crypto/nss_util.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "crypto/nss_util.h"
   6 #include "crypto/nss_util_internal.h"
   7
   8 #include <nss.h>
   9 #include <plarena.h>
  10 #include <prerror.h>
  11 #include <prinit.h>
  12 #include <prtime.h>
  13 #include <pk11pub.h>
  14 #include <secmod.h>
  15
  16 #if defined(OS_LINUX)
  17 #include <linux/nfs_fs.h>
  18 #include <sys/vfs.h>
  19 #endif
  20
  21 #include <vector>
  22
  23 #include "base/environment.h"
  24 #include "base/file_path.h"
  25 #include "base/file_util.h"
  26 #include "base/lazy_instance.h"
  27 #include "base/logging.h"
  28 #include "base/memory/scoped_ptr.h"
  29 #include "base/native_library.h"
  30 #include "base/stringprintf.h"
  31 #include "base/threading/thread_restrictions.h"
  32 #include "crypto/scoped_nss_types.h"
  33
  34 // USE_NSS means we use NSS for everything crypto-related.  If USE_NSS is not
  35 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
  36 // use NSS for crypto or certificate verification, and we don't use the NSS
  37 // certificate and key databases.
  38 #if defined(USE_NSS)
  39 #include "base/synchronization/lock.h"
  40 #include "crypto/crypto_module_blocking_password_delegate.h"
  41 #endif  // defined(USE_NSS)
  42
  43 namespace crypto {
  44
  45 namespace {
  46
  47 #if defined(OS_CHROMEOS)
  48 const char kNSSDatabaseName[] = "Real NSS database";
  49
  50 // Constants for loading opencryptoki.
  51 const char kOpencryptokiModuleName[] = "opencryptoki";
  52 const char kOpencryptokiPath[] = "/usr/lib/opencryptoki/libopencryptoki.so";
  53
  54 // Fake certificate authority database used for testing.
  55 static const FilePath::CharType kReadOnlyCertDB[] =
  56     FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb");
  57 #endif  // defined(OS_CHROMEOS)
  58
  59 std::string GetNSSErrorMessage() {
  60   std::string result;
  61   if (PR_GetErrorTextLength()) {
  62     scoped_array<char> error_text(new char[PR_GetErrorTextLength() + 1]);
  63     PRInt32 copied = PR_GetErrorText(error_text.get());
  64     result = std::string(error_text.get(), copied);
  65   } else {
  66     result = StringPrintf("NSS error code: %d", PR_GetError());
  67   }
  68   return result;
  69 }
  70
  71 #if defined(USE_NSS)
  72 FilePath GetDefaultConfigDirectory() {
  73   FilePath dir = file_util::GetHomeDir();
  74   if (dir.empty()) {
  75     LOG(ERROR) << "Failed to get home directory.";
  76     return dir;
  77   }
  78   dir = dir.AppendASCII(".pki").AppendASCII("nssdb");
  79   if (!file_util::CreateDirectory(dir)) {
  80     LOG(ERROR) << "Failed to create " << dir.value() << " directory.";
  81     dir.clear();
  82   }
  83   return dir;
  84 }
  85
  86 // On non-chromeos platforms, return the default config directory.
  87 // On chromeos, return a read-only directory with fake root CA certs for testing
  88 // (which will not exist on non-testing images).  These root CA certs are used
  89 // by the local Google Accounts server mock we use when testing our login code.
  90 // If this directory is not present, NSS_Init() will fail.  It is up to the
  91 // caller to failover to NSS_NoDB_Init() at that point.
  92 FilePath GetInitialConfigDirectory() {
  93 #if defined(OS_CHROMEOS)
  94   return FilePath(kReadOnlyCertDB);
  95 #else
  96   return GetDefaultConfigDirectory();
  97 #endif  // defined(OS_CHROMEOS)
  98 }
  99
 100 // This callback for NSS forwards all requests to a caller-specified
 101 // CryptoModuleBlockingPasswordDelegate object.
 102 char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) {
 103 #if defined(OS_CHROMEOS)
 104   // If we get asked for a password for the TPM, then return the
 105   // well known password we use, as long as the TPM slot has been
 106   // initialized.
