1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CRYPTO_NSS_UTIL_H_ 6 #define CRYPTO_NSS_UTIL_H_ 7 8 #include <stdint.h> 9 10 #include <string> 11 #include "base/callback.h" 12 #include "base/compiler_specific.h" 13 #include "base/macros.h" 14 #include "crypto/crypto_export.h" 15 16 namespace base { 17 class FilePath; 18 class Lock; 19 class Time; 20 } // namespace base 21 22 // This file specifically doesn't depend on any NSS or NSPR headers because it 23 // is included by various (non-crypto) parts of chrome to call the 24 // initialization functions. 25 namespace crypto { 26 27 // EarlySetupForNSSInit performs lightweight setup which must occur before the 28 // process goes multithreaded. This does not initialise NSS. For test, see 29 // EnsureNSSInit. 30 CRYPTO_EXPORT void EarlySetupForNSSInit(); 31 32 // Initialize NRPR if it isn't already initialized. This function is 33 // thread-safe, and NSPR will only ever be initialized once. 34 CRYPTO_EXPORT void EnsureNSPRInit(); 35 36 // Initialize NSS if it isn't already initialized. This must be called before 37 // any other NSS functions. This function is thread-safe, and NSS will only 38 // ever be initialized once. 39 CRYPTO_EXPORT void EnsureNSSInit(); 40 41 // Check if the current NSS version is greater than or equals to |version|. 42 // A sample version string is "3.12.3". 43 bool CheckNSSVersion(const char* version); 44 45 #if defined(OS_CHROMEOS) 46 // Indicates that NSS should use the Chaps library so that we 47 // can access the TPM through NSS. InitializeTPMTokenAndSystemSlot and 48 // InitializeTPMForChromeOSUser must still be called to load the slots. 49 CRYPTO_EXPORT void EnableTPMTokenForNSS(); 50 51 // Returns true if EnableTPMTokenForNSS has been called. 52 CRYPTO_EXPORT bool IsTPMTokenEnabledForNSS(); 53 54 // Returns true if the TPM is owned and PKCS#11 initialized with the 55 // user and security officer PINs, and has been enabled in NSS by 56 // calling EnableTPMForNSS, and Chaps has been successfully 57 // loaded into NSS. 58 // If |callback| is non-null and the function returns false, the |callback| will 59 // be run once the TPM is ready. |callback| will never be run if the function 60 // returns true. 61 CRYPTO_EXPORT bool IsTPMTokenReady(const base::Closure& callback) 62 WARN_UNUSED_RESULT; 63 64 // Initialize the TPM token and system slot. The |callback| will run on the same 65 // thread with true if the token and slot were successfully loaded or were 66 // already initialized. |callback| will be passed false if loading failed. Once 67 // called, InitializeTPMTokenAndSystemSlot must not be called again until the 68 // |callback| has been run. 69 CRYPTO_EXPORT void InitializeTPMTokenAndSystemSlot( 70 int system_slot_id, 71 const base::Callback<void(bool)>& callback); 72 #endif 73 74 // Convert a NSS PRTime value into a base::Time object. 75 // We use a int64_t instead of PRTime here to avoid depending on NSPR headers. 76 CRYPTO_EXPORT base::Time PRTimeToBaseTime(int64_t prtime); 77 78 // Convert a base::Time object into a PRTime value. 79 // We use a int64_t instead of PRTime here to avoid depending on NSPR headers. 80 CRYPTO_EXPORT int64_t BaseTimeToPRTime(base::Time time); 81 82 // NSS has a bug which can cause a deadlock or stall in some cases when writing 83 // to the certDB and keyDB. It also has a bug which causes concurrent key pair 84 // generations to scribble over each other. To work around this, we synchronize 85 // writes to the NSS databases with a global lock. The lock is hidden beneath a 86 // function for easy disabling when the bug is fixed. Callers should allow for 87 // it to return NULL in the future. 88 // 89 // See https://bugzilla.mozilla.org/show_bug.cgi?id=564011 90 base::Lock* GetNSSWriteLock(); 91 92 // A helper class that acquires the NSS write Lock while the AutoNSSWriteLock 93 // is in scope. 94 class CRYPTO_EXPORT AutoNSSWriteLock { 95 public: 96 AutoNSSWriteLock(); 97 ~AutoNSSWriteLock(); 98 private: 99 base::Lock *lock_; 100 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); 101 }; 102 103 } // namespace crypto 104 105 #endif // CRYPTO_NSS_UTIL_H_ 106