nss_cert_database.cc 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/nss_cert_database.h"
  5. #include <cert.h>
  6. #include <certdb.h>
  7. #include <dlfcn.h>
  8. #include <keyhi.h>
  9. #include <pk11pub.h>
  10. #include <secmod.h>
  11. #include <memory>
  12. #include <utility>
  13. #include "base/bind.h"
  14. #include "base/callback.h"
  15. #include "base/logging.h"
  16. #include "base/memory/raw_ptr.h"
  17. #include "base/observer_list_threadsafe.h"
  18. #include "base/task/thread_pool.h"
  19. #include "base/threading/scoped_blocking_call.h"
  20. #include "build/build_config.h"
  21. #include "build/chromeos_buildflags.h"
  22. #include "crypto/nss_util_internal.h"
  23. #include "crypto/scoped_nss_types.h"
  24. #include "net/base/net_errors.h"
  25. #include "net/cert/cert_database.h"
  26. #include "net/cert/x509_certificate.h"
  27. #include "net/cert/x509_util_nss.h"
  28. #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
  29. #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
  30. #if BUILDFLAG(IS_CHROMEOS_ASH) || BUILDFLAG(IS_CHROMEOS_LACROS)
  31. #include "crypto/chaps_support.h"
  32. #endif
  33. // PSM = Mozilla's Personal Security Manager.
  34. namespace psm = mozilla_security_manager;
  35. namespace net {
  36. namespace {
  37. using PK11HasAttributeSetFunction = CK_BBOOL (*)(PK11SlotInfo* slot,
  38. CK_OBJECT_HANDLE id,
  39. CK_ATTRIBUTE_TYPE type,
  40. PRBool haslock);
  41. // TODO(pneubeck): Move this class out of NSSCertDatabase and to the caller of
  42. // the c'tor of NSSCertDatabase, see https://crbug.com/395983 .
  43. // Helper that observes events from the NSSCertDatabase and forwards them to
  44. // the given CertDatabase.
  45. class CertNotificationForwarder : public NSSCertDatabase::Observer {
  46. public:
  47. explicit CertNotificationForwarder(CertDatabase* cert_db)
  48. : cert_db_(cert_db) {}
  49. CertNotificationForwarder(const CertNotificationForwarder&) = delete;
  50. CertNotificationForwarder& operator=(const CertNotificationForwarder&) =
  51. delete;
  52. ~CertNotificationForwarder() override = default;
  53. void OnCertDBChanged() override { cert_db_->NotifyObserversCertDBChanged(); }
  54. private:
  55. raw_ptr<CertDatabase> cert_db_;
  56. };
  57. } // namespace
  58. NSSCertDatabase::CertInfo::CertInfo() = default;
  59. NSSCertDatabase::CertInfo::CertInfo(CertInfo&& other) = default;
  60. NSSCertDatabase::CertInfo::~CertInfo() = default;
  61. NSSCertDatabase::CertInfo& NSSCertDatabase::CertInfo::operator=(
  62. NSSCertDatabase::CertInfo&& other) = default;
  63. NSSCertDatabase::ImportCertFailure::ImportCertFailure(
  64. ScopedCERTCertificate cert,
  65. int err)
  66. : certificate(std::move(cert)), net_error(err) {}
  67. NSSCertDatabase::ImportCertFailure::ImportCertFailure(
  68. ImportCertFailure&& other) = default;
  69. NSSCertDatabase::ImportCertFailure::~ImportCertFailure() = default;
  70. NSSCertDatabase::NSSCertDatabase(crypto::ScopedPK11Slot public_slot,
  71. crypto::ScopedPK11Slot private_slot)
  72. : public_slot_(std::move(public_slot)),
  73. private_slot_(std::move(private_slot)),
  74. observer_list_(
  75. base::MakeRefCounted<base::ObserverListThreadSafe<Observer>>()) {
  76. CHECK(public_slot_);
  77. CertDatabase* cert_db = CertDatabase::GetInstance();
  78. cert_notification_forwarder_ =
  79. std::make_unique<CertNotificationForwarder>(cert_db);
  80. AddObserver(cert_notification_forwarder_.get());
  81. psm::EnsurePKCS12Init();
  82. }
  83. NSSCertDatabase::~NSSCertDatabase() = default;
  84. void NSSCertDatabase::ListCerts(ListCertsCallback callback) {
  85. base::ThreadPool::PostTaskAndReplyWithResult(
  86. FROM_HERE,
  87. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  88. base::BindOnce(&NSSCertDatabase::ListCertsImpl, crypto::ScopedPK11Slot()),
  89. std::move(callback));
  90. }
  91. void NSSCertDatabase::ListCertsInSlot(ListCertsCallback callback,
  92. PK11SlotInfo* slot) {