 107   if (crypto::IsTPMTokenReady()) {
 108     std::string token_name;
 109     std::string user_pin;
 110     crypto::GetTPMTokenInfo(&token_name, &user_pin);
 111     if (PK11_GetTokenName(slot) == token_name)
 112       return PORT_Strdup(user_pin.c_str());
 113   }
 114 #endif
 115   crypto::CryptoModuleBlockingPasswordDelegate* delegate =
 116       reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg);
 117   if (delegate) {
 118     bool cancelled = false;
 119     std::string password = delegate->RequestPassword(PK11_GetTokenName(slot),
 120                                                      retry != PR_FALSE,
 121                                                      &cancelled);
 122     if (cancelled)
 123       return NULL;
 124     char* result = PORT_Strdup(password.c_str());
 125     password.replace(0, password.size(), password.size(), 0);
 126     return result;
 127   }
 128   DLOG(ERROR) << "PK11 password requested with NULL arg";
 129   return NULL;
 130 }
 131
 132 // NSS creates a local cache of the sqlite database if it detects that the
 133 // filesystem the database is on is much slower than the local disk.  The
 134 // detection doesn't work with the latest versions of sqlite, such as 3.6.22
 135 // (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561).  So we set
 136 // the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's
 137 // detection when database_dir is on NFS.  See http://crbug.com/48585.
 138 //
 139 // TODO(wtc): port this function to other USE_NSS platforms.  It is defined
 140 // only for OS_LINUX simply because the statfs structure is OS-specific.
 141 //
 142 // Because this function sets an environment variable it must be run before we
 143 // go multi-threaded.
 144 void UseLocalCacheOfNSSDatabaseIfNFS(const FilePath& database_dir) {
 145 #if defined(OS_LINUX)
 146   struct statfs buf;
 147   if (statfs(database_dir.value().c_str(), &buf) == 0) {
 148     if (buf.f_type == NFS_SUPER_MAGIC) {
 149       scoped_ptr<base::Environment> env(base::Environment::Create());
 150       const char* use_cache_env_var = "NSS_SDB_USE_CACHE";
 151       if (!env->HasVar(use_cache_env_var))
 152         env->SetVar(use_cache_env_var, "yes");
 153     }
 154   }
 155 #endif  // defined(OS_LINUX)
 156 }
 157
 158 PK11SlotInfo* FindSlotWithTokenName(const std::string& token_name) {
 159   AutoSECMODListReadLock auto_lock;
 160   SECMODModuleList* head = SECMOD_GetDefaultModuleList();
 161   for (SECMODModuleList* item = head; item != NULL; item = item->next) {
 162     int slot_count = item->module->loaded ? item->module->slotCount : 0;
 163     for (int i = 0; i < slot_count; i++) {
 164       PK11SlotInfo* slot = item->module->slots[i];
 165       if (PK11_GetTokenName(slot) == token_name)
 166         return PK11_ReferenceSlot(slot);
 167     }
 168   }
 169   return NULL;
 170 }
 171
 172 #endif  // defined(USE_NSS)
 173
 174 // A singleton to initialize/deinitialize NSPR.
 175 // Separate from the NSS singleton because we initialize NSPR on the UI thread.
 176 // Now that we're leaking the singleton, we could merge back with the NSS
 177 // singleton.
 178 class NSPRInitSingleton {
 179  private:
 180   friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>;
 181
 182   NSPRInitSingleton() {
 183     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
 184   }
 185
 186   // NOTE(willchan): We don't actually execute this code since we leak NSS to
 187   // prevent non-joinable threads from using NSS after it's already been shut
 188   // down.
 189   ~NSPRInitSingleton() {
 190     PL_ArenaFinish();
 191     PRStatus prstatus = PR_Cleanup();
 192     if (prstatus != PR_SUCCESS) {
 193       LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
 194     }
 195   }
 196 };
 197
 198 base::LazyInstance<NSPRInitSingleton,
 199                    base::LeakyLazyInstanceTraits<NSPRInitSingleton> >
 200     g_nspr_singleton(base::LINKER_INITIALIZED);
 201
 202 class NSSInitSingleton {
 203  public:
 204 #if defined(OS_CHROMEOS)
 205   void OpenPersistentNSSDB() {
 206     if (!chromeos_user_logged_in_) {
 207       // GetDefaultConfigDirectory causes us to do blocking IO on UI thread.
