NSS Channel ID: don't check ECC support on every socket creation.

crypto/ec_private_key_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/ec_private_key.h"
 
 extern "C" {
 // Work around NSS missing SEC_BEGIN_PROTOS in secmodt.h.  This must come before
 // other NSS headers.
 #include <secmodt.h>
 }
 
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
+#include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 #include "crypto/scoped_nss_types.h"
 #include "crypto/third_party/nss/chromium-nss.h"
 
 namespace {
 
+PK11SlotInfo* GetKeySlot() {
+  return crypto::GetPublicNSSKeySlot();
+}
+
+class EllipticCurveSupportChecker {
+ public:
+  EllipticCurveSupportChecker() {
+    // NOTE: we can do this check here only because we use the NSS internal
+    // slot.  If we support other slots in the future, checking whether they
+    // support ECDSA may block NSS, and the value may also change as devices are
+    // inserted/removed, so we would need to re-check on every use.
+    crypto::EnsureNSSInit();
+    crypto::ScopedPK11Slot slot(GetKeySlot());
+    supported_ = PK11_DoesMechanism(slot.get(), CKM_EC_KEY_PAIR_GEN) &&
+        PK11_DoesMechanism(slot.get(), CKM_ECDSA);
+  }
+
+  bool Supported() {
+    return supported_;
+  }
+
+ private:
+  bool supported_;
+};
+
+static base::LazyInstance<EllipticCurveSupportChecker>::Leaky
+    g_elliptic_curve_supported = LAZY_INSTANCE_INITIALIZER;
+
 // Copied from rsa_private_key_nss.cc.
 static bool ReadAttribute(SECKEYPrivateKey* key,
                           CK_ATTRIBUTE_TYPE type,
                           std::vector<uint8>* output) {
   SECItem item;
   SECStatus rv;
   rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, type, &item);
   if (rv != SECSuccess) {
     DLOG(ERROR) << "PK11_ReadRawAttribute: " << PORT_GetError();
     return false;
   }
 
   output->assign(item.data, item.data + item.len);
   SECITEM_FreeItem(&item, PR_FALSE);
   return true;
 }
 
 }  // namespace
 
 namespace crypto {
 
 ECPrivateKey::~ECPrivateKey() {
   if (key_)
     SECKEY_DestroyPrivateKey(key_);
   if (public_key_)
     SECKEY_DestroyPublicKey(public_key_);
 }
 
 // static
+bool ECPrivateKey::IsSupported() {
+  return g_elliptic_curve_supported.Get().Supported();
+}
+
+// static
 ECPrivateKey* ECPrivateKey::Create() {
   return CreateWithParams(PR_FALSE /* not permanent */,
                           PR_FALSE /* not sensitive */);
 }
 
 // static
 ECPrivateKey* ECPrivateKey::CreateSensitive() {
 #if defined(USE_NSS)
   return CreateWithParams(PR_TRUE /* permanent */,
                           PR_TRUE /* sensitive */);
@@ skipping 41 matching lines @@
 // static
 bool ECPrivateKey::ImportFromEncryptedPrivateKeyInfo(
     const std::string& password,
     const uint8* encrypted_private_key_info,
     size_t encrypted_private_key_info_len,
     CERTSubjectPublicKeyInfo* decoded_spki,
     bool permanent,
     bool sensitive,
     SECKEYPrivateKey** key,
     SECKEYPublicKey** public_key) {
-  ScopedPK11Slot slot(GetPublicNSSKeySlot());
+  ScopedPK11Slot slot(GetKeySlot());
   if (!slot.get())
     return false;
 
   *public_key = SECKEY_ExtractPublicKey(decoded_spki);
 
   if (!*public_key) {
     DLOG(ERROR) << "SECKEY_ExtractPublicKey: " << PORT_GetError();
     return false;
   }
 
@@ skipping 112 matching lines @@
 
 ECPrivateKey::ECPrivateKey() : key_(NULL), public_key_(NULL) {}
 
 // static
 ECPrivateKey* ECPrivateKey::CreateWithParams(bool permanent,
                                              bool sensitive) {
   EnsureNSSInit();
 
   scoped_ptr<ECPrivateKey> result(new ECPrivateKey);
 
-  ScopedPK11Slot slot(GetPrivateNSSKeySlot());
+  ScopedPK11Slot slot(GetKeySlot());
   if (!slot.get())
     return NULL;
 
   SECOidData* oid_data = SECOID_FindOIDByTag(SEC_OID_SECG_EC_SECP256R1);
   if (!oid_data) {
     DLOG(ERROR) << "SECOID_FindOIDByTag: " << PORT_GetError();
     return NULL;
   }
 
   // SECKEYECParams is a SECItem containing the DER encoded ASN.1 ECParameters
@@ skipping 61 matching lines @@
 
   SECKEY_DestroySubjectPublicKeyInfo(decoded_spki);
 
   if (success)
     return result.release();
 
   return NULL;
 }
 
 }  // namespace crypto