  93. DCHECK(slot);
  94. base::ThreadPool::PostTaskAndReplyWithResult(
  95. FROM_HERE,
  96. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  97. base::BindOnce(&NSSCertDatabase::ListCertsImpl,
  98. crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot))),
  99. std::move(callback));
  100. }
  101. void NSSCertDatabase::ListCertsInfo(ListCertsInfoCallback callback) {
  102. base::ThreadPool::PostTaskAndReplyWithResult(
  103. FROM_HERE,
  104. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  105. base::BindOnce(&NSSCertDatabase::ListCertsInfoImpl,
  106. /*slot=*/nullptr,
  107. /*add_certs_info=*/true),
  108. std::move(callback));
  109. }
  110. #if BUILDFLAG(IS_CHROMEOS)
  111. crypto::ScopedPK11Slot NSSCertDatabase::GetSystemSlot() const {
  112. return crypto::ScopedPK11Slot();
  113. }
  114. // static
  115. bool NSSCertDatabase::IsCertificateOnSlot(CERTCertificate* cert,
  116. PK11SlotInfo* slot) {
  117. if (!slot)
  118. return false;
  119. return PK11_FindCertInSlot(slot, cert, nullptr) != CK_INVALID_HANDLE;
  120. }
  121. #endif // BUILDFLAG(IS_CHROMEOS)
  122. crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
  123. return crypto::ScopedPK11Slot(PK11_ReferenceSlot(public_slot_.get()));
  124. }
  125. crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
  126. if (!private_slot_)
  127. return crypto::ScopedPK11Slot();
  128. return crypto::ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()));
  129. }
  130. void NSSCertDatabase::ListModules(std::vector<crypto::ScopedPK11Slot>* modules,
  131. bool need_rw) const {
  132. modules->clear();
  133. // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
  134. crypto::ScopedPK11SlotList slot_list(
  135. PK11_GetAllTokens(CKM_INVALID_MECHANISM,
  136. need_rw ? PR_TRUE : PR_FALSE, // needRW
  137. PR_TRUE, // loadCerts (unused)
  138. nullptr)); // wincx
  139. if (!slot_list) {
  140. LOG(ERROR) << "PK11_GetAllTokens failed: " << PORT_GetError();
  141. return;
  142. }
  143. PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list.get());
  144. while (slot_element) {
  145. modules->push_back(
  146. crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot_element->slot)));
  147. slot_element = PK11_GetNextSafe(slot_list.get(), slot_element,
  148. PR_FALSE); // restart
  149. }
  150. }
  151. bool NSSCertDatabase::SetCertTrust(CERTCertificate* cert,
  152. CertType type,
  153. TrustBits trust_bits) {
  154. bool success = psm::SetCertTrust(cert, type, trust_bits);
  155. if (success)
  156. NotifyObserversCertDBChanged();
  157. return success;
  158. }
  159. int NSSCertDatabase::ImportFromPKCS12(
  160. PK11SlotInfo* slot_info,
  161. const std::string& data,
  162. const std::u16string& password,
  163. bool is_extractable,
  164. ScopedCERTCertificateList* imported_certs) {
  165. int result =
  166. psm::nsPKCS12Blob_Import(slot_info, data.data(), data.size(), password,
  167. is_extractable, imported_certs);
  168. if (result == OK)
  169. NotifyObserversCertDBChanged();
  170. return result;
  171. }
  172. int NSSCertDatabase::ExportToPKCS12(const ScopedCERTCertificateList& certs,
  173. const std::u16string& password,
  174. std::string* output) const {
  175. return psm::nsPKCS12Blob_Export(output, certs, password);
  176. }
  177. CERTCertificate* NSSCertDatabase::FindRootInList(
  178. const ScopedCERTCertificateList& certificates) const {
  179. DCHECK_GT(certificates.size(), 0U);
  180. if (certificates.size() == 1)
  181. return certificates[0].get();
  182. CERTCertificate* cert0 = certificates[0].get();
  183. CERTCertificate* cert1 = certificates[1].get();
  184. CERTCertificate* certn_2 = certificates[certificates.size() - 2].get();
  185. CERTCertificate* certn_1 = certificates[certificates.size() - 1].get();
  186. // Using CERT_CompareName is an alternative, except that it is broken until
  187. // NSS 3.32 (see https://bugzilla.mozilla.org/show_bug.cgi?id=1361197 ).
