If easy sign-in is set up, allow TPMTokenLoader to start before login

crypto/nss_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 
 #include <nss.h>
 #include <pk11pub.h>
 #include <plarena.h>
@@ skipping 329 matching lines @@
     TPMModuleAndSlot* tpm_args_ptr = tpm_args.get();
     if (base::WorkerPool::PostTaskAndReply(
             FROM_HERE,
             base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread,
                        system_slot_id,
                        tpm_args_ptr),
             base::Bind(&NSSInitSingleton::OnInitializedTPMTokenAndSystemSlot,
                        base::Unretained(this),  // NSSInitSingleton is leaky
                        callback,
                        base::Passed(&tpm_args)),
-            true /* task_is_slow */
-            )) {
+            true /* task_is_slow */)) {
       initializing_tpm_token_ = true;
     } else {
       base::MessageLoop::current()->PostTask(FROM_HERE,
                                              base::Bind(callback, false));
     }
   }
 
   static void InitializeTPMTokenOnWorkerThread(CK_SLOT_ID token_slot_id,
                                                TPMModuleAndSlot* tpm_args) {
     // This tries to load the Chaps module so NSS can talk to the hardware
@@ skipping 138 matching lines @@
     TPMModuleAndSlot* tpm_args_ptr = tpm_args.get();
     base::WorkerPool::PostTaskAndReply(
         FROM_HERE,
         base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread,
                    slot_id,
                    tpm_args_ptr),
         base::Bind(&NSSInitSingleton::OnInitializedTPMForChromeOSUser,
                    base::Unretained(this),  // NSSInitSingleton is leaky
                    username_hash,
                    base::Passed(&tpm_args)),
-        true /* task_is_slow */
-        );
+        true /* task_is_slow */);
   }
 
   void OnInitializedTPMForChromeOSUser(const std::string& username_hash,
                                        scoped_ptr<TPMModuleAndSlot> tpm_args) {
     DCHECK(thread_checker_.CalledOnValidThread());
     DVLOG(2) << "Got tpm slot for " << username_hash << " "
              << !!tpm_args->tpm_slot;
     chromeos_user_map_[username_hash]->SetPrivateSlot(
         tpm_args->tpm_slot.Pass());
   }
 
   void InitializePrivateSoftwareSlotForChromeOSUser(
       const std::string& username_hash) {
     DCHECK(thread_checker_.CalledOnValidThread());
     VLOG(1) << "using software private slot for " << username_hash;
     DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end());
     DCHECK(chromeos_user_map_[username_hash]->
                private_slot_initialization_started());
 
     chromeos_user_map_[username_hash]->SetPrivateSlot(
         chromeos_user_map_[username_hash]->GetPublicSlot());
   }
 
   ScopedPK11Slot GetPublicSlotForChromeOSUser(
       const std::string& username_hash) {
     DCHECK(thread_checker_.CalledOnValidThread());
 
     if (username_hash.empty()) {
       DVLOG(2) << "empty username_hash";
-      return ScopedPK11Slot();
+      return ScopedPK11Slot(PK11_GetInternalKeySlot());

[pneubeck (no reviews), 2014/12/02 11:56:47]

the fact that you have to change this to make the CHECK in NSSCertDatabase
happy, indicates that we have still/again a conceptual problem here:

In my latest changes I tried to ensure clearer/stronger guarantees like
 1) username(_hash) always be non-empty
 2) NSSCertDatabase to guarantee slots to exist (so that consumers don't have to
clutter slot accesses if conditionals)

I still think that 1) is right and important. Just overloading an empty string
with some special semantics is error-prone. Wherever we need a 'signin-profile'
mode, we should make it explicit.
2) seems more arguable to me, and maybe you should better remove that CHECK
instead of modifying nss_util.cc. Did you explore that route?

     }
 
     if (chromeos_user_map_.find(username_hash) == chromeos_user_map_.end()) {
       LOG(ERROR) << username_hash << " not initialized.";
       return ScopedPK11Slot();
     }
     return chromeos_user_map_[username_hash]->GetPublicSlot();
   }
 
   ScopedPK11Slot GetPrivateSlotForChromeOSUser(
@@ skipping 544 matching lines @@
   return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue();
 }
 
 #if !defined(OS_CHROMEOS)
 PK11SlotInfo* GetPersistentNSSKeySlot() {
   return g_nss_singleton.Get().GetPersistentNSSKeySlot();
 }
 #endif
 
 }  // namespace crypto