OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "crypto/nss_util.h" | 5 #include "crypto/nss_util.h" |
6 #include "crypto/nss_util_internal.h" | 6 #include "crypto/nss_util_internal.h" |
7 | 7 |
8 #include <nss.h> | 8 #include <nss.h> |
9 #include <pk11pub.h> | 9 #include <pk11pub.h> |
10 #include <plarena.h> | 10 #include <plarena.h> |
(...skipping 215 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
226 | 226 |
227 void EnableTPMTokenForNSS() { | 227 void EnableTPMTokenForNSS() { |
228 DCHECK(thread_checker_.CalledOnValidThread()); | 228 DCHECK(thread_checker_.CalledOnValidThread()); |
229 | 229 |
230 // If this gets set, then we'll use the TPM for certs with | 230 // If this gets set, then we'll use the TPM for certs with |
231 // private keys, otherwise we'll fall back to the software | 231 // private keys, otherwise we'll fall back to the software |
232 // implementation. | 232 // implementation. |
233 tpm_token_enabled_for_nss_ = true; | 233 tpm_token_enabled_for_nss_ = true; |
234 } | 234 } |
235 | 235 |
236 bool InitializeTPMToken(const std::string& token_name, | 236 bool InitializeTPMToken(int token_slot_id) { |
237 int token_slot_id, | |
238 const std::string& user_pin) { | |
239 DCHECK(thread_checker_.CalledOnValidThread()); | 237 DCHECK(thread_checker_.CalledOnValidThread()); |
240 | 238 |
241 // If EnableTPMTokenForNSS hasn't been called, return false. | 239 // If EnableTPMTokenForNSS hasn't been called, return false. |
242 if (!tpm_token_enabled_for_nss_) | 240 if (!tpm_token_enabled_for_nss_) |
243 return false; | 241 return false; |
244 | 242 |
245 // If everything is already initialized, then return true. | 243 // If everything is already initialized, then return true. |
246 if (chaps_module_ && tpm_slot_) | 244 if (chaps_module_ && tpm_slot_) |
247 return true; | 245 return true; |
248 | 246 |
249 tpm_token_name_ = token_name; | |
250 tpm_user_pin_ = user_pin; | |
251 | |
252 // This tries to load the Chaps module so NSS can talk to the hardware | 247 // This tries to load the Chaps module so NSS can talk to the hardware |
253 // TPM. | 248 // TPM. |
254 if (!chaps_module_) { | 249 if (!chaps_module_) { |
255 chaps_module_ = LoadModule( | 250 chaps_module_ = LoadModule( |
256 kChapsModuleName, | 251 kChapsModuleName, |
257 kChapsPath, | 252 kChapsPath, |
258 // For more details on these parameters, see: | 253 // For more details on these parameters, see: |
259 // https://developer.mozilla.org/en/PKCS11_Module_Specs | 254 // https://developer.mozilla.org/en/PKCS11_Module_Specs |
260 // slotFlags=[PublicCerts] -- Certificates and public keys can be | 255 // slotFlags=[PublicCerts] -- Certificates and public keys can be |
261 // read from this slot without requiring a call to C_Login. | 256 // read from this slot without requiring a call to C_Login. |
262 // askpw=only -- Only authenticate to the token when necessary. | 257 // askpw=only -- Only authenticate to the token when necessary. |
263 "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\""); | 258 "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\""); |
264 if (!chaps_module_ && test_slot_) { | 259 if (!chaps_module_ && test_slot_) { |
265 // chromeos_unittests try to test the TPM initialization process. If we | 260 // chromeos_unittests try to test the TPM initialization process. If we |
266 // have a test DB open, pretend that it is the TPM slot. | 261 // have a test DB open, pretend that it is the TPM slot. |
267 tpm_slot_ = PK11_ReferenceSlot(test_slot_); | 262 tpm_slot_ = PK11_ReferenceSlot(test_slot_); |
268 return true; | 263 return true; |
269 } | 264 } |
270 } | 265 } |
271 if (chaps_module_){ | 266 if (chaps_module_){ |
272 tpm_slot_ = GetTPMSlotForId(token_slot_id); | 267 tpm_slot_ = GetTPMSlotForId(token_slot_id); |
273 | 268 |
274 return tpm_slot_ != NULL; | 269 return tpm_slot_ != NULL; |
275 } | 270 } |
276 return false; | 271 return false; |
277 } | 272 } |
278 | 273 |
279 void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) { | |
280 DCHECK(thread_checker_.CalledOnValidThread()); | |
281 if (!tpm_token_enabled_for_nss_) { | |
282 LOG(ERROR) << "GetTPMTokenInfo called before TPM Token is ready."; | |
283 return; | |
284 } | |
285 if (token_name) | |
286 *token_name = tpm_token_name_; | |
287 if (user_pin) | |
288 *user_pin = tpm_user_pin_; | |
289 } | |
290 | |
291 bool IsTPMTokenReady() { | 274 bool IsTPMTokenReady() { |
292 // TODO(mattm): Change to DCHECK when callers have been fixed. | 275 // TODO(mattm): Change to DCHECK when callers have been fixed. |
293 if (!thread_checker_.CalledOnValidThread()) { | 276 if (!thread_checker_.CalledOnValidThread()) { |
294 DVLOG(1) << "Called on wrong thread.\n" | 277 DVLOG(1) << "Called on wrong thread.\n" |
295 << base::debug::StackTrace().ToString(); | 278 << base::debug::StackTrace().ToString(); |
296 } | 279 } |
297 | 280 |
298 return tpm_slot_ != NULL; | 281 return tpm_slot_ != NULL; |
299 } | 282 } |
300 | 283 |
(...skipping 303 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
604 LOG(ERROR) << "Error opening persistent database (" << modspec | 587 LOG(ERROR) << "Error opening persistent database (" << modspec |
605 << "): " << GetNSSErrorMessage(); | 588 << "): " << GetNSSErrorMessage(); |
606 } | 589 } |
607 return db_slot; | 590 return db_slot; |
608 } | 591 } |
609 | 592 |
610 // If this is set to true NSS is forced to be initialized without a DB. | 593 // If this is set to true NSS is forced to be initialized without a DB. |
611 static bool force_nodb_init_; | 594 static bool force_nodb_init_; |
612 | 595 |
613 bool tpm_token_enabled_for_nss_; | 596 bool tpm_token_enabled_for_nss_; |
614 std::string tpm_token_name_; | 597 std::string tpm_token_name_; |
wtc
2013/11/23 00:42:29
Delete the tpm_token_name_ member.