  188. if (SECITEM_CompareItem(&cert1->derIssuer, &cert0->derSubject) == SECEqual)
  189. return cert0;
  190. if (SECITEM_CompareItem(&certn_2->derIssuer, &certn_1->derSubject) ==
  191. SECEqual) {
  192. return certn_1;
  193. }
  194. LOG(WARNING) << "certificate list is not a hierarchy";
  195. return cert0;
  196. }
  197. int NSSCertDatabase::ImportUserCert(const std::string& data) {
  198. ScopedCERTCertificateList certificates =
  199. x509_util::CreateCERTCertificateListFromBytes(
  200. data.c_str(), data.size(), net::X509Certificate::FORMAT_AUTO);
  201. if (certificates.empty())
  202. return ERR_CERT_INVALID;
  203. int result = psm::ImportUserCert(certificates[0].get());
  204. if (result == OK)
  205. NotifyObserversCertDBChanged();
  206. return result;
  207. }
  208. int NSSCertDatabase::ImportUserCert(CERTCertificate* cert) {
  209. int result = psm::ImportUserCert(cert);
  210. if (result == OK)
  211. NotifyObserversCertDBChanged();
  212. return result;
  213. }
  214. bool NSSCertDatabase::ImportCACerts(
  215. const ScopedCERTCertificateList& certificates,
  216. TrustBits trust_bits,
  217. ImportCertFailureList* not_imported) {
  218. crypto::ScopedPK11Slot slot(GetPublicSlot());
  219. CERTCertificate* root = FindRootInList(certificates);
  220. bool success = psm::ImportCACerts(slot.get(), certificates, root, trust_bits,
  221. not_imported);
  222. if (success)
  223. NotifyObserversCertDBChanged();
  224. return success;
  225. }
  226. bool NSSCertDatabase::ImportServerCert(
  227. const ScopedCERTCertificateList& certificates,
  228. TrustBits trust_bits,
  229. ImportCertFailureList* not_imported) {
  230. crypto::ScopedPK11Slot slot(GetPublicSlot());
  231. return psm::ImportServerCert(slot.get(), certificates, trust_bits,
  232. not_imported);
  233. }
  234. NSSCertDatabase::TrustBits NSSCertDatabase::GetCertTrust(
  235. const CERTCertificate* cert,
  236. CertType type) const {
  237. CERTCertTrust trust;
  238. SECStatus srv = CERT_GetCertTrust(cert, &trust);
  239. if (srv != SECSuccess) {
  240. LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
  241. return TRUST_DEFAULT;
  242. }
  243. // We define our own more "friendly" TrustBits, which means we aren't able to
  244. // round-trip all possible NSS trust flag combinations. We try to map them in
  245. // a sensible way.
