crypto/nss_util.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "crypto/nss_util.h"
   6 #include "crypto/nss_util_internal.h"
   7
   8 #include <nss.h>
   9 #include <pk11pub.h>
  10 #include <plarena.h>
  11 #include <prerror.h>
  12 #include <prinit.h>
  13 #include <prtime.h>
  14 #include <secmod.h>
  15
  16 #if defined(OS_LINUX)
  17 #include <linux/nfs_fs.h>
  18 #include <sys/vfs.h>
  19 #elif defined(OS_OPENBSD)
  20 #include <sys/mount.h>
  21 #include <sys/param.h>
  22 #endif
  23
  24 #include <vector>
  25
  26 #include "base/debug/alias.h"
  27 #include "base/environment.h"
  28 #include "base/file_path.h"
  29 #include "base/file_util.h"
  30 #include "base/files/scoped_temp_dir.h"
  31 #include "base/lazy_instance.h"
  32 #include "base/logging.h"
  33 #include "base/memory/scoped_ptr.h"
  34 #include "base/metrics/histogram.h"
  35 #include "base/native_library.h"
  36 #include "base/stringprintf.h"
  37 #include "base/threading/thread_restrictions.h"
  38 #include "build/build_config.h"
  39
  40 #if defined(OS_CHROMEOS)
  41 #include "crypto/symmetric_key.h"
  42 #endif
  43
  44 // USE_NSS means we use NSS for everything crypto-related.  If USE_NSS is not
  45 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
  46 // use NSS for crypto or certificate verification, and we don't use the NSS
  47 // certificate and key databases.
  48 #if defined(USE_NSS)
  49 #include "base/synchronization/lock.h"
  50 #include "crypto/crypto_module_blocking_password_delegate.h"
  51 #endif  // defined(USE_NSS)
  52
  53 namespace crypto {
  54
  55 namespace {
  56
  57 #if defined(OS_CHROMEOS)
  58 const char kNSSDatabaseName[] = "Real NSS database";
  59
  60 // Constants for loading the Chrome OS TPM-backed PKCS #11 library.
  61 const char kChapsModuleName[] = "Chaps";
  62 const char kChapsPath[] = "libchaps.so";
  63
  64 // Fake certificate authority database used for testing.
  65 static const base::FilePath::CharType kReadOnlyCertDB[] =
  66     FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb");
  67 #endif  // defined(OS_CHROMEOS)
  68
  69 std::string GetNSSErrorMessage() {
  70   std::string result;
  71   if (PR_GetErrorTextLength()) {
  72     scoped_array<char> error_text(new char[PR_GetErrorTextLength() + 1]);
  73     PRInt32 copied = PR_GetErrorText(error_text.get());
  74     result = std::string(error_text.get(), copied);
  75   } else {
  76     result = StringPrintf("NSS error code: %d", PR_GetError());
  77   }
  78   return result;
  79 }
  80
  81 #if defined(USE_NSS)
  82 base::FilePath GetDefaultConfigDirectory() {
  83   base::FilePath dir = file_util::GetHomeDir();
  84   if (dir.empty()) {
  85     LOG(ERROR) << "Failed to get home directory.";
  86     return dir;
  87   }
  88   dir = dir.AppendASCII(".pki").AppendASCII("nssdb");
  89   if (!file_util::CreateDirectory(dir)) {
  90     LOG(ERROR) << "Failed to create " << dir.value() << " directory.";
  91     dir.clear();
  92   }
  93   return dir;
  94 }
  95
  96 #if defined(OS_CHROMEOS)
  97 // Supplemental user key id.
  98 unsigned char kSupplementalUserKeyId[] = {
  99   0xCC, 0x13, 0x19, 0xDE, 0x75, 0x5E, 0xFE, 0xFA,
 100   0x5E, 0x71, 0xD4, 0xA6, 0xFB, 0x00, 0x00, 0xCC
 101 };
 102 #endif  // defined(OS_CHROMEOS)
 103
 104
 105 // On non-chromeos platforms, return the default config directory.
 106 // On chromeos, return a read-only directory with fake root CA certs for testing
 107 // (which will not exist on non-testing images).  These root CA certs are used
 108 // by the local Google Accounts server mock we use when testing our login code.