 208       // Temporarily allow it until we fix http://crbug.com/70119
 209       base::ThreadRestrictions::ScopedAllowIO allow_io;
 210       chromeos_user_logged_in_ = true;
 211
 212       // This creates another DB slot in NSS that is read/write, unlike
 213       // the fake root CA cert DB and the "default" crypto key
 214       // provider, which are still read-only (because we initialized
 215       // NSS before we had a cryptohome mounted).
 216       software_slot_ = OpenUserDB(GetDefaultConfigDirectory(),
 217                                   kNSSDatabaseName);
 218     }
 219   }
 220
 221   void EnableTPMTokenForNSS(TPMTokenInfoDelegate* info_delegate) {
 222     CHECK(info_delegate);
 223     tpm_token_info_delegate_.reset(info_delegate);
 224     // Try to load once to avoid jank later.  Ignore the return value,
 225     // because if it fails we will try again later.
 226     EnsureTPMTokenReady();
 227   }
 228
 229   // This is called whenever we want to make sure opencryptoki is
 230   // properly loaded, because it can fail shortly after the initial
 231   // login while the PINs are being initialized, and we want to retry
 232   // if this happens.
 233   bool EnsureTPMTokenReady() {
 234     // If EnableTPMTokenForNSS hasn't been called, return false.
 235     if (tpm_token_info_delegate_.get() == NULL)
 236       return false;
 237
 238     // If everything is already initialized, then return true.
 239     if (opencryptoki_module_ && tpm_slot_)
 240       return true;
 241
 242     if (tpm_token_info_delegate_->IsTokenReady()) {
 243       // This tries to load the opencryptoki module so NSS can talk to
 244       // the hardware TPM.
 245       if (!opencryptoki_module_) {
 246         opencryptoki_module_ = LoadModule(
 247             kOpencryptokiModuleName,
 248             kOpencryptokiPath,
 249             // trustOrder=100 -- means it'll select this as the most
 250             //   trusted slot for the mechanisms it provides.
 251             // slotParams=... -- selects RSA as the only mechanism, and only
 252             //   asks for the password when necessary (instead of every
 253             //   time, or after a timeout).
 254             "trustOrder=100 slotParams=(1={slotFlags=[RSA] askpw=only})");
 255       }
 256       if (opencryptoki_module_) {
 257         // If this gets set, then we'll use the TPM for certs with
 258         // private keys, otherwise we'll fall back to the software
 259         // implementation.
 260         tpm_slot_ = GetTPMSlot();
 261         return tpm_slot_ != NULL;
 262       }
 263     }
 264     return false;
 265   }
 266
 267   bool IsTPMTokenAvailable() {
 268     if (tpm_token_info_delegate_.get() == NULL)
 269       return false;
 270     return tpm_token_info_delegate_->IsTokenAvailable();
 271   }
 272
 273   void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) {
 274     if (tpm_token_info_delegate_.get() == NULL) {
 275       LOG(ERROR) << "GetTPMTokenInfo called before TPM Token is ready.";
 276       return;
 277     }
 278     tpm_token_info_delegate_->GetTokenInfo(token_name, user_pin);
 279   }
 280
 281   bool IsTPMTokenReady() {
 282     return tpm_slot_ != NULL;
 283   }
 284
 285   PK11SlotInfo* GetTPMSlot() {
 286     std::string token_name;
 287     GetTPMTokenInfo(&token_name, NULL);
 288     return FindSlotWithTokenName(token_name);
 289   }
 290
 291 #endif  // defined(OS_CHROMEOS)
 292
 293
 294   bool OpenTestNSSDB(const FilePath& path, const char* description) {
 295     test_slot_ = OpenUserDB(path, description);
 296     return !!test_slot_;
 297   }
 298
 299   void CloseTestNSSDB() {
 300     if (test_slot_) {
 301       SECStatus status = SECMOD_CloseUserDB(test_slot_);
 302       if (status != SECSuccess)
 303         LOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
 304       PK11_FreeSlot(test_slot_);
 305       test_slot_ = NULL;
 306     }
 307   }
 308
 309   PK11SlotInfo* GetPublicNSSKeySlot() {
 310     if (test_slot_)
 311       return PK11_ReferenceSlot(test_slot_);
 312     if (software_slot_)
 313       return PK11_ReferenceSlot(software_slot_);
 314     return PK11_GetInternalKeySlot();
 315   }
 316
 317   PK11SlotInfo* GetPrivateNSSKeySlot() {
 318     if (test_slot_)
 319       return PK11_ReferenceSlot(test_slot_);
 320
 321 #if defined(OS_CHROMEOS)
 322     // Make sure that if EnableTPMTokenForNSS has been called that we
 323     // have successfully loaded opencryptoki.