  246. switch (type) {
  247. case CA_CERT: {
  248. const unsigned kTrustedCA = CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA;
  249. const unsigned kCAFlags = kTrustedCA | CERTDB_TERMINAL_RECORD;
  250. TrustBits trust_bits = TRUST_DEFAULT;
  251. if ((trust.sslFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
  252. trust_bits |= DISTRUSTED_SSL;
  253. else if (trust.sslFlags & kTrustedCA)
  254. trust_bits |= TRUSTED_SSL;
  255. if ((trust.emailFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
  256. trust_bits |= DISTRUSTED_EMAIL;
  257. else if (trust.emailFlags & kTrustedCA)
  258. trust_bits |= TRUSTED_EMAIL;
  259. if ((trust.objectSigningFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
  260. trust_bits |= DISTRUSTED_OBJ_SIGN;
  261. else if (trust.objectSigningFlags & kTrustedCA)
  262. trust_bits |= TRUSTED_OBJ_SIGN;
  263. return trust_bits;
  264. }
  265. case SERVER_CERT:
  266. if (trust.sslFlags & CERTDB_TERMINAL_RECORD) {
  267. if (trust.sslFlags & CERTDB_TRUSTED)
  268. return TRUSTED_SSL;
  269. return DISTRUSTED_SSL;
  270. }
  271. return TRUST_DEFAULT;
  272. default:
  273. return TRUST_DEFAULT;
  274. }
  275. }
  276. bool NSSCertDatabase::DeleteCertAndKey(CERTCertificate* cert) {
  277. if (!DeleteCertAndKeyImpl(cert))
  278. return false;
  279. NotifyObserversCertDBChanged();
  280. return true;
  281. }
  282. void NSSCertDatabase::DeleteCertAndKeyAsync(ScopedCERTCertificate cert,
  283. DeleteCertCallback callback) {
  284. base::ThreadPool::PostTaskAndReplyWithResult(
  285. FROM_HERE,
  286. {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
  287. base::BindOnce(&NSSCertDatabase::DeleteCertAndKeyImplScoped,
  288. std::move(cert)),
  289. base::BindOnce(&NSSCertDatabase::NotifyCertRemovalAndCallBack,
  290. weak_factory_.GetWeakPtr(), std::move(callback)));
  291. }
  292. // static
  293. bool NSSCertDatabase::IsUntrusted(const CERTCertificate* cert) {
  294. CERTCertTrust nsstrust;
  295. SECStatus rv = CERT_GetCertTrust(cert, &nsstrust);
  296. if (rv != SECSuccess) {
  297. LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
  298. return false;
  299. }
  300. // The CERTCertTrust structure contains three trust records:
  301. // sslFlags, emailFlags, and objectSigningFlags. The three
  302. // trust records are independent of each other.
  303. //
  304. // If the CERTDB_TERMINAL_RECORD bit in a trust record is set,
  305. // then that trust record is a terminal record. A terminal
  306. // record is used for explicit trust and distrust of an
  307. // end-entity or intermediate CA cert.
  308. //
  309. // In a terminal record, if neither CERTDB_TRUSTED_CA nor
  310. // CERTDB_TRUSTED is set, then the terminal record means
  311. // explicit distrust. On the other hand, if the terminal
  312. // record has either CERTDB_TRUSTED_CA or CERTDB_TRUSTED bit
  313. // set, then the terminal record means explicit trust.
  314. //
  315. // For a root CA, the trust record does not have
  316. // the CERTDB_TERMINAL_RECORD bit set.
  317. static const unsigned int kTrusted = CERTDB_TRUSTED_CA | CERTDB_TRUSTED;
  318. if ((nsstrust.sslFlags & CERTDB_TERMINAL_RECORD) != 0 &&
  319. (nsstrust.sslFlags & kTrusted) == 0) {
  320. return true;
  321. }
  322. if ((nsstrust.emailFlags & CERTDB_TERMINAL_RECORD) != 0 &&
  323. (nsstrust.emailFlags & kTrusted) == 0) {
  324. return true;
  325. }
  326. if ((nsstrust.objectSigningFlags & CERTDB_TERMINAL_RECORD) != 0 &&
  327. (nsstrust.objectSigningFlags & kTrusted) == 0) {
  328. return true;
  329. }
  330. // Self-signed certificates that don't have any trust bits set are untrusted.
  331. // Other certificates that don't have any trust bits set may still be trusted
  332. // if they chain up to a trust anchor.
  333. if (SECITEM_CompareItem(&cert->derIssuer, &cert->derSubject) == SECEqual) {
  334. return (nsstrust.sslFlags & kTrusted) == 0 &&
  335. (nsstrust.emailFlags & kTrusted) == 0 &&
  336. (nsstrust.objectSigningFlags & kTrusted) == 0;
  337. }
  338. return false;
  339. }
  340. // static
  341. bool NSSCertDatabase::IsWebTrustAnchor(const CERTCertificate* cert) {
  342. CERTCertTrust nsstrust;
  343. SECStatus rv = CERT_GetCertTrust(cert, &nsstrust);
  344. if (rv != SECSuccess) {
  345. LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
  346. return false;
  347. }
  348. // Note: This should return true iff a net::TrustStoreNSS instantiated with
  349. // SECTrustType trustSSL would classify |cert| as a trust anchor.
