net/cert/nss_cert_database.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/nss_cert_database.h"
   6
   7 #include <cert.h>
   8 #include <certdb.h>
   9 #include <keyhi.h>
  10 #include <pk11pub.h>
  11 #include <secmod.h>
  12
  13 #include "base/bind.h"
  14 #include "base/callback.h"
  15 #include "base/logging.h"
  16 #include "base/memory/scoped_ptr.h"
  17 #include "base/observer_list_threadsafe.h"
  18 #include "base/task_runner.h"
  19 #include "base/task_runner_util.h"
  20 #include "base/threading/worker_pool.h"
  21 #include "crypto/scoped_nss_types.h"
  22 #include "net/base/crypto_module.h"
  23 #include "net/base/net_errors.h"
  24 #include "net/cert/cert_database.h"
  25 #include "net/cert/x509_certificate.h"
  26 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
  27 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
  28
  29 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
  30 // the new name of the macro.
  31 #if !defined(CERTDB_TERMINAL_RECORD)
  32 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER
  33 #endif
  34
  35 // PSM = Mozilla's Personal Security Manager.
  36 namespace psm = mozilla_security_manager;
  37
  38 namespace net {
  39
  40 namespace {
  41
  42 // TODO(pneubeck): Move this class out of NSSCertDatabase and to the caller of
  43 // the c'tor of NSSCertDatabase, see https://crbug.com/395983 .
  44 // Helper that observes events from the NSSCertDatabase and forwards them to
  45 // the given CertDatabase.
  46 class CertNotificationForwarder : public NSSCertDatabase::Observer {
  47  public:
  48   explicit CertNotificationForwarder(CertDatabase* cert_db)
  49       : cert_db_(cert_db) {}
  50
  51   virtual ~CertNotificationForwarder() {}
  52
  53   // NSSCertDatabase::Observer implementation:
  54   virtual void OnCertAdded(const X509Certificate* cert) OVERRIDE {
  55     cert_db_->NotifyObserversOfCertAdded(cert);
  56   }
  57
  58   virtual void OnCertRemoved(const X509Certificate* cert) OVERRIDE {
  59     cert_db_->NotifyObserversOfCertRemoved(cert);
  60   }
  61
  62   virtual void OnCACertChanged(const X509Certificate* cert) OVERRIDE {
  63     cert_db_->NotifyObserversOfCACertChanged(cert);
  64   }
  65
  66  private:
  67   CertDatabase* cert_db_;
  68
  69   DISALLOW_COPY_AND_ASSIGN(CertNotificationForwarder);
  70 };
  71
  72 }  // namespace
  73
  74 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
  75     const scoped_refptr<X509Certificate>& cert,
  76     int err)
  77     : certificate(cert), net_error(err) {}
  78
  79 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
  80
  81 NSSCertDatabase::NSSCertDatabase(crypto::ScopedPK11Slot public_slot,
  82                                  crypto::ScopedPK11Slot private_slot)
  83     : public_slot_(public_slot.Pass()),
  84       private_slot_(private_slot.Pass()),
  85       observer_list_(new ObserverListThreadSafe<Observer>),
  86       weak_factory_(this) {
  87   CHECK(public_slot_);
  88
  89   // This also makes sure that NSS has been initialized.
  90   CertDatabase* cert_db = CertDatabase::GetInstance();
  91   cert_notification_forwarder_.reset(new CertNotificationForwarder(cert_db));
  92   AddObserver(cert_notification_forwarder_.get());
  93
  94   psm::EnsurePKCS12Init();
  95 }
  96
  97 NSSCertDatabase::~NSSCertDatabase() {}
  98
  99 void NSSCertDatabase::ListCertsSync(CertificateList* certs) {
 100   ListCertsImpl(crypto::ScopedPK11Slot(), certs);
 101 }
 102
 103 void NSSCertDatabase::ListCerts(
 104     const base::Callback<void(scoped_ptr<CertificateList> certs)>& callback) {
 105   scoped_ptr<CertificateList> certs(new CertificateList());
 106
 107   // base::Passed will NULL out |certs|, so cache the underlying pointer here.
