1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "crypto/nss_util.h"
6 #include "crypto/nss_util_internal.h"
17 #include <linux/nfs_fs.h>
23 #include "base/environment.h"
24 #include "base/file_path.h"
25 #include "base/file_util.h"
26 #include "base/lazy_instance.h"
27 #include "base/logging.h"
28 #include "base/memory/scoped_ptr.h"
29 #include "base/native_library.h"
30 #include "base/stringprintf.h"
31 #include "base/threading/thread_restrictions.h"
32 #include "crypto/scoped_nss_types.h"
34 // USE_NSS means we use NSS for everything crypto-related. If USE_NSS is not
35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
36 // use NSS for crypto or certificate verification, and we don't use the NSS
37 // certificate and key databases.
39 #include "base/synchronization/lock.h"
40 #include "crypto/crypto_module_blocking_password_delegate.h"
41 #endif // defined(USE_NSS)
47 #if defined(OS_CHROMEOS)
48 const char kNSSDatabaseName
[] = "Real NSS database";
50 // Constants for loading opencryptoki.
51 const char kOpencryptokiModuleName
[] = "opencryptoki";
52 const char kOpencryptokiPath
[] = "/usr/lib/opencryptoki/libopencryptoki.so";
54 // Fake certificate authority database used for testing.
55 static const FilePath::CharType kReadOnlyCertDB
[] =
56 FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb");
57 #endif // defined(OS_CHROMEOS)
59 std::string
GetNSSErrorMessage() {
61 if (PR_GetErrorTextLength()) {
62 scoped_array
<char> error_text(new char[PR_GetErrorTextLength() + 1]);
63 PRInt32 copied
= PR_GetErrorText(error_text
.get());
64 result
= std::string(error_text
.get(), copied
);
66 result
= StringPrintf("NSS error code: %d", PR_GetError());
72 FilePath
GetDefaultConfigDirectory() {
73 FilePath dir
= file_util::GetHomeDir();
75 LOG(ERROR
) << "Failed to get home directory.";
78 dir
= dir
.AppendASCII(".pki").AppendASCII("nssdb");
79 if (!file_util::CreateDirectory(dir
)) {
80 LOG(ERROR
) << "Failed to create " << dir
.value() << " directory.";
86 // On non-chromeos platforms, return the default config directory.
87 // On chromeos, return a read-only directory with fake root CA certs for testing
88 // (which will not exist on non-testing images). These root CA certs are used
89 // by the local Google Accounts server mock we use when testing our login code.
90 // If this directory is not present, NSS_Init() will fail. It is up to the
91 // caller to failover to NSS_NoDB_Init() at that point.
92 FilePath
GetInitialConfigDirectory() {
93 #if defined(OS_CHROMEOS)
94 return FilePath(kReadOnlyCertDB
);
96 return GetDefaultConfigDirectory();
97 #endif // defined(OS_CHROMEOS)
100 // This callback for NSS forwards all requests to a caller-specified
101 // CryptoModuleBlockingPasswordDelegate object.
102 char* PKCS11PasswordFunc(PK11SlotInfo
* slot
, PRBool retry
, void* arg
) {
103 #if defined(OS_CHROMEOS)
104 // If we get asked for a password for the TPM, then return the
105 // well known password we use, as long as the TPM slot has been
107 if (crypto::IsTPMTokenReady()) {
108 std::string token_name
;
109 std::string user_pin
;
110 crypto::GetTPMTokenInfo(&token_name
, &user_pin
);
111 if (PK11_GetTokenName(slot
) == token_name
)
112 return PORT_Strdup(user_pin
.c_str());
115 crypto::CryptoModuleBlockingPasswordDelegate
* delegate
=
116 reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate
*>(arg
);
118 bool cancelled
= false;
119 std::string password
= delegate
->RequestPassword(PK11_GetTokenName(slot
),
124 char* result
= PORT_Strdup(password
.c_str());
125 password
.replace(0, password
.size(), password
.size(), 0);
128 DLOG(ERROR
) << "PK11 password requested with NULL arg";
132 // NSS creates a local cache of the sqlite database if it detects that the
133 // filesystem the database is on is much slower than the local disk. The
134 // detection doesn't work with the latest versions of sqlite, such as 3.6.22
135 // (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561). So we set
136 // the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's
137 // detection when database_dir is on NFS. See http://crbug.com/48585.