  350. const unsigned int ssl_trust_flags = nsstrust.sslFlags;
  351. // Determine if the certificate is a trust anchor.
  352. if ((ssl_trust_flags & CERTDB_TRUSTED_CA) == CERTDB_TRUSTED_CA) {
  353. return true;
  354. }
  355. return false;
  356. }
  357. // static
  358. bool NSSCertDatabase::IsReadOnly(const CERTCertificate* cert) {
  359. PK11SlotInfo* slot = cert->slot;
  360. return slot && PK11_IsReadOnly(slot);
  361. }
  362. // static
  363. // `cfi-icall` is a clang flag to enable extra checks to prevent "Indirect call
  364. // of a function with wrong dynamic type". To work properly it requires the
  365. // called function or the function taking the address of the called function
  366. // to be compiled with "-fsanitize=cfi-icall" that is not true for libnss3.
  367. // Because of that we are getting a false positive result around using the
  368. // dynamically loaded `pk11_has_attribute_set` method.
  369. NO_SANITIZE("cfi-icall")
  370. bool NSSCertDatabase::IsHardwareBacked(const CERTCertificate* cert) {
  371. PK11SlotInfo* slot = cert->slot;
  372. if (!slot)
  373. return false;
  374. #if BUILDFLAG(IS_CHROMEOS_ASH) || BUILDFLAG(IS_CHROMEOS_LACROS)
  375. // For keys in Chaps, it's possible that they are truly hardware backed, or
  376. // they can be software-backed, such as if the creator requested it, or if the
  377. // TPM does not support the key algorithm. Chaps sets a kKeyInSoftware
  378. // attribute to true for private keys that aren't wrapped by the TPM.
  379. if (crypto::IsSlotProvidedByChaps(slot)) {
  380. static PK11HasAttributeSetFunction pk11_has_attribute_set =
  381. reinterpret_cast<PK11HasAttributeSetFunction>(
  382. dlsym(RTLD_DEFAULT, "PK11_HasAttributeSet"));
  383. if (pk11_has_attribute_set) {
  384. constexpr CK_ATTRIBUTE_TYPE kKeyInSoftware = CKA_VENDOR_DEFINED + 5;
  385. SECKEYPrivateKey* private_key = PK11_FindPrivateKeyFromCert(
  386. slot, const_cast<CERTCertificate*>(cert), nullptr);
  387. // PK11_HasAttributeSet returns true if the object in the given slot has
  388. // the attribute set to true. Otherwise it returns false.
  389. if (private_key &&
  390. pk11_has_attribute_set(slot, private_key->pkcs11ID, kKeyInSoftware,
  391. /*haslock=*/PR_FALSE)) {
  392. return false;
  393. }
  394. }
  395. // All keys in chaps without the attribute are hardware backed.
  396. return true;
  397. }
  398. #endif
  399. return PK11_IsHW(slot);
  400. }
  401. void NSSCertDatabase::AddObserver(Observer* observer) {
  402. observer_list_->AddObserver(observer);
  403. }
  404. void NSSCertDatabase::RemoveObserver(Observer* observer) {
  405. observer_list_->RemoveObserver(observer);
  406. }
  407. // static
  408. ScopedCERTCertificateList NSSCertDatabase::ExtractCertificates(
  409. CertInfoList certs_info) {
  410. ScopedCERTCertificateList certs;
  411. certs.reserve(certs_info.size());
  412. for (auto& cert_info : certs_info)
  413. certs.push_back(std::move(cert_info.cert));
  414. return certs;
  415. }
  416. // static
  417. ScopedCERTCertificateList NSSCertDatabase::ListCertsImpl(
  418. crypto::ScopedPK11Slot slot) {
  419. CertInfoList certs_info =
  420. ListCertsInfoImpl(std::move(slot), /*add_certs_info=*/false);
  421. return ExtractCertificates(std::move(certs_info));
  422. }
  423. // static
  424. NSSCertDatabase::CertInfoList NSSCertDatabase::ListCertsInfoImpl(
  425. crypto::ScopedPK11Slot slot,
  426. bool add_certs_info) {
  427. // This method may acquire the NSS lock or reenter this code via extension
  428. // hooks (such as smart card UI). To ensure threads are not starved or
  429. // deadlocked, the base::ScopedBlockingCall below increments the thread pool
  430. // capacity if this method takes too much time to run.