 108   CertificateList* raw_certs = certs.get();
 109   GetSlowTaskRunner()->PostTaskAndReply(
 110       FROM_HERE,
 111       base::Bind(&NSSCertDatabase::ListCertsImpl,
 112                  base::Passed(crypto::ScopedPK11Slot()),
 113                  base::Unretained(raw_certs)),
 114       base::Bind(callback, base::Passed(&certs)));
 115 }
 116
 117 void NSSCertDatabase::ListCertsInSlot(const ListCertsCallback& callback,
 118                                       PK11SlotInfo* slot) {
 119   DCHECK(slot);
 120   scoped_ptr<CertificateList> certs(new CertificateList());
 121
 122   // base::Passed will NULL out |certs|, so cache the underlying pointer here.
 123   CertificateList* raw_certs = certs.get();
 124   GetSlowTaskRunner()->PostTaskAndReply(
 125       FROM_HERE,
 126       base::Bind(&NSSCertDatabase::ListCertsImpl,
 127                  base::Passed(crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot))),
 128                  base::Unretained(raw_certs)),
 129       base::Bind(callback, base::Passed(&certs)));
 130 }
 131
 132 #if defined(OS_CHROMEOS)
 133 crypto::ScopedPK11Slot NSSCertDatabase::GetSystemSlot() const {
 134   return crypto::ScopedPK11Slot();
 135 }
 136 #endif
 137
 138 crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
 139   return crypto::ScopedPK11Slot(PK11_ReferenceSlot(public_slot_.get()));
 140 }
 141
 142 crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
 143   if (!private_slot_)
 144     return crypto::ScopedPK11Slot();
 145   return crypto::ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()));
 146 }
 147
 148 CryptoModule* NSSCertDatabase::GetPublicModule() const {
 149   crypto::ScopedPK11Slot slot(GetPublicSlot());
 150   return CryptoModule::CreateFromHandle(slot.get());
 151 }
 152
 153 CryptoModule* NSSCertDatabase::GetPrivateModule() const {
 154   crypto::ScopedPK11Slot slot(GetPrivateSlot());
 155   return CryptoModule::CreateFromHandle(slot.get());
 156 }
 157
 158 void NSSCertDatabase::ListModules(CryptoModuleList* modules,
 159                                   bool need_rw) const {
 160   modules->clear();
 161
 162   // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
 163   crypto::ScopedPK11SlotList slot_list(
 164       PK11_GetAllTokens(CKM_INVALID_MECHANISM,
 165                         need_rw ? PR_TRUE : PR_FALSE,  // needRW
 166                         PR_TRUE,                       // loadCerts (unused)
 167                         NULL));                        // wincx
 168   if (!slot_list) {
 169     LOG(ERROR) << "PK11_GetAllTokens failed: " << PORT_GetError();
 170     return;
 171   }
 172
 173   PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list.get());
 174   while (slot_element) {
 175     modules->push_back(CryptoModule::CreateFromHandle(slot_element->slot));
 176     slot_element = PK11_GetNextSafe(slot_list.get(), slot_element,
 177                                     PR_FALSE);  // restart
 178   }
 179 }
 180
 181 int NSSCertDatabase::ImportFromPKCS12(
 182     CryptoModule* module,
 183     const std::string& data,
 184     const base::string16& password,
 185     bool is_extractable,
 186     net::CertificateList* imported_certs) {
 187   DVLOG(1) << __func__ << " "
 188            << PK11_GetModuleID(module->os_module_handle()) << ":"
 189            << PK11_GetSlotID(module->os_module_handle());
 190   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
 191                                         data.data(), data.size(),
 192                                         password,
 193                                         is_extractable,
 194                                         imported_certs);
 195   if (result == net::OK)
 196     NotifyObserversOfCertAdded(NULL);
 197
 198   return result;
 199 }
 200
 201 int NSSCertDatabase::ExportToPKCS12(
 202     const CertificateList& certs,
 203     const base::string16& password,
 204     std::string* output) const {
 205   return psm::nsPKCS12Blob_Export(output, certs, password);
 206 }
 207
 208 X509Certificate* NSSCertDatabase::FindRootInList(
 209     const CertificateList& certificates) const {