 109 // If this directory is not present, NSS_Init() will fail.  It is up to the
 110 // caller to failover to NSS_NoDB_Init() at that point.
 111 base::FilePath GetInitialConfigDirectory() {
 112 #if defined(OS_CHROMEOS)
 113   return base::FilePath(kReadOnlyCertDB);
 114 #else
 115   return GetDefaultConfigDirectory();
 116 #endif  // defined(OS_CHROMEOS)
 117 }
 118
 119 // This callback for NSS forwards all requests to a caller-specified
 120 // CryptoModuleBlockingPasswordDelegate object.
 121 char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) {
 122 #if defined(OS_CHROMEOS)
 123   // If we get asked for a password for the TPM, then return the
 124   // well known password we use, as long as the TPM slot has been
 125   // initialized.
 126   if (crypto::IsTPMTokenReady()) {
 127     std::string token_name;
 128     std::string user_pin;
 129     crypto::GetTPMTokenInfo(&token_name, &user_pin);
 130     if (PK11_GetTokenName(slot) == token_name)
 131       return PORT_Strdup(user_pin.c_str());
 132   }
 133 #endif
 134   crypto::CryptoModuleBlockingPasswordDelegate* delegate =
 135       reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg);
 136   if (delegate) {
 137     bool cancelled = false;
 138     std::string password = delegate->RequestPassword(PK11_GetTokenName(slot),
 139                                                      retry != PR_FALSE,
 140                                                      &cancelled);
 141     if (cancelled)
 142       return NULL;
 143     char* result = PORT_Strdup(password.c_str());
 144     password.replace(0, password.size(), password.size(), 0);
 145     return result;
 146   }
 147   DLOG(ERROR) << "PK11 password requested with NULL arg";
 148   return NULL;
 149 }
 150
 151 // NSS creates a local cache of the sqlite database if it detects that the
 152 // filesystem the database is on is much slower than the local disk.  The
 153 // detection doesn't work with the latest versions of sqlite, such as 3.6.22
 154 // (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561).  So we set
 155 // the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's
 156 // detection when database_dir is on NFS.  See http://crbug.com/48585.
 157 //
 158 // TODO(wtc): port this function to other USE_NSS platforms.  It is defined
 159 // only for OS_LINUX and OS_OPENBSD simply because the statfs structure
 160 // is OS-specific.
 161 //
 162 // Because this function sets an environment variable it must be run before we
 163 // go multi-threaded.
 164 void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) {
 165 #if defined(OS_LINUX) || defined(OS_OPENBSD)
 166   struct statfs buf;
 167   if (statfs(database_dir.value().c_str(), &buf) == 0) {
 168 #if defined(OS_LINUX)
 169     if (buf.f_type == NFS_SUPER_MAGIC) {
 170 #elif defined(OS_OPENBSD)
 171     if (strcmp(buf.f_fstypename, MOUNT_NFS) == 0) {
 172 #endif
 173       scoped_ptr<base::Environment> env(base::Environment::Create());
 174       const char* use_cache_env_var = "NSS_SDB_USE_CACHE";
 175       if (!env->HasVar(use_cache_env_var))
 176         env->SetVar(use_cache_env_var, "yes");
 177     }
 178   }
 179 #endif  // defined(OS_LINUX) || defined(OS_OPENBSD)
 180 }
 181
 182 PK11SlotInfo* FindSlotWithTokenName(const std::string& token_name) {
 183   AutoSECMODListReadLock auto_lock;
 184   SECMODModuleList* head = SECMOD_GetDefaultModuleList();
 185   for (SECMODModuleList* item = head; item != NULL; item = item->next) {
 186     int slot_count = item->module->loaded ? item->module->slotCount : 0;
 187     for (int i = 0; i < slot_count; i++) {
 188       PK11SlotInfo* slot = item->module->slots[i];
 189       if (PK11_GetTokenName(slot) == token_name)
 190         return PK11_ReferenceSlot(slot);
 191     }
 192   }
 193   return NULL;
 194 }
 195
 196 #endif  // defined(USE_NSS)
 197
 198 // A singleton to initialize/deinitialize NSPR.