 324     if (tpm_token_info_delegate_.get() != NULL) {
 325       if (EnsureTPMTokenReady()) {
 326         return PK11_ReferenceSlot(tpm_slot_);
 327       } else {
 328         // If we were supposed to get the hardware token, but were
 329         // unable to, return NULL rather than fall back to sofware.
 330         return NULL;
 331       }
 332     }
 333 #endif
 334     // If we weren't supposed to enable the TPM for NSS, then return
 335     // the software slot.
 336     if (software_slot_)
 337       return PK11_ReferenceSlot(software_slot_);
 338     return PK11_GetInternalKeySlot();
 339   }
 340
 341 #if defined(USE_NSS)
 342   base::Lock* write_lock() {
 343     return &write_lock_;
 344   }
 345 #endif  // defined(USE_NSS)
 346
 347   // This method is used to force NSS to be initialized without a DB.
 348   // Call this method before NSSInitSingleton() is constructed.
 349   static void ForceNoDBInit() {
 350     force_nodb_init_ = true;
 351   }
 352
 353  private:
 354   friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>;
 355
 356   NSSInitSingleton()
 357       : opencryptoki_module_(NULL),
 358         software_slot_(NULL),
 359         test_slot_(NULL),
 360         tpm_slot_(NULL),
 361         root_(NULL),
 362         chromeos_user_logged_in_(false) {
 363     EnsureNSPRInit();
 364
 365     // We *must* have NSS >= 3.12.3.  See bug 26448.
 366     COMPILE_ASSERT(
 367         (NSS_VMAJOR == 3 && NSS_VMINOR == 12 && NSS_VPATCH >= 3) ||
 368         (NSS_VMAJOR == 3 && NSS_VMINOR > 12) ||
 369         (NSS_VMAJOR > 3),
 370         nss_version_check_failed);
 371     // Also check the run-time NSS version.
 372     // NSS_VersionCheck is a >= check, not strict equality.
 373     if (!NSS_VersionCheck("3.12.3")) {
 374       // It turns out many people have misconfigured NSS setups, where
 375       // their run-time NSPR doesn't match the one their NSS was compiled
 376       // against.  So rather than aborting, complain loudly.
 377       LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed.  "
 378                     "We depend on NSS >= 3.12.3, and this error is not fatal "
 379                     "only because many people have busted NSS setups (for "
 380                     "example, using the wrong version of NSPR). "
 381                     "Please upgrade to the latest NSS and NSPR, and if you "
 382                     "still get this error, contact your distribution "
 383                     "maintainer.";
 384     }
 385
 386     SECStatus status = SECFailure;
 387     bool nodb_init = force_nodb_init_;
 388
 389 #if !defined(USE_NSS)
 390     // Use the system certificate store, so initialize NSS without database.
 391     nodb_init = true;
 392 #endif
 393
 394     if (nodb_init) {
 395       status = NSS_NoDB_Init(NULL);
 396       if (status != SECSuccess) {
 397         LOG(ERROR) << "Error initializing NSS without a persistent "
 398                       "database: " << GetNSSErrorMessage();
 399       }
 400     } else {
 401 #if defined(USE_NSS)
 402       FilePath database_dir = GetInitialConfigDirectory();
 403       if (!database_dir.empty()) {
 404         // This duplicates the work which should have been done in
 405         // EarlySetupForNSSInit. However, this function is idempotent so
 406         // there's no harm done.
 407         UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
 408
 409         // Initialize with a persistent database (likely, ~/.pki/nssdb).
