OLD | NEW |
| (Empty) |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef BASE_NSS_UTIL_H_ | |
6 #define BASE_NSS_UTIL_H_ | |
7 #pragma once | |
8 | |
9 #include <string> | |
10 #include "base/basictypes.h" | |
11 | |
12 #if defined(USE_NSS) | |
13 class FilePath; | |
14 #endif // defined(USE_NSS) | |
15 | |
16 // This file specifically doesn't depend on any NSS or NSPR headers because it | |
17 // is included by various (non-crypto) parts of chrome to call the | |
18 // initialization functions. | |
19 namespace base { | |
20 | |
21 class Lock; | |
22 class Time; | |
23 | |
24 #if defined(USE_NSS) | |
25 // EarlySetupForNSSInit performs lightweight setup which must occur before the | |
26 // process goes multithreaded. This does not initialise NSS. For test, see | |
27 // EnsureNSSInit. | |
28 void EarlySetupForNSSInit(); | |
29 #endif | |
30 | |
31 // Initialize NRPR if it isn't already initialized. This function is | |
32 // thread-safe, and NSPR will only ever be initialized once. NSPR will be | |
33 // properly shut down on program exit. | |
34 void EnsureNSPRInit(); | |
35 | |
36 // Initialize NSS if it isn't already initialized. This must be called before | |
37 // any other NSS functions. This function is thread-safe, and NSS will only | |
38 // ever be initialized once. NSS will be properly shut down on program exit. | |
39 void EnsureNSSInit(); | |
40 | |
41 // Call this before calling EnsureNSSInit() will force NSS to initialize | |
42 // without a persistent DB. This is used for the special case where access of | |
43 // persistent DB is prohibited. | |
44 // | |
45 // TODO(hclam): Isolate loading default root certs. | |
46 // | |
47 // NSS will be initialized without loading any user security modules, including | |
48 // the built-in root certificates module. User security modules need to be | |
49 // loaded manually after NSS initialization. | |
50 // | |
51 // If EnsureNSSInit() is called before then this function has no effect. | |
52 // | |
53 // Calling this method only has effect on Linux. | |
54 // | |
55 // WARNING: Use this with caution. | |
56 void ForceNSSNoDBInit(); | |
57 | |
58 // This methods is used to disable checks in NSS when used in a forked process. | |
59 // NSS checks whether it is running a forked process to avoid problems when | |
60 // using user security modules in a forked process. However if we are sure | |
61 // there are no modules loaded before the process is forked then there is no | |
62 // harm disabling the check. | |
63 // | |
64 // This method must be called before EnsureNSSInit() to take effect. | |
65 // | |
66 // WARNING: Use this with caution. | |
67 void DisableNSSForkCheck(); | |
68 | |
69 // Load NSS library files. This function has no effect on Mac and Windows. | |
70 // This loads the necessary NSS library files so that NSS can be initialized | |
71 // after loading additional library files is disallowed, for example when the | |
72 // sandbox is active. | |
73 // | |
74 // Note that this does not load libnssckbi.so which contains the root | |
75 // certificates. | |
76 void LoadNSSLibraries(); | |
77 | |
78 // Check if the current NSS version is greater than or equals to |version|. | |
79 // A sample version string is "3.12.3". | |
80 bool CheckNSSVersion(const char* version); | |
81 | |
82 #if defined(OS_CHROMEOS) | |
83 // Open the r/w nssdb that's stored inside the user's encrypted home | |
84 // directory. This is the default slot returned by | |
85 // GetPublicNSSKeySlot(). | |
86 void OpenPersistentNSSDB(); | |
87 | |
88 // Load the opencryptoki library into NSS so that we can access the | |
89 // TPM through NSS. Once this is called, GetPrivateNSSKeySlot() will | |
90 // return the TPM slot if one was found. Returns false if it was | |
91 // unable to load opencryptoki or open the TPM slot. | |
92 bool EnableTPMForNSS(); | |
93 | |
94 // Get name for the built-in TPM token on ChromeOS. | |
95 std::string GetTPMTokenName(); | |
96 | |
97 // Get the user PIN for the built-in TPM token on ChromeOS. | |
98 std::string GetTPMUserPIN(); | |
99 #endif | |
100 | |
101 // Convert a NSS PRTime value into a base::Time object. | |
102 // We use a int64 instead of PRTime here to avoid depending on NSPR headers. | |
103 Time PRTimeToBaseTime(int64 prtime); | |
104 | |
105 #if defined(USE_NSS) | |
106 // Exposed for unittests only. |path| should be an existing directory under | |
107 // which the DB files will be placed. |description| is a user-visible name for | |
108 // the DB, as a utf8 string, which will be truncated at 32 bytes. | |
109 bool OpenTestNSSDB(const FilePath& path, const char* description); | |
110 void CloseTestNSSDB(); | |
111 | |
112 // NSS has a bug which can cause a deadlock or stall in some cases when writing | |
113 // to the certDB and keyDB. It also has a bug which causes concurrent key pair | |
114 // generations to scribble over each other. To work around this, we synchronize | |
115 // writes to the NSS databases with a global lock. The lock is hidden beneath a | |
116 // function for easy disabling when the bug is fixed. Callers should allow for | |
117 // it to return NULL in the future. | |
118 // | |
119 // See https://bugzilla.mozilla.org/show_bug.cgi?id=564011 | |
120 Lock* GetNSSWriteLock(); | |
121 | |
122 // A helper class that acquires the NSS write Lock while the AutoNSSWriteLock | |
123 // is in scope. | |
124 class AutoNSSWriteLock { | |
125 public: | |
126 AutoNSSWriteLock(); | |
127 ~AutoNSSWriteLock(); | |
128 private: | |
129 Lock *lock_; | |
130 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); | |
131 }; | |
132 | |
133 #endif // defined(USE_NSS) | |
134 | |
135 } // namespace base | |
136 | |
137 #endif // BASE_NSS_UTIL_H_ | |
OLD | NEW |