139 // TODO(wtc): port this function to other USE_NSS platforms. It is defined
140 // only for OS_LINUX simply because the statfs structure is OS-specific.
142 // Because this function sets an environment variable it must be run before we
143 // go multi-threaded.
144 void UseLocalCacheOfNSSDatabaseIfNFS(const FilePath
& database_dir
) {
145 #if defined(OS_LINUX)
147 if (statfs(database_dir
.value().c_str(), &buf
) == 0) {
148 if (buf
.f_type
== NFS_SUPER_MAGIC
) {
149 scoped_ptr
<base::Environment
> env(base::Environment::Create());
150 const char* use_cache_env_var
= "NSS_SDB_USE_CACHE";
151 if (!env
->HasVar(use_cache_env_var
))
152 env
->SetVar(use_cache_env_var
, "yes");
155 #endif // defined(OS_LINUX)
158 PK11SlotInfo
* FindSlotWithTokenName(const std::string
& token_name
) {
159 AutoSECMODListReadLock auto_lock
;
160 SECMODModuleList
* head
= SECMOD_GetDefaultModuleList();
161 for (SECMODModuleList
* item
= head
; item
!= NULL
; item
= item
->next
) {
162 int slot_count
= item
->module
->loaded
? item
->module
->slotCount
: 0;
163 for (int i
= 0; i
< slot_count
; i
++) {
164 PK11SlotInfo
* slot
= item
->module
->slots
[i
];
165 if (PK11_GetTokenName(slot
) == token_name
)
166 return PK11_ReferenceSlot(slot
);
172 #endif // defined(USE_NSS)
174 // A singleton to initialize/deinitialize NSPR.
175 // Separate from the NSS singleton because we initialize NSPR on the UI thread.
176 // Now that we're leaking the singleton, we could merge back with the NSS
178 class NSPRInitSingleton
{
180 friend struct base::DefaultLazyInstanceTraits
<NSPRInitSingleton
>;
182 NSPRInitSingleton() {
183 PR_Init(PR_USER_THREAD
, PR_PRIORITY_NORMAL
, 0);
186 // NOTE(willchan): We don't actually execute this code since we leak NSS to
187 // prevent non-joinable threads from using NSS after it's already been shut
189 ~NSPRInitSingleton() {
191 PRStatus prstatus
= PR_Cleanup();
192 if (prstatus
!= PR_SUCCESS
) {
193 LOG(ERROR
) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
198 base::LazyInstance
<NSPRInitSingleton
,
199 base::LeakyLazyInstanceTraits
<NSPRInitSingleton
> >
200 g_nspr_singleton(base::LINKER_INITIALIZED
);
202 class NSSInitSingleton
{
204 #if defined(OS_CHROMEOS)
205 void OpenPersistentNSSDB() {
206 if (!chromeos_user_logged_in_
) {
207 // GetDefaultConfigDirectory causes us to do blocking IO on UI thread.
208 // Temporarily allow it until we fix http://crbug.com/70119
209 base::ThreadRestrictions::ScopedAllowIO allow_io
;
210 chromeos_user_logged_in_
= true;
212 // This creates another DB slot in NSS that is read/write, unlike
213 // the fake root CA cert DB and the "default" crypto key
214 // provider, which are still read-only (because we initialized
215 // NSS before we had a cryptohome mounted).
216 software_slot_
= OpenUserDB(GetDefaultConfigDirectory(),
221 void EnableTPMTokenForNSS(TPMTokenInfoDelegate
* info_delegate
) {
222 CHECK(info_delegate
);
223 tpm_token_info_delegate_
.reset(info_delegate
);
224 // Try to load once to avoid jank later. Ignore the return value,
225 // because if it fails we will try again later.
226 EnsureTPMTokenReady();
229 // This is called whenever we want to make sure opencryptoki is
230 // properly loaded, because it can fail shortly after the initial
231 // login while the PINs are being initialized, and we want to retry
233 bool EnsureTPMTokenReady() {
234 // If EnableTPMTokenForNSS hasn't been called, return false.