 410         // Use "sql:" which can be shared by multiple processes safely.
 411         std::string nss_config_dir =
 412             StringPrintf("sql:%s", database_dir.value().c_str());
 413 #if defined(OS_CHROMEOS)
 414         status = NSS_Init(nss_config_dir.c_str());
 415 #else
 416         status = NSS_InitReadWrite(nss_config_dir.c_str());
 417 #endif
 418         if (status != SECSuccess) {
 419           LOG(ERROR) << "Error initializing NSS with a persistent "
 420                         "database (" << nss_config_dir
 421                      << "): " << GetNSSErrorMessage();
 422         }
 423       }
 424       if (status != SECSuccess) {
 425         VLOG(1) << "Initializing NSS without a persistent database.";
 426         status = NSS_NoDB_Init(NULL);
 427         if (status != SECSuccess) {
 428           LOG(ERROR) << "Error initializing NSS without a persistent "
 429                         "database: " << GetNSSErrorMessage();
 430           return;
 431         }
 432       }
 433
 434       PK11_SetPasswordFunc(PKCS11PasswordFunc);
 435
 436       // If we haven't initialized the password for the NSS databases,
 437       // initialize an empty-string password so that we don't need to
 438       // log in.
 439       PK11SlotInfo* slot = PK11_GetInternalKeySlot();
 440       if (slot) {
 441         // PK11_InitPin may write to the keyDB, but no other thread can use NSS
 442         // yet, so we don't need to lock.
 443         if (PK11_NeedUserInit(slot))
 444           PK11_InitPin(slot, NULL, NULL);
 445         PK11_FreeSlot(slot);
 446       }
 447
 448       root_ = InitDefaultRootCerts();
 449 #endif  // defined(USE_NSS)
 450     }
 451   }
 452
 453   // NOTE(willchan): We don't actually execute this code since we leak NSS to
 454   // prevent non-joinable threads from using NSS after it's already been shut
 455   // down.
 456   ~NSSInitSingleton() {
 457     if (tpm_slot_) {
 458       PK11_FreeSlot(tpm_slot_);
 459       tpm_slot_ = NULL;
 460     }
 461     if (software_slot_) {
 462       SECMOD_CloseUserDB(software_slot_);
 463       PK11_FreeSlot(software_slot_);
 464       software_slot_ = NULL;
 465     }
 466     CloseTestNSSDB();
 467     if (root_) {
 468       SECMOD_UnloadUserModule(root_);
 469       SECMOD_DestroyModule(root_);
 470       root_ = NULL;
 471     }
 472     if (opencryptoki_module_) {
 473       SECMOD_UnloadUserModule(opencryptoki_module_);
 474       SECMOD_DestroyModule(opencryptoki_module_);
 475       opencryptoki_module_ = NULL;
 476     }
 477
 478     SECStatus status = NSS_Shutdown();
 479     if (status != SECSuccess) {
 480       // We VLOG(1) because this failure is relatively harmless (leaking, but
 481       // we're shutting down anyway).
 482       VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609";
 483     }
 484   }
 485
 486 #if defined(USE_NSS)
 487   // Load nss's built-in root certs.
 488   SECMODModule* InitDefaultRootCerts() {
 489     SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL);
 490     if (root)
 491       return root;
 492
 493     // Aw, snap.  Can't find/load root cert shared library.
 494     // This will make it hard to talk to anybody via https.
 495     NOTREACHED();
 496     return NULL;
 497   }
 498
 499   // Load the given module for this NSS session.
 500   SECMODModule* LoadModule(const char* name,
 501                            const char* library_path,
 502                            const char* params) {
 503     std::string modparams = StringPrintf(
 504         "name=\"%s\" library=\"%s\" %s",
 505         name, library_path, params ? params : "");
 506
 507     // Shouldn't need to const_cast here, but SECMOD doesn't properly
 508     // declare input string arguments as const.  Bug
 509     // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed
 510     // on NSS codebase to address this.