 210   DCHECK_GT(certificates.size(), 0U);
 211
 212   if (certificates.size() == 1)
 213     return certificates[0].get();
 214
 215   X509Certificate* cert0 = certificates[0].get();
 216   X509Certificate* cert1 = certificates[1].get();
 217   X509Certificate* certn_2 = certificates[certificates.size() - 2].get();
 218   X509Certificate* certn_1 = certificates[certificates.size() - 1].get();
 219
 220   if (CERT_CompareName(&cert1->os_cert_handle()->issuer,
 221                        &cert0->os_cert_handle()->subject) == SECEqual)
 222     return cert0;
 223   if (CERT_CompareName(&certn_2->os_cert_handle()->issuer,
 224                        &certn_1->os_cert_handle()->subject) == SECEqual)
 225     return certn_1;
 226
 227   LOG(WARNING) << "certificate list is not a hierarchy";
 228   return cert0;
 229 }
 230
 231 bool NSSCertDatabase::ImportCACerts(const CertificateList& certificates,
 232                                     TrustBits trust_bits,
 233                                     ImportCertFailureList* not_imported) {
 234   crypto::ScopedPK11Slot slot(GetPublicSlot());
 235   X509Certificate* root = FindRootInList(certificates);
 236   bool success = psm::ImportCACerts(
 237       slot.get(), certificates, root, trust_bits, not_imported);
 238   if (success)
 239     NotifyObserversOfCACertChanged(NULL);
 240
 241   return success;
 242 }
 243
 244 bool NSSCertDatabase::ImportServerCert(const CertificateList& certificates,
 245                                        TrustBits trust_bits,
 246                                        ImportCertFailureList* not_imported) {
 247   crypto::ScopedPK11Slot slot(GetPublicSlot());
 248   return psm::ImportServerCert(
 249       slot.get(), certificates, trust_bits, not_imported);
 250 }
 251
 252 NSSCertDatabase::TrustBits NSSCertDatabase::GetCertTrust(
 253     const X509Certificate* cert,
 254     CertType type) const {
 255   CERTCertTrust trust;
 256   SECStatus srv = CERT_GetCertTrust(cert->os_cert_handle(), &trust);
 257   if (srv != SECSuccess) {
 258     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
 259     return TRUST_DEFAULT;
 260   }
 261   // We define our own more "friendly" TrustBits, which means we aren't able to
 262   // round-trip all possible NSS trust flag combinations.  We try to map them in
 263   // a sensible way.
 264   switch (type) {
 265     case CA_CERT: {
 266       const unsigned kTrustedCA = CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA;
 267       const unsigned kCAFlags = kTrustedCA | CERTDB_TERMINAL_RECORD;
 268
 269       TrustBits trust_bits = TRUST_DEFAULT;
 270       if ((trust.sslFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 271         trust_bits |= DISTRUSTED_SSL;
 272       else if (trust.sslFlags & kTrustedCA)
 273         trust_bits |= TRUSTED_SSL;
 274
 275       if ((trust.emailFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 276         trust_bits |= DISTRUSTED_EMAIL;
 277       else if (trust.emailFlags & kTrustedCA)
 278         trust_bits |= TRUSTED_EMAIL;
 279
 280       if ((trust.objectSigningFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 281         trust_bits |= DISTRUSTED_OBJ_SIGN;
 282       else if (trust.objectSigningFlags & kTrustedCA)
 283         trust_bits |= TRUSTED_OBJ_SIGN;
 284
 285       return trust_bits;
 286     }
 287     case SERVER_CERT:
 288       if (trust.sslFlags & CERTDB_TERMINAL_RECORD) {
 289         if (trust.sslFlags & CERTDB_TRUSTED)
 290           return TRUSTED_SSL;
 291         return DISTRUSTED_SSL;
 292       }
 293       return TRUST_DEFAULT;
 294     default:
 295       return TRUST_DEFAULT;
 296   }
 297 }
 298
 299 bool NSSCertDatabase::IsUntrusted(const X509Certificate* cert) const {
 300   CERTCertTrust nsstrust;
 301   SECStatus rv = CERT_GetCertTrust(cert->os_cert_handle(), &nsstrust);
 302   if (rv != SECSuccess) {
 303     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
 304     return false;
 305   }
 306
 307   // The CERTCertTrust structure contains three trust records:
 308   // sslFlags, emailFlags, and objectSigningFlags.  The three
 309   // trust records are independent of each other.
