nss_util_internal.h 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef CRYPTO_NSS_UTIL_INTERNAL_H_
  5. #define CRYPTO_NSS_UTIL_INTERNAL_H_
  6. #include <secmodt.h>
  7. #include <string>
  8. #include "base/callback.h"
  9. #include "base/memory/raw_ptr.h"
  10. #include "build/chromeos_buildflags.h"
  11. #include "crypto/crypto_export.h"
  12. #include "crypto/scoped_nss_types.h"
  13. namespace base {
  14. class FilePath;
  15. }
  16. // These functions return a type defined in an NSS header, and so cannot be
  17. // declared in nss_util.h. Hence, they are declared here.
  18. namespace crypto {
  19. // Opens an NSS software database in folder `path`, with the (potentially)
  20. // user-visible description `description`. Returns the slot for the opened
  21. // database, or nullptr if the database could not be opened. Can be called
  22. // multiple times for the same `path`, thread-safe.
  23. CRYPTO_EXPORT ScopedPK11Slot OpenSoftwareNSSDB(const base::FilePath& path,
  24. const std::string& description);
  25. // Closes the underlying database for the `slot`. All remaining slots
  26. // referencing the same database will remain valid objects, but won't be able to
  27. // successfully retrieve certificates, etc. Should be used for all databases
  28. // that were opened with `OpenSoftwareNSSDB` (instead of `SECMOD_CloseUserDB`).
  29. // Can be called multiple times. Returns `SECSuccess` if the database was
  30. // successfully closed, returns `SECFailure` if it was never opened, was already
  31. // closed by an earlier call, or failed to close. Thread-safe.
  32. CRYPTO_EXPORT SECStatus CloseSoftwareNSSDB(PK11SlotInfo* slot);
  33. // A helper class that acquires the SECMOD list read lock while the
  34. // AutoSECMODListReadLock is in scope.
  35. class CRYPTO_EXPORT AutoSECMODListReadLock {
  36. public:
  37. AutoSECMODListReadLock();
  38. AutoSECMODListReadLock(const AutoSECMODListReadLock&) = delete;
  39. AutoSECMODListReadLock& operator=(const AutoSECMODListReadLock&) = delete;
  40. ~AutoSECMODListReadLock();
  41. private:
  42. raw_ptr<SECMODListLock> lock_;
  43. };
  44. #if BUILDFLAG(IS_CHROMEOS_ASH)
  45. // Returns path to the NSS database file in the provided profile
  46. // directory.
  47. CRYPTO_EXPORT base::FilePath GetSoftwareNSSDBPath(
  48. const base::FilePath& profile_directory_path);
  49. // Returns a reference to the system-wide TPM slot (or nullptr if it will never
  50. // be loaded).
  51. CRYPTO_EXPORT void GetSystemNSSKeySlot(
  52. base::OnceCallback<void(ScopedPK11Slot)> callback);
  53. // Injects the given |slot| as a system slot set by the future
  54. // |InitializeTPMTokenAndSystemSlot| call.
  55. CRYPTO_EXPORT void PrepareSystemSlotForTesting(ScopedPK11Slot slot);
  56. // Attempt to unset the testing system slot.
  57. // Note: After this method is called, the system is in an undefined state; it is
  58. // NOT possible to call `PrepareSystemSlotForTesting()` and have it return to a
  59. // known-good state. The primary purpose is to attempt to release system
  60. // resources, such as file handles, to allow the cleanup of files on disk, but
  61. // because of the process-wide effect, it's not possible to unwind any/all
  62. // initialization that depended on this previously-configured system slot.
  63. CRYPTO_EXPORT void ResetSystemSlotForTesting();
  64. // Reset the global ChromeOSTokenManager. This is used between tests, so
  65. // tests that run in the same process won't hit DCHECKS because they have
  66. // different BrowserIO threads.
  67. CRYPTO_EXPORT void ResetTokenManagerForTesting();
  68. // Prepare per-user NSS slot mapping. It is safe to call this function multiple
  69. // times. Returns true if the user was added, or false if it already existed.
  70. CRYPTO_EXPORT bool InitializeNSSForChromeOSUser(
  71. const std::string& username_hash,
  72. const base::FilePath& path);
  73. // Returns whether TPM for ChromeOS user still needs initialization. If
  74. // true is returned, the caller can proceed to initialize TPM slot for the
  75. // user, but should call |WillInitializeTPMForChromeOSUser| first.
  76. // |InitializeNSSForChromeOSUser| must have been called first.
  77. [[nodiscard]] CRYPTO_EXPORT bool ShouldInitializeTPMForChromeOSUser(
  78. const std::string& username_hash);
  79. // Makes |ShouldInitializeTPMForChromeOSUser| start returning false.
  80. // Should be called before starting TPM initialization for the user.
  81. // Assumes |InitializeNSSForChromeOSUser| had already been called.
  82. CRYPTO_EXPORT void WillInitializeTPMForChromeOSUser(
  83. const std::string& username_hash);
  84. // Use TPM slot |slot_id| for user. InitializeNSSForChromeOSUser must have been
  85. // called first.
  86. CRYPTO_EXPORT void InitializeTPMForChromeOSUser(
  87. const std::string& username_hash,
  88. CK_SLOT_ID slot_id);
  89. // Use the software slot as the private slot for user.
  90. // InitializeNSSForChromeOSUser must have been called first.
  91. CRYPTO_EXPORT void InitializePrivateSoftwareSlotForChromeOSUser(
  92. const std::string& username_hash);
  93. // Returns a reference to the public slot for user.
  94. [[nodiscard]] CRYPTO_EXPORT ScopedPK11Slot
  95. GetPublicSlotForChromeOSUser(const std::string& username_hash);
  96. // Returns the private slot for |username_hash| if it is loaded. If it is not
  97. // loaded and |callback| is non-null, the |callback| will be run once the slot
  98. // is loaded.
  99. [[nodiscard]] CRYPTO_EXPORT ScopedPK11Slot GetPrivateSlotForChromeOSUser(
  100. const std::string& username_hash,
  101. base::OnceCallback<void(ScopedPK11Slot)> callback);
  102. // Closes the NSS DB for |username_hash| that was previously opened by the
  103. // *Initialize*ForChromeOSUser functions.
  104. CRYPTO_EXPORT void CloseChromeOSUserForTesting(
  105. const std::string& username_hash);
  106. // Sets the slot which should be used as private slot for the next
  107. // |InitializePrivateSoftwareSlotForChromeOSUser| called. This is intended for
  108. // simulating a separate private slot in Chrome OS browser tests.
  109. // As a sanity check, it is recommended to check that the private slot of the
  110. // profile's certificate database is set to |slot| when the profile is
  111. // available, because |slot| will be used as private slot for whichever profile
  112. // is initialized next.
  113. CRYPTO_EXPORT void SetPrivateSoftwareSlotForChromeOSUserForTesting(
  114. ScopedPK11Slot slot);
  115. #endif // BUILDFLAG(IS_CHROMEOS_ASH)
  116. // Loads the given module for this NSS session.
  117. SECMODModule* LoadNSSModule(const char* name,
  118. const char* library_path,
  119. const char* params);
  120. // Returns the current NSS error message.
  121. std::string GetNSSErrorMessage();
  122. } // namespace crypto
  123. #endif // CRYPTO_NSS_UTIL_INTERNAL_H_