 199 // Separate from the NSS singleton because we initialize NSPR on the UI thread.
 200 // Now that we're leaking the singleton, we could merge back with the NSS
 201 // singleton.
 202 class NSPRInitSingleton {
 203  private:
 204   friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>;
 205
 206   NSPRInitSingleton() {
 207     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
 208   }
 209
 210   // NOTE(willchan): We don't actually execute this code since we leak NSS to
 211   // prevent non-joinable threads from using NSS after it's already been shut
 212   // down.
 213   ~NSPRInitSingleton() {
 214     PL_ArenaFinish();
 215     PRStatus prstatus = PR_Cleanup();
 216     if (prstatus != PR_SUCCESS)
 217       LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
 218   }
 219 };
 220
 221 base::LazyInstance<NSPRInitSingleton>::Leaky
 222     g_nspr_singleton = LAZY_INSTANCE_INITIALIZER;
 223
 224 // This is a LazyInstance so that it will be deleted automatically when the
 225 // unittest exits.  NSSInitSingleton is a LeakySingleton, so it would not be
 226 // deleted if it were a regular member.
 227 base::LazyInstance<base::ScopedTempDir> g_test_nss_db_dir =
 228     LAZY_INSTANCE_INITIALIZER;
 229
 230 // Force a crash with error info on NSS_NoDB_Init failure.
 231 void CrashOnNSSInitFailure() {
 232   int nss_error = PR_GetError();
 233   int os_error = PR_GetOSError();
 234   base::debug::Alias(&nss_error);
 235   base::debug::Alias(&os_error);
 236   LOG(ERROR) << "Error initializing NSS without a persistent database: "
 237              << GetNSSErrorMessage();
 238   LOG(FATAL) << "nss_error=" << nss_error << ", os_error=" << os_error;
 239 }
 240
 241 class NSSInitSingleton {
 242  public:
 243 #if defined(OS_CHROMEOS)
 244   void OpenPersistentNSSDB() {
 245     if (!chromeos_user_logged_in_) {
 246       // GetDefaultConfigDirectory causes us to do blocking IO on UI thread.
 247       // Temporarily allow it until we fix http://crbug.com/70119
 248       base::ThreadRestrictions::ScopedAllowIO allow_io;
 249       chromeos_user_logged_in_ = true;
 250
 251       // This creates another DB slot in NSS that is read/write, unlike
 252       // the fake root CA cert DB and the "default" crypto key
 253       // provider, which are still read-only (because we initialized
 254       // NSS before we had a cryptohome mounted).
 255       software_slot_ = OpenUserDB(GetDefaultConfigDirectory(),
 256                                   kNSSDatabaseName);
 257     }
 258   }
 259
 260   void EnableTPMTokenForNSS() {
 261     tpm_token_enabled_for_nss_ = true;
 262   }
 263
 264   bool InitializeTPMToken(const std::string& token_name,
 265                           const std::string& user_pin) {
 266     // If EnableTPMTokenForNSS hasn't been called, return false.
 267     if (!tpm_token_enabled_for_nss_)
 268       return false;
 269
 270     // If everything is already initialized, then return true.
 271     if (chaps_module_ && tpm_slot_)
 272       return true;
 273
 274     tpm_token_name_ = token_name;
 275     tpm_user_pin_ = user_pin;
 276
 277     // This tries to load the Chaps module so NSS can talk to the hardware
 278     // TPM.
 279     if (!chaps_module_) {
 280       chaps_module_ = LoadModule(
 281           kChapsModuleName,
 282           kChapsPath,
 283           // For more details on these parameters, see:
 284           // https://developer.mozilla.org/en/PKCS11_Module_Specs
 285           // slotFlags=[PublicCerts] -- Certificates and public keys can be
 286           //   read from this slot without requiring a call to C_Login.
 287           // askpw=only -- Only authenticate to the token when necessary.
 288           "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\"");
 289     }
 290     if (chaps_module_){
 291       // If this gets set, then we'll use the TPM for certs with
 292       // private keys, otherwise we'll fall back to the software
 293       // implementation.
