        return true;
+      }
     }
     if (chaps_module_){
-      // If this gets set, then we'll use the TPM for certs with
-      // private keys, otherwise we'll fall back to the software
-      // implementation.
-      tpm_slot_ = GetTPMSlot();
+      tpm_slot_ = GetTPMSlotForId(token_slot_id);

[Ryan Sleevi, 2013/10/24 01:26:21]

CASTING DANGER: CK_SLOT_ID is a CK_ULONG - which is PKCS#11-header/platform
specific, but at least 32 bits

For NSS, it's an unsigned long int.

You're casting a (signed) int up here. While I realize this is "probably" safe,
by virtue of it only talking to Chaps, the API divergence is at least worth
noting (perhaps in the comments for GetTPMSlotForID or here)

[mattm, 2013/10/24 01:59:07]

Done.

 
       return tpm_slot_ != NULL;
     }
@@ -302,10 +296,19 @@ class NSSInitSingleton {
     return tpm_slot_ != NULL;
   }
 
-  PK11SlotInfo* GetTPMSlot() {
-    std::string token_name;
-    GetTPMTokenInfo(&token_name, NULL);
-    return FindSlotWithTokenName(token_name);
+  PK11SlotInfo* GetTPMSlotForId(CK_SLOT_ID slot_id) {
+    if (!chaps_module_)
+      return NULL;
+
+    VLOG(1) << "Poking chaps module.";
+    SECStatus rv = SECMOD_UpdateSlotList(chaps_module_);
+    if (rv != SECSuccess)
+      PLOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError();
+
+    PK11SlotInfo* slot = SECMOD_LookupSlot(chaps_module_->moduleID, slot_id);
+    if (!slot)
+      LOG(ERROR) << "TPM slot " << slot_id << " not found.";
+    return slot;
   }
 #endif  // defined(OS_CHROMEOS)
 
@@ -383,6 +386,8 @@ class NSSInitSingleton {
         tpm_slot_(NULL),
         root_(NULL),
         chromeos_user_logged_in_(false) {
+    LOG(ERROR) << __func__;
+    base::debug::StackTrace().Print();
     base::TimeTicks start_time = base::TimeTicks::Now();
     EnsureNSPRInit();
 
@@ -549,6 +554,12 @@ class NSSInitSingleton {
                  << GetNSSErrorMessage();
       return NULL;
     }
+    if (!module->loaded) {
+      LOG(ERROR) << "After loading " << name << ", loaded==false: "
+                 << GetNSSErrorMessage();
+      SECMOD_DestroyModule(module);
+      return NULL;
+    }
     return module;
   }
 #endif
@@ -630,6 +641,7 @@ void EnsureNSSInit() {
 }
 
 void ForceNSSNoDBInit() {
+  LOG(ERROR) << "OKAAAAAAAAAAAAAAAAY";
   NSSInitSingleton::ForceNoDBInit();
 }
 
@@ -752,8 +764,14 @@ bool IsTPMTokenReady() {
 }
 
 bool InitializeTPMToken(const std::string& token_name,
-                        const std::string& user_pin) {
-  return g_nss_singleton.Get().InitializeTPMToken(token_name, user_pin);
+                        const std::string& user_pin,
+                        int token_slot_id) {
+  return g_nss_singleton.Get().InitializeTPMToken(
+      token_name, user_pin, token_slot_id);
+}
+
+PK11SlotInfo* GetTPMSlotForId(CK_SLOT_ID slot_id) {
+  return g_nss_singleton.Get().GetTPMSlotForId(slot_id);
 }
 #endif  // defined(OS_CHROMEOS)