235 if (tpm_token_info_delegate_
.get() == NULL
)
238 // If everything is already initialized, then return true.
239 if (opencryptoki_module_
&& tpm_slot_
)
242 if (tpm_token_info_delegate_
->IsTokenReady()) {
243 // This tries to load the opencryptoki module so NSS can talk to
245 if (!opencryptoki_module_
) {
246 opencryptoki_module_
= LoadModule(
247 kOpencryptokiModuleName
,
249 // trustOrder=100 -- means it'll select this as the most
250 // trusted slot for the mechanisms it provides.
251 // slotParams=... -- selects RSA as the only mechanism, and only
252 // asks for the password when necessary (instead of every
253 // time, or after a timeout).
254 "trustOrder=100 slotParams=(1={slotFlags=[RSA] askpw=only})");
256 if (opencryptoki_module_
) {
257 // If this gets set, then we'll use the TPM for certs with
258 // private keys, otherwise we'll fall back to the software
260 tpm_slot_
= GetTPMSlot();
261 return tpm_slot_
!= NULL
;
267 bool IsTPMTokenAvailable() {
268 if (tpm_token_info_delegate_
.get() == NULL
)
270 return tpm_token_info_delegate_
->IsTokenAvailable();
273 void GetTPMTokenInfo(std::string
* token_name
, std::string
* user_pin
) {
274 if (tpm_token_info_delegate_
.get() == NULL
) {
275 LOG(ERROR
) << "GetTPMTokenInfo called before TPM Token is ready.";
278 tpm_token_info_delegate_
->GetTokenInfo(token_name
, user_pin
);
281 bool IsTPMTokenReady() {
282 return tpm_slot_
!= NULL
;
285 PK11SlotInfo
* GetTPMSlot() {
286 std::string token_name
;
287 GetTPMTokenInfo(&token_name
, NULL
);
288 return FindSlotWithTokenName(token_name
);
291 #endif // defined(OS_CHROMEOS)
294 bool OpenTestNSSDB(const FilePath
& path
, const char* description
) {
295 test_slot_
= OpenUserDB(path
, description
);
299 void CloseTestNSSDB() {
301 SECStatus status
= SECMOD_CloseUserDB(test_slot_
);
302 if (status
!= SECSuccess
)
303 LOG(ERROR
) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
304 PK11_FreeSlot(test_slot_
);
309 PK11SlotInfo
* GetPublicNSSKeySlot() {
311 return PK11_ReferenceSlot(test_slot_
);
313 return PK11_ReferenceSlot(software_slot_
);
314 return PK11_GetInternalKeySlot();
317 PK11SlotInfo
* GetPrivateNSSKeySlot() {
319 return PK11_ReferenceSlot(test_slot_
);
321 #if defined(OS_CHROMEOS)
322 // Make sure that if EnableTPMTokenForNSS has been called that we
323 // have successfully loaded opencryptoki.
324 if (tpm_token_info_delegate_
.get() != NULL
) {
325 if (EnsureTPMTokenReady()) {
326 return PK11_ReferenceSlot(tpm_slot_
);
328 // If we were supposed to get the hardware token, but were
329 // unable to, return NULL rather than fall back to sofware.
334 // If we weren't supposed to enable the TPM for NSS, then return
335 // the software slot.
337 return PK11_ReferenceSlot(software_slot_
);
338 return PK11_GetInternalKeySlot();
342 base::Lock
* write_lock() {
345 #endif // defined(USE_NSS)
347 // This method is used to force NSS to be initialized without a DB.
348 // Call this method before NSSInitSingleton() is constructed.
349 static void ForceNoDBInit() {
350 force_nodb_init_
= true;
354 friend struct base::DefaultLazyInstanceTraits
<NSSInitSingleton
>;
357 : opencryptoki_module_(NULL
),
358 software_slot_(NULL
),
362 chromeos_user_logged_in_(false) {
365 // We *must* have NSS >= 3.12.3. See bug 26448.