 294       tpm_slot_ = GetTPMSlot();
 295
 296       return tpm_slot_ != NULL;
 297     }
 298     return false;
 299   }
 300
 301   void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) {
 302     if (!tpm_token_enabled_for_nss_) {
 303       LOG(ERROR) << "GetTPMTokenInfo called before TPM Token is ready.";
 304       return;
 305     }
 306     if (token_name)
 307       *token_name = tpm_token_name_;
 308     if (user_pin)
 309       *user_pin = tpm_user_pin_;
 310   }
 311
 312   bool IsTPMTokenReady() {
 313     return tpm_slot_ != NULL;
 314   }
 315
 316   PK11SlotInfo* GetTPMSlot() {
 317     std::string token_name;
 318     GetTPMTokenInfo(&token_name, NULL);
 319     return FindSlotWithTokenName(token_name);
 320   }
 321
 322   SymmetricKey* GetSupplementalUserKey() {
 323     DCHECK(chromeos_user_logged_in_);
 324
 325     PK11SlotInfo* slot = NULL;
 326     PK11SymKey* key = NULL;
 327     SECItem keyID;
 328     CK_MECHANISM_TYPE type = CKM_AES_ECB;
 329
 330     slot = GetPublicNSSKeySlot();
 331     if (!slot)
 332       goto done;
 333
 334     if (PK11_Authenticate(slot, PR_TRUE, NULL) != SECSuccess)
 335       goto done;
 336
 337     keyID.type = siBuffer;
 338     keyID.data = kSupplementalUserKeyId;
 339     keyID.len = static_cast<int>(sizeof(kSupplementalUserKeyId));
 340
 341     // Find/generate AES key.
 342     key = PK11_FindFixedKey(slot, type, &keyID, NULL);
 343     if (!key) {
 344       const int kKeySizeInBytes = 32;
 345       key = PK11_TokenKeyGen(slot, type, NULL,
 346                              kKeySizeInBytes,
 347                              &keyID, PR_TRUE, NULL);
 348     }
 349
 350   done:
 351     if (slot)
 352       PK11_FreeSlot(slot);
 353
 354     return key ? SymmetricKey::CreateFromKey(key) : NULL;
 355   }
 356 #endif  // defined(OS_CHROMEOS)
 357
 358
 359   bool OpenTestNSSDB() {
 360     if (test_slot_)
 361       return true;
 362     if (!g_test_nss_db_dir.Get().CreateUniqueTempDir())
 363       return false;
 364     test_slot_ = OpenUserDB(g_test_nss_db_dir.Get().path(), "Test DB");
 365     return !!test_slot_;
 366   }
 367
 368   void CloseTestNSSDB() {
 369     if (test_slot_) {
 370       SECStatus status = SECMOD_CloseUserDB(test_slot_);
 371       if (status != SECSuccess)
 372         PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
 373       PK11_FreeSlot(test_slot_);
 374       test_slot_ = NULL;
 375       ignore_result(g_test_nss_db_dir.Get().Delete());
 376     }
 377   }
 378
 379   PK11SlotInfo* GetPublicNSSKeySlot() {
 380     if (test_slot_)
 381       return PK11_ReferenceSlot(test_slot_);
 382     if (software_slot_)
 383       return PK11_ReferenceSlot(software_slot_);
 384     return PK11_GetInternalKeySlot();
 385   }
 386
 387   PK11SlotInfo* GetPrivateNSSKeySlot() {
 388     if (test_slot_)
 389       return PK11_ReferenceSlot(test_slot_);
 390
 391 #if defined(OS_CHROMEOS)
 392     if (tpm_token_enabled_for_nss_) {
 393       if (IsTPMTokenReady()) {
 394         return PK11_ReferenceSlot(tpm_slot_);
 395       } else {
 396         // If we were supposed to get the hardware token, but were
 397         // unable to, return NULL rather than fall back to sofware.
 398         return NULL;
 399       }
 400     }
 401 #endif
 402     // If we weren't supposed to enable the TPM for NSS, then return
 403     // the software slot.