mattm
2013/11/23 01:30:50
oops, done.
| |
615 std::string tpm_user_pin_; | |
616 SECMODModule* chaps_module_; | 598 SECMODModule* chaps_module_; |
617 PK11SlotInfo* software_slot_; | 599 PK11SlotInfo* software_slot_; |
618 PK11SlotInfo* test_slot_; | 600 PK11SlotInfo* test_slot_; |
619 PK11SlotInfo* tpm_slot_; | 601 PK11SlotInfo* tpm_slot_; |
620 SECMODModule* root_; | 602 SECMODModule* root_; |
621 bool chromeos_user_logged_in_; | 603 bool chromeos_user_logged_in_; |
622 #if defined(USE_NSS) | 604 #if defined(USE_NSS) |
623 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 | 605 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011 |
624 // is fixed, we will no longer need the lock. | 606 // is fixed, we will no longer need the lock. |
625 base::Lock write_lock_; | 607 base::Lock write_lock_; |
(...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
775 | 757 |
776 #if defined(OS_CHROMEOS) | 758 #if defined(OS_CHROMEOS) |
777 void OpenPersistentNSSDB() { | 759 void OpenPersistentNSSDB() { |
778 g_nss_singleton.Get().OpenPersistentNSSDB(); | 760 g_nss_singleton.Get().OpenPersistentNSSDB(); |
779 } | 761 } |
780 | 762 |
781 void EnableTPMTokenForNSS() { | 763 void EnableTPMTokenForNSS() { |
782 g_nss_singleton.Get().EnableTPMTokenForNSS(); | 764 g_nss_singleton.Get().EnableTPMTokenForNSS(); |
783 } | 765 } |
784 | 766 |
785 void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) { | |
786 g_nss_singleton.Get().GetTPMTokenInfo(token_name, user_pin); | |
787 } | |
788 | |
789 bool IsTPMTokenReady() { | 767 bool IsTPMTokenReady() { |
790 return g_nss_singleton.Get().IsTPMTokenReady(); | 768 return g_nss_singleton.Get().IsTPMTokenReady(); |
791 } | 769 } |
792 | 770 |
793 bool InitializeTPMToken(const std::string& token_name, | 771 bool InitializeTPMToken(int token_slot_id) { |
794 int token_slot_id, | 772 return g_nss_singleton.Get().InitializeTPMToken(token_slot_id); |
795 const std::string& user_pin) { | |
796 return g_nss_singleton.Get().InitializeTPMToken( | |
797 token_name, token_slot_id, user_pin); | |
798 } | 773 } |
799 #endif // defined(OS_CHROMEOS) | 774 #endif // defined(OS_CHROMEOS) |
800 | 775 |
801 base::Time PRTimeToBaseTime(PRTime prtime) { | 776 base::Time PRTimeToBaseTime(PRTime prtime) { |
802 return base::Time::FromInternalValue( | 777 return base::Time::FromInternalValue( |
803 prtime + base::Time::UnixEpoch().ToInternalValue()); | 778 prtime + base::Time::UnixEpoch().ToInternalValue()); |
804 } | 779 } |
805 | 780 |
806 PRTime BaseTimeToPRTime(base::Time time) { | 781 PRTime BaseTimeToPRTime(base::Time time) { |
807 return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue(); | 782 return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue(); |
808 } | 783 } |
809 | 784 |
810 PK11SlotInfo* GetPublicNSSKeySlot() { | 785 PK11SlotInfo* GetPublicNSSKeySlot() { |
811 return g_nss_singleton.Get().GetPublicNSSKeySlot(); | 786 return g_nss_singleton.Get().GetPublicNSSKeySlot(); |
812 } | 787 } |
813 | 788 |
814 PK11SlotInfo* GetPrivateNSSKeySlot() { | 789 PK11SlotInfo* GetPrivateNSSKeySlot() { |
815 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); | 790 return g_nss_singleton.Get().GetPrivateNSSKeySlot(); |
816 } | 791 } |
817 | 792 |
818 } // namespace crypto | 793 } // namespace crypto |
OLD | NEW |