367 (NSS_VMAJOR
== 3 && NSS_VMINOR
== 12 && NSS_VPATCH
>= 3) ||
368 (NSS_VMAJOR
== 3 && NSS_VMINOR
> 12) ||
370 nss_version_check_failed
);
371 // Also check the run-time NSS version.
372 // NSS_VersionCheck is a >= check, not strict equality.
373 if (!NSS_VersionCheck("3.12.3")) {
374 // It turns out many people have misconfigured NSS setups, where
375 // their run-time NSPR doesn't match the one their NSS was compiled
376 // against. So rather than aborting, complain loudly.
377 LOG(ERROR
) << "NSS_VersionCheck(\"3.12.3\") failed. "
378 "We depend on NSS >= 3.12.3, and this error is not fatal "
379 "only because many people have busted NSS setups (for "
380 "example, using the wrong version of NSPR). "
381 "Please upgrade to the latest NSS and NSPR, and if you "
382 "still get this error, contact your distribution "
386 SECStatus status
= SECFailure
;
387 bool nodb_init
= force_nodb_init_
;
389 #if !defined(USE_NSS)
390 // Use the system certificate store, so initialize NSS without database.
395 status
= NSS_NoDB_Init(NULL
);
396 if (status
!= SECSuccess
) {
397 LOG(ERROR
) << "Error initializing NSS without a persistent "
398 "database: " << GetNSSErrorMessage();
402 FilePath database_dir
= GetInitialConfigDirectory();
403 if (!database_dir
.empty()) {
404 // This duplicates the work which should have been done in
405 // EarlySetupForNSSInit. However, this function is idempotent so
406 // there's no harm done.
407 UseLocalCacheOfNSSDatabaseIfNFS(database_dir
);
409 // Initialize with a persistent database (likely, ~/.pki/nssdb).
410 // Use "sql:" which can be shared by multiple processes safely.
411 std::string nss_config_dir
=
412 StringPrintf("sql:%s", database_dir
.value().c_str());
413 #if defined(OS_CHROMEOS)
414 status
= NSS_Init(nss_config_dir
.c_str());
416 status
= NSS_InitReadWrite(nss_config_dir
.c_str());
418 if (status
!= SECSuccess
) {
419 LOG(ERROR
) << "Error initializing NSS with a persistent "
420 "database (" << nss_config_dir
421 << "): " << GetNSSErrorMessage();
424 if (status
!= SECSuccess
) {
425 VLOG(1) << "Initializing NSS without a persistent database.";
426 status
= NSS_NoDB_Init(NULL
);
427 if (status
!= SECSuccess
) {
428 LOG(ERROR
) << "Error initializing NSS without a persistent "
429 "database: " << GetNSSErrorMessage();
434 PK11_SetPasswordFunc(PKCS11PasswordFunc
);
436 // If we haven't initialized the password for the NSS databases,
437 // initialize an empty-string password so that we don't need to
439 PK11SlotInfo
* slot
= PK11_GetInternalKeySlot();
441 // PK11_InitPin may write to the keyDB, but no other thread can use NSS
442 // yet, so we don't need to lock.
443 if (PK11_NeedUserInit(slot
))
444 PK11_InitPin(slot
, NULL
, NULL
);
448 root_
= InitDefaultRootCerts();
449 #endif // defined(USE_NSS)
453 // NOTE(willchan): We don't actually execute this code since we leak NSS to
454 // prevent non-joinable threads from using NSS after it's already been shut
456 ~NSSInitSingleton() {
458 PK11_FreeSlot(tpm_slot_
);
461 if (software_slot_
) {
462 SECMOD_CloseUserDB(software_slot_
);
463 PK11_FreeSlot(software_slot_
);
464 software_slot_
= NULL
;
468 SECMOD_UnloadUserModule(root_
);
469 SECMOD_DestroyModule(root_
);
472 if (opencryptoki_module_
) {
473 SECMOD_UnloadUserModule(opencryptoki_module_
);
474 SECMOD_DestroyModule(opencryptoki_module_
);
475 opencryptoki_module_
= NULL
;
478 SECStatus status
= NSS_Shutdown();
479 if (status
!= SECSuccess
) {
480 // We VLOG(1) because this failure is relatively harmless (leaking, but
481 // we're shutting down anyway).