 404     if (software_slot_)
 405       return PK11_ReferenceSlot(software_slot_);
 406     return PK11_GetInternalKeySlot();
 407   }
 408
 409 #if defined(USE_NSS)
 410   base::Lock* write_lock() {
 411     return &write_lock_;
 412   }
 413 #endif  // defined(USE_NSS)
 414
 415   // This method is used to force NSS to be initialized without a DB.
 416   // Call this method before NSSInitSingleton() is constructed.
 417   static void ForceNoDBInit() {
 418     force_nodb_init_ = true;
 419   }
 420
 421  private:
 422   friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>;
 423
 424   NSSInitSingleton()
 425       : tpm_token_enabled_for_nss_(false),
 426         chaps_module_(NULL),
 427         software_slot_(NULL),
 428         test_slot_(NULL),
 429         tpm_slot_(NULL),
 430         root_(NULL),
 431         chromeos_user_logged_in_(false) {
 432     base::TimeTicks start_time = base::TimeTicks::Now();
 433     EnsureNSPRInit();
 434
 435     // We *must* have NSS >= 3.12.3.  See bug 26448.
 436     COMPILE_ASSERT(
 437         (NSS_VMAJOR == 3 && NSS_VMINOR == 12 && NSS_VPATCH >= 3) ||
 438         (NSS_VMAJOR == 3 && NSS_VMINOR > 12) ||
 439         (NSS_VMAJOR > 3),
 440         nss_version_check_failed);
 441     // Also check the run-time NSS version.
 442     // NSS_VersionCheck is a >= check, not strict equality.
 443     if (!NSS_VersionCheck("3.12.3")) {
 444       // It turns out many people have misconfigured NSS setups, where
 445       // their run-time NSPR doesn't match the one their NSS was compiled
 446       // against.  So rather than aborting, complain loudly.
 447       LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed.  "
 448                     "We depend on NSS >= 3.12.3, and this error is not fatal "
 449                     "only because many people have busted NSS setups (for "
 450                     "example, using the wrong version of NSPR). "
 451                     "Please upgrade to the latest NSS and NSPR, and if you "
 452                     "still get this error, contact your distribution "
 453                     "maintainer.";
 454     }
 455
 456     SECStatus status = SECFailure;
 457     bool nodb_init = force_nodb_init_;
 458
 459 #if !defined(USE_NSS)
 460     // Use the system certificate store, so initialize NSS without database.
 461     nodb_init = true;
 462 #endif
 463
 464     if (nodb_init) {
 465       status = NSS_NoDB_Init(NULL);
 466       if (status != SECSuccess) {
 467         CrashOnNSSInitFailure();
 468         return;
 469       }
 470 #if defined(OS_IOS)
 471       root_ = InitDefaultRootCerts();
 472 #endif  // defined(OS_IOS)
 473     } else {
 474 #if defined(USE_NSS)
 475       base::FilePath database_dir = GetInitialConfigDirectory();
 476       if (!database_dir.empty()) {
 477         // This duplicates the work which should have been done in
 478         // EarlySetupForNSSInit. However, this function is idempotent so
 479         // there's no harm done.
 480         UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
 481
 482         // Initialize with a persistent database (likely, ~/.pki/nssdb).
 483         // Use "sql:" which can be shared by multiple processes safely.
 484         std::string nss_config_dir =
 485             StringPrintf("sql:%s", database_dir.value().c_str());
 486 #if defined(OS_CHROMEOS)
 487         status = NSS_Init(nss_config_dir.c_str());
 488 #else
 489         status = NSS_InitReadWrite(nss_config_dir.c_str());
 490 #endif
 491         if (status != SECSuccess) {
 492           LOG(ERROR) << "Error initializing NSS with a persistent "
 493                         "database (" << nss_config_dir
 494                      << "): " << GetNSSErrorMessage();
 495         }
 496       }
 497       if (status != SECSuccess) {
 498         VLOG(1) << "Initializing NSS without a persistent database.";
 499         status = NSS_NoDB_Init(NULL);
 500         if (status != SECSuccess) {
 501           CrashOnNSSInitFailure();
 502           return;
 503         }
 504       }
 505
 506       PK11_SetPasswordFunc(PKCS11PasswordFunc);
 507
 508       // If we haven't initialized the password for the NSS databases,
 509       // initialize an empty-string password so that we don't need to
 510       // log in.