  431. base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
  432. base::BlockingType::MAY_BLOCK);
  433. CertInfoList certs_info;
  434. CERTCertList* cert_list = nullptr;
  435. if (slot)
  436. cert_list = PK11_ListCertsInSlot(slot.get());
  437. else
  438. cert_list = PK11_ListCerts(PK11CertListUnique, nullptr);
  439. // PK11_ListCerts[InSlot] can return nullptr, e.g. because the PKCS#11 token
  440. // that was backing the specified slot is not available anymore.
  441. // Treat it as no certificates being present on the slot.
  442. if (!cert_list) {
  443. LOG(WARNING) << (slot ? "PK11_ListCertsInSlot" : "PK11_ListCerts")
  444. << " returned null";
  445. return certs_info;
  446. }
  447. CERTCertListNode* node;
  448. for (node = CERT_LIST_HEAD(cert_list); !CERT_LIST_END(node, cert_list);
  449. node = CERT_LIST_NEXT(node)) {
  450. CertInfo cert_info;
  451. cert_info.cert = x509_util::DupCERTCertificate(node->cert);
  452. if (add_certs_info) {
  453. cert_info.on_read_only_slot = IsReadOnly(cert_info.cert.get());
  454. cert_info.untrusted = IsUntrusted(cert_info.cert.get());
  455. cert_info.web_trust_anchor = IsWebTrustAnchor(cert_info.cert.get());
  456. cert_info.hardware_backed = IsHardwareBacked(cert_info.cert.get());
  457. }
  458. certs_info.push_back(std::move(cert_info));
  459. }
  460. CERT_DestroyCertList(cert_list);
  461. return certs_info;
  462. }
  463. void NSSCertDatabase::NotifyCertRemovalAndCallBack(DeleteCertCallback callback,
  464. bool success) {
  465. if (success)
  466. NotifyObserversCertDBChanged();
  467. std::move(callback).Run(success);
  468. }
  469. void NSSCertDatabase::NotifyObserversCertDBChanged() {
  470. observer_list_->Notify(FROM_HERE, &Observer::OnCertDBChanged);
  471. }
  472. // static
  473. bool NSSCertDatabase::DeleteCertAndKeyImpl(CERTCertificate* cert) {
  474. // This method may acquire the NSS lock or reenter this code via extension
  475. // hooks (such as smart card UI). To ensure threads are not starved or
  476. // deadlocked, the base::ScopedBlockingCall below increments the thread pool
  477. // capacity if this method takes too much time to run.
  478. base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
  479. base::BlockingType::MAY_BLOCK);
  480. // For some reason, PK11_DeleteTokenCertAndKey only calls
  481. // SEC_DeletePermCertificate if the private key is found. So, we check
  482. // whether a private key exists before deciding which function to call to
  483. // delete the cert.
  484. SECKEYPrivateKey* privKey = PK11_FindKeyByAnyCert(cert, nullptr);
  485. if (privKey) {
  486. SECKEY_DestroyPrivateKey(privKey);
  487. if (PK11_DeleteTokenCertAndKey(cert, nullptr)) {
  488. LOG(ERROR) << "PK11_DeleteTokenCertAndKey failed: " << PORT_GetError();
  489. return false;
  490. }
  491. } else {
  492. if (SEC_DeletePermCertificate(cert)) {
  493. LOG(ERROR) << "SEC_DeletePermCertificate failed: " << PORT_GetError();
  494. return false;
  495. }
  496. }
  497. return true;
  498. }
  499. // static
  500. bool NSSCertDatabase::DeleteCertAndKeyImplScoped(ScopedCERTCertificate cert) {
  501. return NSSCertDatabase::DeleteCertAndKeyImpl(cert.get());
  502. }
  503. } // namespace net