482 VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609";
487 // Load nss's built-in root certs.
488 SECMODModule
* InitDefaultRootCerts() {
489 SECMODModule
* root
= LoadModule("Root Certs", "libnssckbi.so", NULL
);
493 // Aw, snap. Can't find/load root cert shared library.
494 // This will make it hard to talk to anybody via https.
499 // Load the given module for this NSS session.
500 SECMODModule
* LoadModule(const char* name
,
501 const char* library_path
,
502 const char* params
) {
503 std::string modparams
= StringPrintf(
504 "name=\"%s\" library=\"%s\" %s",
505 name
, library_path
, params
? params
: "");
507 // Shouldn't need to const_cast here, but SECMOD doesn't properly
508 // declare input string arguments as const. Bug
509 // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed
510 // on NSS codebase to address this.
511 SECMODModule
* module
= SECMOD_LoadUserModule(
512 const_cast<char*>(modparams
.c_str()), NULL
, PR_FALSE
);
514 LOG(ERROR
) << "Error loading " << name
<< " module into NSS: "
515 << GetNSSErrorMessage();
522 static PK11SlotInfo
* OpenUserDB(const FilePath
& path
,
523 const char* description
) {
524 const std::string modspec
=
525 StringPrintf("configDir='sql:%s' tokenDescription='%s'",
526 path
.value().c_str(), description
);
527 PK11SlotInfo
* db_slot
= SECMOD_OpenUserDB(modspec
.c_str());
529 if (PK11_NeedUserInit(db_slot
))
530 PK11_InitPin(db_slot
, NULL
, NULL
);
533 LOG(ERROR
) << "Error opening persistent database (" << modspec
534 << "): " << GetNSSErrorMessage();
539 // If this is set to true NSS is forced to be initialized without a DB.
540 static bool force_nodb_init_
;
542 #if defined(OS_CHROMEOS)
543 scoped_ptr
<TPMTokenInfoDelegate
> tpm_token_info_delegate_
;
546 SECMODModule
* opencryptoki_module_
;
547 PK11SlotInfo
* software_slot_
;
548 PK11SlotInfo
* test_slot_
;
549 PK11SlotInfo
* tpm_slot_
;
551 bool chromeos_user_logged_in_
;
553 // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
554 // is fixed, we will no longer need the lock.
555 base::Lock write_lock_
;
556 #endif // defined(USE_NSS)
560 bool NSSInitSingleton::force_nodb_init_
= false;
562 base::LazyInstance
<NSSInitSingleton
,
563 base::LeakyLazyInstanceTraits
<NSSInitSingleton
> >
564 g_nss_singleton(base::LINKER_INITIALIZED
);
569 void EarlySetupForNSSInit() {
570 FilePath database_dir
= GetInitialConfigDirectory();
571 if (!database_dir
.empty())
572 UseLocalCacheOfNSSDatabaseIfNFS(database_dir
);
576 void EnsureNSPRInit() {
577 g_nspr_singleton
.Get();
580 void EnsureNSSInit() {
581 // Initializing SSL causes us to do blocking IO.
582 // Temporarily allow it until we fix
583 // http://code.google.com/p/chromium/issues/detail?id=59847
584 base::ThreadRestrictions::ScopedAllowIO allow_io
;
585 g_nss_singleton
.Get();
588 void ForceNSSNoDBInit() {
589 NSSInitSingleton::ForceNoDBInit();
592 void DisableNSSForkCheck() {
593 scoped_ptr
<base::Environment
> env(base::Environment::Create());
594 env
->SetVar("NSS_STRICT_NOFORK", "DISABLED");
597 void LoadNSSLibraries() {
598 // Some NSS libraries are linked dynamically so load them here.
600 // Try to search for multiple directories to load the libraries.
601 std::vector
<FilePath
> paths
;
603 // Use relative path to Search PATH for the library files.
604 paths
.push_back(FilePath());
606 // For Debian derivaties NSS libraries are located here.
607 paths
.push_back(FilePath("/usr/lib/nss"));
609 // A list of library files to load.