 511       PK11SlotInfo* slot = PK11_GetInternalKeySlot();
 512       if (slot) {
 513         // PK11_InitPin may write to the keyDB, but no other thread can use NSS
 514         // yet, so we don't need to lock.
 515         if (PK11_NeedUserInit(slot))
 516           PK11_InitPin(slot, NULL, NULL);
 517         PK11_FreeSlot(slot);
 518       }
 519
 520       root_ = InitDefaultRootCerts();
 521 #endif  // defined(USE_NSS)
 522     }
 523
 524     // Disable MD5 certificate signatures. (They are disabled by default in
 525     // NSS 3.14.)
 526     NSS_SetAlgorithmPolicy(SEC_OID_MD5, 0, NSS_USE_ALG_IN_CERT_SIGNATURE);
 527     NSS_SetAlgorithmPolicy(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION,
 528                            0, NSS_USE_ALG_IN_CERT_SIGNATURE);
 529
 530     // The UMA bit is conditionally set for this histogram in
 531     // chrome/common/startup_metric_utils.cc .
 532     HISTOGRAM_CUSTOM_TIMES("Startup.SlowStartupNSSInit",
 533                            base::TimeTicks::Now() - start_time,
 534                            base::TimeDelta::FromMilliseconds(10),
 535                            base::TimeDelta::FromHours(1),
 536                            50);
 537   }
 538
 539   // NOTE(willchan): We don't actually execute this code since we leak NSS to
 540   // prevent non-joinable threads from using NSS after it's already been shut
 541   // down.
 542   ~NSSInitSingleton() {
 543     if (tpm_slot_) {
 544       PK11_FreeSlot(tpm_slot_);
 545       tpm_slot_ = NULL;
 546     }
 547     if (software_slot_) {
 548       SECMOD_CloseUserDB(software_slot_);
 549       PK11_FreeSlot(software_slot_);
 550       software_slot_ = NULL;
 551     }
 552     CloseTestNSSDB();
 553     if (root_) {
 554       SECMOD_UnloadUserModule(root_);
 555       SECMOD_DestroyModule(root_);
 556       root_ = NULL;
 557     }
 558     if (chaps_module_) {
 559       SECMOD_UnloadUserModule(chaps_module_);
 560       SECMOD_DestroyModule(chaps_module_);
 561       chaps_module_ = NULL;
 562     }
 563
 564     SECStatus status = NSS_Shutdown();
 565     if (status != SECSuccess) {
 566       // We VLOG(1) because this failure is relatively harmless (leaking, but
 567       // we're shutting down anyway).
 568       VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609";
 569     }
 570   }
 571
 572 #if defined(USE_NSS) || defined(OS_IOS)
 573   // Load nss's built-in root certs.
 574   SECMODModule* InitDefaultRootCerts() {
 575     SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL);
 576     if (root)
 577       return root;
 578
 579     // Aw, snap.  Can't find/load root cert shared library.
 580     // This will make it hard to talk to anybody via https.
 581     NOTREACHED();
 582     return NULL;
 583   }
 584
 585   // Load the given module for this NSS session.
 586   SECMODModule* LoadModule(const char* name,
 587                            const char* library_path,
 588                            const char* params) {
 589     std::string modparams = StringPrintf(
 590         "name=\"%s\" library=\"%s\" %s",
 591         name, library_path, params ? params : "");
 592
 593     // Shouldn't need to const_cast here, but SECMOD doesn't properly
 594     // declare input string arguments as const.  Bug
 595     // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed
 596     // on NSS codebase to address this.