 310   //
 311   // If the CERTDB_TERMINAL_RECORD bit in a trust record is set,
 312   // then that trust record is a terminal record.  A terminal
 313   // record is used for explicit trust and distrust of an
 314   // end-entity or intermediate CA cert.
 315   //
 316   // In a terminal record, if neither CERTDB_TRUSTED_CA nor
 317   // CERTDB_TRUSTED is set, then the terminal record means
 318   // explicit distrust.  On the other hand, if the terminal
 319   // record has either CERTDB_TRUSTED_CA or CERTDB_TRUSTED bit
 320   // set, then the terminal record means explicit trust.
 321   //
 322   // For a root CA, the trust record does not have
 323   // the CERTDB_TERMINAL_RECORD bit set.
 324
 325   static const unsigned int kTrusted = CERTDB_TRUSTED_CA | CERTDB_TRUSTED;
 326   if ((nsstrust.sslFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 327       (nsstrust.sslFlags & kTrusted) == 0) {
 328     return true;
 329   }
 330   if ((nsstrust.emailFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 331       (nsstrust.emailFlags & kTrusted) == 0) {
 332     return true;
 333   }
 334   if ((nsstrust.objectSigningFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 335       (nsstrust.objectSigningFlags & kTrusted) == 0) {
 336     return true;
 337   }
 338
 339   // Self-signed certificates that don't have any trust bits set are untrusted.
 340   // Other certificates that don't have any trust bits set may still be trusted
 341   // if they chain up to a trust anchor.
 342   if (CERT_CompareName(&cert->os_cert_handle()->issuer,
 343                        &cert->os_cert_handle()->subject) == SECEqual) {
 344     return (nsstrust.sslFlags & kTrusted) == 0 &&
 345            (nsstrust.emailFlags & kTrusted) == 0 &&
 346            (nsstrust.objectSigningFlags & kTrusted) == 0;
 347   }
 348
 349   return false;
 350 }
 351
 352 bool NSSCertDatabase::SetCertTrust(const X509Certificate* cert,
 353                                 CertType type,
 354                                 TrustBits trust_bits) {
 355   bool success = psm::SetCertTrust(cert, type, trust_bits);
 356   if (success)
 357     NotifyObserversOfCACertChanged(cert);
 358
 359   return success;
 360 }
 361
 362 bool NSSCertDatabase::DeleteCertAndKey(X509Certificate* cert) {
 363   if (!DeleteCertAndKeyImpl(cert))
 364     return false;
 365   NotifyObserversOfCertRemoved(cert);
 366   return true;
 367 }
 368
 369 void NSSCertDatabase::DeleteCertAndKeyAsync(
 370     const scoped_refptr<X509Certificate>& cert,
 371     const DeleteCertCallback& callback) {
 372   base::PostTaskAndReplyWithResult(
 373       GetSlowTaskRunner().get(),
 374       FROM_HERE,
 375       base::Bind(&NSSCertDatabase::DeleteCertAndKeyImpl, cert),
 376       base::Bind(&NSSCertDatabase::NotifyCertRemovalAndCallBack,
 377                  weak_factory_.GetWeakPtr(),
 378                  cert,
 379                  callback));
 380 }
 381
 382 bool NSSCertDatabase::IsReadOnly(const X509Certificate* cert) const {
 383   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
 384   return slot && PK11_IsReadOnly(slot);
 385 }
 386
 387 bool NSSCertDatabase::IsHardwareBacked(const X509Certificate* cert) const {
 388   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