610 std::vector
<std::string
> libs
;
611 libs
.push_back("libsoftokn3.so");
612 libs
.push_back("libfreebl3.so");
614 // For each combination of library file and path, check for existence and
617 for (size_t i
= 0; i
< libs
.size(); ++i
) {
618 for (size_t j
= 0; j
< paths
.size(); ++j
) {
619 FilePath path
= paths
[j
].Append(libs
[i
]);
620 base::NativeLibrary lib
= base::LoadNativeLibrary(path
, NULL
);
628 if (loaded
== libs
.size()) {
629 VLOG(3) << "NSS libraries loaded.";
631 LOG(WARNING
) << "Failed to load NSS libraries.";
636 bool CheckNSSVersion(const char* version
) {
637 return !!NSS_VersionCheck(version
);
641 bool OpenTestNSSDB(const FilePath
& path
, const char* description
) {
642 return g_nss_singleton
.Get().OpenTestNSSDB(path
, description
);
645 void CloseTestNSSDB() {
646 g_nss_singleton
.Get().CloseTestNSSDB();
649 base::Lock
* GetNSSWriteLock() {
650 return g_nss_singleton
.Get().write_lock();
653 AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) {
654 // May be NULL if the lock is not needed in our version of NSS.
659 AutoNSSWriteLock::~AutoNSSWriteLock() {
661 lock_
->AssertAcquired();
666 AutoSECMODListReadLock::AutoSECMODListReadLock()
667 : lock_(SECMOD_GetDefaultModuleListLock()) {
668 SECMOD_GetReadLock(lock_
);
671 AutoSECMODListReadLock::~AutoSECMODListReadLock() {
672 SECMOD_ReleaseReadLock(lock_
);
675 #endif // defined(USE_NSS)
677 #if defined(OS_CHROMEOS)
678 void OpenPersistentNSSDB() {
679 g_nss_singleton
.Get().OpenPersistentNSSDB();
682 TPMTokenInfoDelegate::TPMTokenInfoDelegate() {}
683 TPMTokenInfoDelegate::~TPMTokenInfoDelegate() {}
685 void EnableTPMTokenForNSS(TPMTokenInfoDelegate
* info_delegate
) {
686 g_nss_singleton
.Get().EnableTPMTokenForNSS(info_delegate
);
689 void GetTPMTokenInfo(std::string
* token_name
, std::string
* user_pin
) {
690 g_nss_singleton
.Get().GetTPMTokenInfo(token_name
, user_pin
);
693 bool IsTPMTokenAvailable() {
694 return g_nss_singleton
.Get().IsTPMTokenAvailable();
697 bool IsTPMTokenReady() {
698 return g_nss_singleton
.Get().IsTPMTokenReady();
701 bool EnsureTPMTokenReady() {
702 return g_nss_singleton
.Get().EnsureTPMTokenReady();
705 #endif // defined(OS_CHROMEOS)
707 // TODO(port): Implement this more simply. We can convert by subtracting an
708 // offset (the difference between NSPR's and base::Time's epochs).
709 base::Time
PRTimeToBaseTime(PRTime prtime
) {
710 PRExplodedTime prxtime
;
711 PR_ExplodeTime(prtime
, PR_GMTParameters
, &prxtime
);
713 base::Time::Exploded exploded
;
714 exploded
.year
= prxtime
.tm_year
;
715 exploded
.month
= prxtime
.tm_month
+ 1;
716 exploded
.day_of_week
= prxtime
.tm_wday
;
717 exploded
.day_of_month
= prxtime
.tm_mday
;
718 exploded
.hour
= prxtime
.tm_hour
;
719 exploded
.minute
= prxtime
.tm_min
;
720 exploded
.second
= prxtime
.tm_sec
;
721 exploded
.millisecond
= prxtime
.tm_usec
/ 1000;
723 return base::Time::FromUTCExploded(exploded
);
726 PK11SlotInfo
* GetPublicNSSKeySlot() {
727 return g_nss_singleton
.Get().GetPublicNSSKeySlot();
730 PK11SlotInfo
* GetPrivateNSSKeySlot() {
731 return g_nss_singleton
.Get().GetPrivateNSSKeySlot();
734 } // namespace crypto