 597     SECMODModule* module = SECMOD_LoadUserModule(
 598         const_cast<char*>(modparams.c_str()), NULL, PR_FALSE);
 599     if (!module) {
 600       LOG(ERROR) << "Error loading " << name << " module into NSS: "
 601                  << GetNSSErrorMessage();
 602       return NULL;
 603     }
 604     return module;
 605   }
 606 #endif
 607
 608   static PK11SlotInfo* OpenUserDB(const base::FilePath& path,
 609                                   const char* description) {
 610     const std::string modspec =
 611         StringPrintf("configDir='sql:%s' tokenDescription='%s'",
 612                      path.value().c_str(), description);
 613     PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str());
 614     if (db_slot) {
 615       if (PK11_NeedUserInit(db_slot))
 616         PK11_InitPin(db_slot, NULL, NULL);
 617     }
 618     else {
 619       LOG(ERROR) << "Error opening persistent database (" << modspec
 620                  << "): " << GetNSSErrorMessage();
 621     }
 622     return db_slot;
 623   }
 624
 625   // If this is set to true NSS is forced to be initialized without a DB.
 626   static bool force_nodb_init_;
 627
 628   bool tpm_token_enabled_for_nss_;
 629   std::string tpm_token_name_;
 630   std::string tpm_user_pin_;
 631   SECMODModule* chaps_module_;
 632   PK11SlotInfo* software_slot_;
 633   PK11SlotInfo* test_slot_;
 634   PK11SlotInfo* tpm_slot_;
 635   SECMODModule* root_;
 636   bool chromeos_user_logged_in_;
 637 #if defined(USE_NSS)
 638   // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
 639   // is fixed, we will no longer need the lock.
 640   base::Lock write_lock_;
 641 #endif  // defined(USE_NSS)
 642 };
 643
 644 // static
 645 bool NSSInitSingleton::force_nodb_init_ = false;
 646
 647 base::LazyInstance<NSSInitSingleton>::Leaky
 648     g_nss_singleton = LAZY_INSTANCE_INITIALIZER;
 649 }  // namespace
 650
 651 #if defined(USE_NSS)
 652 void EarlySetupForNSSInit() {
 653   base::FilePath database_dir = GetInitialConfigDirectory();
 654   if (!database_dir.empty())
 655     UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
 656 }
 657 #endif
 658
 659 void EnsureNSPRInit() {
 660   g_nspr_singleton.Get();
 661 }
 662
 663 void InitNSSSafely() {
 664   // We might fork, but we haven't loaded any security modules.
 665   DisableNSSForkCheck();
 666   // If we're sandboxed, we shouldn't be able to open user security modules,
 667   // but it's more correct to tell NSS to not even try.
 668   // Loading user security modules would have security implications.
 669   ForceNSSNoDBInit();
 670   // Initialize NSS.
 671   EnsureNSSInit();
 672 }
 673
 674 void EnsureNSSInit() {
 675   // Initializing SSL causes us to do blocking IO.
 676   // Temporarily allow it until we fix
 677   //   http://code.google.com/p/chromium/issues/detail?id=59847
 678   base::ThreadRestrictions::ScopedAllowIO allow_io;
 679   g_nss_singleton.Get();
 680 }
 681
 682 void ForceNSSNoDBInit() {
 683   NSSInitSingleton::ForceNoDBInit();
 684 }
 685
 686 void DisableNSSForkCheck() {
 687   scoped_ptr<base::Environment> env(base::Environment::Create());
 688   env->SetVar("NSS_STRICT_NOFORK", "DISABLED");
 689 }
 690
 691 void LoadNSSLibraries() {
 692   // Some NSS libraries are linked dynamically so load them here.
 693 #if defined(USE_NSS)
 694   // Try to search for multiple directories to load the libraries.
 695   std::vector<base::FilePath> paths;
 696
 697   // Use relative path to Search PATH for the library files.
 698   paths.push_back(base::FilePath());
 699
 700   // For Debian derivatives NSS libraries are located here.
 701   paths.push_back(base::FilePath("/usr/lib/nss"));
 702
 703   // Ubuntu 11.10 (Oneiric) places the libraries here.
 704 #if defined(ARCH_CPU_X86_64)
 705   paths.push_back(base::FilePath("/usr/lib/x86_64-linux-gnu/nss"));
 706 #elif defined(ARCH_CPU_X86)
 707   paths.push_back(base::FilePath("/usr/lib/i386-linux-gnu/nss"));
 708 #elif defined(ARCH_CPU_ARMEL)
 709   paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabi/nss"));
 710 #endif
 711
 712   // A list of library files to load.
