OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CRYPTO_NSS_UTIL_H_ | 5 #ifndef CRYPTO_NSS_UTIL_H_ |
6 #define CRYPTO_NSS_UTIL_H_ | 6 #define CRYPTO_NSS_UTIL_H_ |
7 #pragma once | 7 #pragma once |
8 | 8 |
9 #include <string> | 9 #include <string> |
10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
11 #include "base/callback.h" | |
12 #include "crypto/crypto_export.h" | 11 #include "crypto/crypto_export.h" |
13 | 12 |
14 #if defined(USE_NSS) | 13 #if defined(USE_NSS) |
15 class FilePath; | 14 class FilePath; |
16 #endif // defined(USE_NSS) | 15 #endif // defined(USE_NSS) |
17 | 16 |
18 namespace base { | 17 namespace base { |
19 class Lock; | 18 class Lock; |
20 class Time; | 19 class Time; |
21 } // namespace base | 20 } // namespace base |
22 | 21 |
23 // This file specifically doesn't depend on any NSS or NSPR headers because it | 22 // This file specifically doesn't depend on any NSS or NSPR headers because it |
24 // is included by various (non-crypto) parts of chrome to call the | 23 // is included by various (non-crypto) parts of chrome to call the |
25 // initialization functions. | 24 // initialization functions. |
26 namespace crypto { | 25 namespace crypto { |
27 | 26 |
28 class SymmetricKey; | 27 class SymmetricKey; |
29 | 28 |
30 // A callback to handle the result of InitializeTPMToken. | |
31 typedef base::Callback<void(bool result)> InitializeTPMTokenCallback; | |
32 | |
33 #if defined(USE_NSS) | 29 #if defined(USE_NSS) |
34 // EarlySetupForNSSInit performs lightweight setup which must occur before the | 30 // EarlySetupForNSSInit performs lightweight setup which must occur before the |
35 // process goes multithreaded. This does not initialise NSS. For test, see | 31 // process goes multithreaded. This does not initialise NSS. For test, see |
36 // EnsureNSSInit. | 32 // EnsureNSSInit. |
37 CRYPTO_EXPORT void EarlySetupForNSSInit(); | 33 CRYPTO_EXPORT void EarlySetupForNSSInit(); |
38 #endif | 34 #endif |
39 | 35 |
40 // Initialize NRPR if it isn't already initialized. This function is | 36 // Initialize NRPR if it isn't already initialized. This function is |
41 // thread-safe, and NSPR will only ever be initialized once. | 37 // thread-safe, and NSPR will only ever be initialized once. |
42 CRYPTO_EXPORT void EnsureNSPRInit(); | 38 CRYPTO_EXPORT void EnsureNSPRInit(); |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
86 // Check if the current NSS version is greater than or equals to |version|. | 82 // Check if the current NSS version is greater than or equals to |version|. |
87 // A sample version string is "3.12.3". | 83 // A sample version string is "3.12.3". |
88 bool CheckNSSVersion(const char* version); | 84 bool CheckNSSVersion(const char* version); |
89 | 85 |
90 #if defined(OS_CHROMEOS) | 86 #if defined(OS_CHROMEOS) |
91 // Open the r/w nssdb that's stored inside the user's encrypted home | 87 // Open the r/w nssdb that's stored inside the user's encrypted home |
92 // directory. This is the default slot returned by | 88 // directory. This is the default slot returned by |
93 // GetPublicNSSKeySlot(). | 89 // GetPublicNSSKeySlot(). |
94 CRYPTO_EXPORT void OpenPersistentNSSDB(); | 90 CRYPTO_EXPORT void OpenPersistentNSSDB(); |
95 | 91 |
96 // A delegate class that we can use to access the cros API for | |
97 // communication with cryptohomed and the TPM. | |
98 class CRYPTO_EXPORT TPMTokenInfoDelegate { | |
99 public: | |
100 // A callback to handle the result of RequestIsTokenReady. | |
101 typedef base::Callback<void(bool result)> RequestIsTokenReadyCallback; | |
102 | |
103 TPMTokenInfoDelegate(); | |
104 virtual ~TPMTokenInfoDelegate(); | |
105 | |
106 // Runs |callback| with true if the TPM and PKCS#11 token slot is ready to be | |
107 // used. | |
108 // If IsTokenAvailable() is false this should run |callback| with false. | |
109 // If IsTokenAvailable() is true, this should eventually run |callback| with | |
110 // true. | |
111 virtual void RequestIsTokenReady(RequestIsTokenReadyCallback callback) const | |
112 = 0; | |
113 | |