 389   return slot && PK11_IsHW(slot);
 390 }
 391
 392 void NSSCertDatabase::AddObserver(Observer* observer) {
 393   observer_list_->AddObserver(observer);
 394 }
 395
 396 void NSSCertDatabase::RemoveObserver(Observer* observer) {
 397   observer_list_->RemoveObserver(observer);
 398 }
 399
 400 void NSSCertDatabase::SetSlowTaskRunnerForTest(
 401     const scoped_refptr<base::TaskRunner>& task_runner) {
 402   slow_task_runner_for_test_ = task_runner;
 403 }
 404
 405 // static
 406 void NSSCertDatabase::ListCertsImpl(crypto::ScopedPK11Slot slot,
 407                                     CertificateList* certs) {
 408   certs->clear();
 409
 410   CERTCertList* cert_list = NULL;
 411   if (slot)
 412     cert_list = PK11_ListCertsInSlot(slot.get());
 413   else
 414     cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
 415
 416   CERTCertListNode* node;
 417   for (node = CERT_LIST_HEAD(cert_list); !CERT_LIST_END(node, cert_list);
 418        node = CERT_LIST_NEXT(node)) {
 419     certs->push_back(X509Certificate::CreateFromHandle(
 420         node->cert, X509Certificate::OSCertHandles()));
 421   }
 422   CERT_DestroyCertList(cert_list);
 423 }
 424
 425 scoped_refptr<base::TaskRunner> NSSCertDatabase::GetSlowTaskRunner() const {
 426   if (slow_task_runner_for_test_.get())
 427     return slow_task_runner_for_test_;
 428   return base::WorkerPool::GetTaskRunner(true /*task is slow*/);
 429 }
 430
 431 void NSSCertDatabase::NotifyCertRemovalAndCallBack(
 432     scoped_refptr<X509Certificate> cert,
 433     const DeleteCertCallback& callback,
 434     bool success) {
 435   if (success)
 436     NotifyObserversOfCertRemoved(cert.get());
 437   callback.Run(success);
 438 }
 439
 440 void NSSCertDatabase::NotifyObserversOfCertAdded(const X509Certificate* cert) {
 441   observer_list_->Notify(&Observer::OnCertAdded, make_scoped_refptr(cert));
 442 }
 443
 444 void NSSCertDatabase::NotifyObserversOfCertRemoved(
 445     const X509Certificate* cert) {
 446   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 447 }
 448
 449 void NSSCertDatabase::NotifyObserversOfCACertChanged(
 450     const X509Certificate* cert) {
 451   observer_list_->Notify(
 452       &Observer::OnCACertChanged, make_scoped_refptr(cert));
 453 }
 454
 455 // static
 456 bool NSSCertDatabase::DeleteCertAndKeyImpl(
 457     scoped_refptr<X509Certificate> cert) {
 458   // For some reason, PK11_DeleteTokenCertAndKey only calls
 459   // SEC_DeletePermCertificate if the private key is found.  So, we check
 460   // whether a private key exists before deciding which function to call to
 461   // delete the cert.
 462   SECKEYPrivateKey* privKey =
 463       PK11_FindKeyByAnyCert(cert->os_cert_handle(), NULL);
 464   if (privKey) {
 465     SECKEY_DestroyPrivateKey(privKey);
 466     if (PK11_DeleteTokenCertAndKey(cert->os_cert_handle(), NULL)) {
 467       LOG(ERROR) << "PK11_DeleteTokenCertAndKey failed: " << PORT_GetError();
 468       return false;
 469     }
 470   } else {
 471     if (SEC_DeletePermCertificate(cert->os_cert_handle())) {
 472       LOG(ERROR) << "SEC_DeletePermCertificate failed: " << PORT_GetError();
 473       return false;
 474     }
 475   }
 476   return true;
 477 }
 478
 479 }  // namespace net