 713   std::vector<std::string> libs;
 714   libs.push_back("libsoftokn3.so");
 715   libs.push_back("libfreebl3.so");
 716
 717   // For each combination of library file and path, check for existence and
 718   // then load.
 719   size_t loaded = 0;
 720   for (size_t i = 0; i < libs.size(); ++i) {
 721     for (size_t j = 0; j < paths.size(); ++j) {
 722       base::FilePath path = paths[j].Append(libs[i]);
 723       base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL);
 724       if (lib) {
 725         ++loaded;
 726         break;
 727       }
 728     }
 729   }
 730
 731   if (loaded == libs.size()) {
 732     VLOG(3) << "NSS libraries loaded.";
 733   } else {
 734     LOG(ERROR) << "Failed to load NSS libraries.";
 735   }
 736 #endif
 737 }
 738
 739 bool CheckNSSVersion(const char* version) {
 740   return !!NSS_VersionCheck(version);
 741 }
 742
 743 #if defined(USE_NSS)
 744 ScopedTestNSSDB::ScopedTestNSSDB()
 745   : is_open_(g_nss_singleton.Get().OpenTestNSSDB()) {
 746 }
 747
 748 ScopedTestNSSDB::~ScopedTestNSSDB() {
 749   // TODO(mattm): Close the dababase once NSS 3.14 is required,
 750   // which fixes https://bugzilla.mozilla.org/show_bug.cgi?id=588269
 751   // Resource leaks are suppressed. http://crbug.com/156433 .
 752 }
 753
 754 base::Lock* GetNSSWriteLock() {
 755   return g_nss_singleton.Get().write_lock();
 756 }
 757
 758 AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) {
 759   // May be NULL if the lock is not needed in our version of NSS.
 760   if (lock_)
 761     lock_->Acquire();
 762 }
 763
 764 AutoNSSWriteLock::~AutoNSSWriteLock() {
 765   if (lock_) {
 766     lock_->AssertAcquired();
 767     lock_->Release();
 768   }
 769 }
 770
 771 AutoSECMODListReadLock::AutoSECMODListReadLock()
 772       : lock_(SECMOD_GetDefaultModuleListLock()) {
 773     SECMOD_GetReadLock(lock_);
 774   }
 775
 776 AutoSECMODListReadLock::~AutoSECMODListReadLock() {
 777   SECMOD_ReleaseReadLock(lock_);
 778 }
 779
 780 #endif  // defined(USE_NSS)
 781
 782 #if defined(OS_CHROMEOS)
 783 void OpenPersistentNSSDB() {
 784   g_nss_singleton.Get().OpenPersistentNSSDB();
 785 }
 786
 787 void EnableTPMTokenForNSS() {
 788   g_nss_singleton.Get().EnableTPMTokenForNSS();
 789 }
 790
 791 void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) {
 792   g_nss_singleton.Get().GetTPMTokenInfo(token_name, user_pin);
 793 }
 794
 795 bool IsTPMTokenReady() {
 796   return g_nss_singleton.Get().IsTPMTokenReady();
 797 }
 798
 799 bool InitializeTPMToken(const std::string& token_name,
 800                         const std::string& user_pin) {
 801   return g_nss_singleton.Get().InitializeTPMToken(token_name, user_pin);
 802 }
 803
 804 SymmetricKey* GetSupplementalUserKey() {
 805   return g_nss_singleton.Get().GetSupplementalUserKey();
 806 }
 807 #endif  // defined(OS_CHROMEOS)
 808
 809 base::Time PRTimeToBaseTime(PRTime prtime) {
 810   return base::Time::FromInternalValue(
 811       prtime + base::Time::UnixEpoch().ToInternalValue());
 812 }
 813
 814 PRTime BaseTimeToPRTime(base::Time time) {
 815   return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue();
 816 }
 817
 818 PK11SlotInfo* GetPublicNSSKeySlot() {
 819   return g_nss_singleton.Get().GetPublicNSSKeySlot();
 820 }
 821
 822 PK11SlotInfo* GetPrivateNSSKeySlot() {
 823   return g_nss_singleton.Get().GetPrivateNSSKeySlot();
 824 }
 825
 826 }  // namespace crypto