 511     SECMODModule* module = SECMOD_LoadUserModule(
 512         const_cast<char*>(modparams.c_str()), NULL, PR_FALSE);
 513     if (!module) {
 514       LOG(ERROR) << "Error loading " << name << " module into NSS: "
 515                  << GetNSSErrorMessage();
 516       return NULL;
 517     }
 518     return module;
 519   }
 520 #endif
 521
 522   static PK11SlotInfo* OpenUserDB(const FilePath& path,
 523                                   const char* description) {
 524     const std::string modspec =
 525         StringPrintf("configDir='sql:%s' tokenDescription='%s'",
 526                      path.value().c_str(), description);
 527     PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str());
 528     if (db_slot) {
 529       if (PK11_NeedUserInit(db_slot))
 530         PK11_InitPin(db_slot, NULL, NULL);
 531     }
 532     else {
 533       LOG(ERROR) << "Error opening persistent database (" << modspec
 534                  << "): " << GetNSSErrorMessage();
 535     }
 536     return db_slot;
 537   }
 538
 539   // If this is set to true NSS is forced to be initialized without a DB.
 540   static bool force_nodb_init_;
 541
 542 #if defined(OS_CHROMEOS)
 543   scoped_ptr<TPMTokenInfoDelegate> tpm_token_info_delegate_;
 544 #endif
 545
 546   SECMODModule* opencryptoki_module_;
 547   PK11SlotInfo* software_slot_;
 548   PK11SlotInfo* test_slot_;
 549   PK11SlotInfo* tpm_slot_;
 550   SECMODModule* root_;
 551   bool chromeos_user_logged_in_;
 552 #if defined(USE_NSS)
 553   // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
 554   // is fixed, we will no longer need the lock.
 555   base::Lock write_lock_;
 556 #endif  // defined(USE_NSS)
 557 };
 558
 559 // static
 560 bool NSSInitSingleton::force_nodb_init_ = false;
 561
 562 base::LazyInstance<NSSInitSingleton,
 563                    base::LeakyLazyInstanceTraits<NSSInitSingleton> >
 564     g_nss_singleton(base::LINKER_INITIALIZED);
 565
 566 }  // namespace
 567
 568 #if defined(USE_NSS)
 569 void EarlySetupForNSSInit() {
 570   FilePath database_dir = GetInitialConfigDirectory();
 571   if (!database_dir.empty())
 572     UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
 573 }
 574 #endif
 575
 576 void EnsureNSPRInit() {
 577   g_nspr_singleton.Get();
 578 }
 579
 580 void EnsureNSSInit() {
 581   // Initializing SSL causes us to do blocking IO.
 582   // Temporarily allow it until we fix
 583   //   http://code.google.com/p/chromium/issues/detail?id=59847
 584   base::ThreadRestrictions::ScopedAllowIO allow_io;
 585   g_nss_singleton.Get();
 586 }
 587
 588 void ForceNSSNoDBInit() {
 589   NSSInitSingleton::ForceNoDBInit();
 590 }
 591
 592 void DisableNSSForkCheck() {
 593   scoped_ptr<base::Environment> env(base::Environment::Create());
 594   env->SetVar("NSS_STRICT_NOFORK", "DISABLED");
 595 }
 596
 597 void LoadNSSLibraries() {
 598   // Some NSS libraries are linked dynamically so load them here.
 599 #if defined(USE_NSS)
 600   // Try to search for multiple directories to load the libraries.
 601   std::vector<FilePath> paths;
 602
 603   // Use relative path to Search PATH for the library files.
 604   paths.push_back(FilePath());
 605
 606   // For Debian derivaties NSS libraries are located here.
 607   paths.push_back(FilePath("/usr/lib/nss"));
 608
 609   // A list of library files to load.
 610   std::vector<std::string> libs;
 611   libs.push_back("libsoftokn3.so");
 612   libs.push_back("libfreebl3.so");
 613
 614   // For each combination of library file and path, check for existence and
 615   // then load.