114 // Fetches token properties. TODO(stevenjb): make this interface asynchronous | |
115 // so that the implementation does not have to be blocking. | |
116 virtual void GetTokenInfo(std::string* token_name, | |
117 std::string* user_pin) const = 0; | |
118 }; | |
119 | |
120 // Indicates that NSS should load the Chaps library so that we | 92 // Indicates that NSS should load the Chaps library so that we |
121 // can access the TPM through NSS. Once this is called, | 93 // can access the TPM through NSS. Once this is called, |
122 // GetPrivateNSSKeySlot() will return the TPM slot if one was found. | 94 // GetPrivateNSSKeySlot() will return the TPM slot if one was found. |
123 // Takes ownership of the passed-in delegate object so it can access | 95 CRYPTO_EXPORT void EnableTPMTokenForNSS(); |
124 // the cros library to talk to cryptohomed. | |
125 CRYPTO_EXPORT void EnableTPMTokenForNSS(TPMTokenInfoDelegate* delegate); | |
126 | 96 |
127 // Get name and user PIN for the built-in TPM token on ChromeOS. | 97 // Get name and user PIN for the built-in TPM token on ChromeOS. |
128 // Either one can safely be NULL. Should only be called after | 98 // Either one can safely be NULL. Should only be called after |
129 // EnableTPMTokenForNSS has been called with a non-null delegate. | 99 // EnableTPMTokenForNSS has been called with a non-null delegate. |
130 CRYPTO_EXPORT void GetTPMTokenInfo(std::string* token_name, | 100 CRYPTO_EXPORT void GetTPMTokenInfo(std::string* token_name, |
131 std::string* user_pin); | 101 std::string* user_pin); |
132 | 102 |
133 // Returns true if the TPM is owned and PKCS#11 initialized with the | 103 // Returns true if the TPM is owned and PKCS#11 initialized with the |
134 // user and security officer PINs, and has been enabled in NSS by | 104 // user and security officer PINs, and has been enabled in NSS by |
135 // calling EnableTPMForNSS, and Chaps has been successfully | 105 // calling EnableTPMForNSS, and Chaps has been successfully |
136 // loaded into NSS. | 106 // loaded into NSS. |
137 CRYPTO_EXPORT bool IsTPMTokenReady(); | 107 CRYPTO_EXPORT bool IsTPMTokenReady(); |
138 | 108 |
139 // Initialize the TPM token. Does nothing if it is already initialized. | 109 // Initialize the TPM token. Does nothing if it is already initialized. |
140 CRYPTO_EXPORT void InitializeTPMToken(InitializeTPMTokenCallback callback); | 110 CRYPTO_EXPORT bool InitializeTPMToken(const std::string& token_name, |
| 111 const std::string& user_pin); |
141 | 112 |
142 // Gets supplemental user key. Creates one in NSS database if it does not exist. | 113 // Gets supplemental user key. Creates one in NSS database if it does not exist. |
143 // The supplemental user key is used for AES encryption of user data that is | 114 // The supplemental user key is used for AES encryption of user data that is |
144 // stored and protected by cryptohome. This additional layer of encryption of | 115 // stored and protected by cryptohome. This additional layer of encryption of |
145 // provided to ensure that sensitive data wouldn't be exposed in plain text in | 116 // provided to ensure that sensitive data wouldn't be exposed in plain text in |
146 // case when an attacker would somehow gain access to all content within | 117 // case when an attacker would somehow gain access to all content within |
147 // cryptohome. | 118 // cryptohome. |
148 CRYPTO_EXPORT SymmetricKey* GetSupplementalUserKey(); | 119 CRYPTO_EXPORT SymmetricKey* GetSupplementalUserKey(); |
149 #endif | 120 #endif |
150 | 121 |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
183 private: | 154 private: |
184 base::Lock *lock_; | 155 base::Lock *lock_; |
185 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); | 156 DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock); |
186 }; | 157 }; |
187 | 158 |
188 #endif // defined(USE_NSS) | 159 #endif // defined(USE_NSS) |
189 | 160 |
190 } // namespace crypto | 161 } // namespace crypto |
191 | 162 |
192 #endif // CRYPTO_NSS_UTIL_H_ | 163 #endif // CRYPTO_NSS_UTIL_H_ |
OLD | NEW |