 616   size_t loaded = 0;
 617   for (size_t i = 0; i < libs.size(); ++i) {
 618     for (size_t j = 0; j < paths.size(); ++j) {
 619       FilePath path = paths[j].Append(libs[i]);
 620       base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL);
 621       if (lib) {
 622         ++loaded;
 623         break;
 624       }
 625     }
 626   }
 627
 628   if (loaded == libs.size()) {
 629     VLOG(3) << "NSS libraries loaded.";
 630   } else {
 631     LOG(WARNING) << "Failed to load NSS libraries.";
 632   }
 633 #endif
 634 }
 635
 636 bool CheckNSSVersion(const char* version) {
 637   return !!NSS_VersionCheck(version);
 638 }
 639
 640 #if defined(USE_NSS)
 641 bool OpenTestNSSDB(const FilePath& path, const char* description) {
 642   return g_nss_singleton.Get().OpenTestNSSDB(path, description);
 643 }
 644
 645 void CloseTestNSSDB() {
 646   g_nss_singleton.Get().CloseTestNSSDB();
 647 }
 648
 649 base::Lock* GetNSSWriteLock() {
 650   return g_nss_singleton.Get().write_lock();
 651 }
 652
 653 AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) {
 654   // May be NULL if the lock is not needed in our version of NSS.
 655   if (lock_)
 656     lock_->Acquire();
 657 }
 658
 659 AutoNSSWriteLock::~AutoNSSWriteLock() {
 660   if (lock_) {
 661     lock_->AssertAcquired();
 662     lock_->Release();
 663   }
 664 }
 665
 666 AutoSECMODListReadLock::AutoSECMODListReadLock()
 667       : lock_(SECMOD_GetDefaultModuleListLock()) {
 668     SECMOD_GetReadLock(lock_);
 669   }
 670
 671 AutoSECMODListReadLock::~AutoSECMODListReadLock() {
 672   SECMOD_ReleaseReadLock(lock_);
 673 }
 674
 675 #endif  // defined(USE_NSS)
 676
 677 #if defined(OS_CHROMEOS)
 678 void OpenPersistentNSSDB() {
 679   g_nss_singleton.Get().OpenPersistentNSSDB();
 680 }
 681
 682 TPMTokenInfoDelegate::TPMTokenInfoDelegate() {}
 683 TPMTokenInfoDelegate::~TPMTokenInfoDelegate() {}
 684
 685 void EnableTPMTokenForNSS(TPMTokenInfoDelegate* info_delegate) {
 686   g_nss_singleton.Get().EnableTPMTokenForNSS(info_delegate);
 687 }
 688
 689 void GetTPMTokenInfo(std::string* token_name, std::string* user_pin) {
 690   g_nss_singleton.Get().GetTPMTokenInfo(token_name, user_pin);
 691 }
 692
 693 bool IsTPMTokenAvailable() {
 694   return g_nss_singleton.Get().IsTPMTokenAvailable();
 695 }
 696
 697 bool IsTPMTokenReady() {
 698   return g_nss_singleton.Get().IsTPMTokenReady();
 699 }
 700
 701 bool EnsureTPMTokenReady() {
 702   return g_nss_singleton.Get().EnsureTPMTokenReady();
 703 }
 704
 705 #endif  // defined(OS_CHROMEOS)
 706
 707 // TODO(port): Implement this more simply.  We can convert by subtracting an
 708 // offset (the difference between NSPR's and base::Time's epochs).
 709 base::Time PRTimeToBaseTime(PRTime prtime) {
 710   PRExplodedTime prxtime;
 711   PR_ExplodeTime(prtime, PR_GMTParameters, &prxtime);
 712
 713   base::Time::Exploded exploded;
 714   exploded.year         = prxtime.tm_year;
 715   exploded.month        = prxtime.tm_month + 1;
 716   exploded.day_of_week  = prxtime.tm_wday;
 717   exploded.day_of_month = prxtime.tm_mday;
 718   exploded.hour         = prxtime.tm_hour;
 719   exploded.minute       = prxtime.tm_min;
 720   exploded.second       = prxtime.tm_sec;
 721   exploded.millisecond  = prxtime.tm_usec / 1000;
 722
 723   return base::Time::FromUTCExploded(exploded);
 724 }
 725
 726 PK11SlotInfo* GetPublicNSSKeySlot() {
 727   return g_nss_singleton.Get().GetPublicNSSKeySlot();
 728 }
 729
 730 PK11SlotInfo* GetPrivateNSSKeySlot() {
 731   return g_nss_singleton.Get().GetPrivateNSSKeySlot();
 732 }
 733
 734 }  // namespace crypto