1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
// Copyright 2013 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/cert/nss_cert_database_chromeos.h"
#include <cert.h>
#include <certdb.h>
#include <pk11pub.h>
#include <algorithm>
#include <memory>
#include <utility>
#include "base/bind.h"
#include "base/callback.h"
#include "base/location.h"
#include "base/stl_util.h"
#include "base/strings/string_number_conversions.h"
#include "base/task_scheduler/post_task.h"
#include "base/task_scheduler/task_scheduler.h"
#include "base/threading/scoped_blocking_call.h"
namespace net {
NSSCertDatabaseChromeOS::NSSCertDatabaseChromeOS(
crypto::ScopedPK11Slot public_slot,
crypto::ScopedPK11Slot private_slot)
: NSSCertDatabase(std::move(public_slot), std::move(private_slot)) {
// By default, don't use a system slot. Only if explicitly set by
// SetSystemSlot, the system slot will be used.
profile_filter_.Init(GetPublicSlot(),
GetPrivateSlot(),
crypto::ScopedPK11Slot() /* no system slot */);
}
NSSCertDatabaseChromeOS::~NSSCertDatabaseChromeOS() = default;
void NSSCertDatabaseChromeOS::SetSystemSlot(
crypto::ScopedPK11Slot system_slot) {
system_slot_ = std::move(system_slot);
profile_filter_.Init(GetPublicSlot(), GetPrivateSlot(), GetSystemSlot());
}
ScopedCERTCertificateList NSSCertDatabaseChromeOS::ListCertsSync() {
LogUserCertificates("ListCertsSync");
return ListCertsImpl(profile_filter_);
}
void NSSCertDatabaseChromeOS::ListCerts(
const NSSCertDatabase::ListCertsCallback& callback) {
LogUserCertificates("ListCerts");
base::PostTaskWithTraitsAndReplyWithResult(
FROM_HERE,
{base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
base::Bind(&NSSCertDatabaseChromeOS::ListCertsImpl, profile_filter_),
callback);
}
crypto::ScopedPK11Slot NSSCertDatabaseChromeOS::GetSystemSlot() const {
if (system_slot_)
return crypto::ScopedPK11Slot(PK11_ReferenceSlot(system_slot_.get()));
return crypto::ScopedPK11Slot();
}
void NSSCertDatabaseChromeOS::LogUserCertificates(
const std::string& log_reason) const {
// Unit tests may not have a TaskScheduler instance.
if (!base::TaskScheduler::GetInstance())
return;
crypto::ScopedPK11Slot system_slot(GetSystemSlot());
base::PostTaskWithTraits(
FROM_HERE,
{base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
base::BindOnce(&NSSCertDatabaseChromeOS::LogUserCertificatesImpl,
log_reason, base::Passed(&system_slot)));
}
void NSSCertDatabaseChromeOS::ListModules(
std::vector<crypto::ScopedPK11Slot>* modules,
bool need_rw) const {
NSSCertDatabase::ListModules(modules, need_rw);
size_t pre_size = modules->size();
base::EraseIf(*modules,
NSSProfileFilterChromeOS::ModuleNotAllowedForProfilePredicate(
profile_filter_));
DVLOG(1) << "filtered " << pre_size - modules->size() << " of " << pre_size
<< " modules";
}
ScopedCERTCertificateList NSSCertDatabaseChromeOS::ListCertsImpl(
const NSSProfileFilterChromeOS& profile_filter) {
// This method may acquire the NSS lock or reenter this code via extension
// hooks (such as smart card UI). To ensure threads are not starved or
// deadlocked, the base::ScopedBlockingCall below increments the thread pool
// capacity if this method takes too much time to run.
base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::MAY_BLOCK);
ScopedCERTCertificateList certs(
NSSCertDatabase::ListCertsImpl(crypto::ScopedPK11Slot()));
size_t pre_size = certs.size();
base::EraseIf(certs,
NSSProfileFilterChromeOS::CertNotAllowedForProfilePredicate(
profile_filter));
DVLOG(1) << "filtered " << pre_size - certs.size() << " of " << pre_size
<< " certs";
return certs;
}
// static
void NSSCertDatabaseChromeOS::LogUserCertificatesImpl(
const std::string& log_reason,
crypto::ScopedPK11Slot system_slot) {
// See ListCertsImpl for details on why we use |MAY_BLOCK|.
base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::MAY_BLOCK);
bool system_slot_present = system_slot != nullptr;
VLOG(0) << "UserCertLogging: Invoked with log_reason=" << log_reason
<< ", system_slot_present=" << system_slot_present;
CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, nullptr);
CERTCertListNode* node;
for (node = CERT_LIST_HEAD(cert_list); !CERT_LIST_END(node, cert_list);
node = CERT_LIST_NEXT(node)) {
CERTCertificate* cert = node->cert;
// Skip if the certificate is not a user certificate, or if this can't be
// determined.
CERTCertTrust nss_trust;
SECStatus rv = CERT_GetCertTrust(cert, &nss_trust);
if (rv != SECSuccess) {
LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
continue;
}
unsigned int all_flags = nss_trust.sslFlags | nss_trust.emailFlags |
nss_trust.objectSigningFlags;
// This logic is from |mozilla_security_manager::GetCertType|.
bool is_user_cert = cert->nickname && (all_flags & CERTDB_USER);
if (!is_user_cert)
continue;
// Get names from the certificate. Only log issuer CommonName for now.
std::string issuer_name = GetCertIssuerCommonName(cert);
// Get information about the slot the certificate is on.
PK11SlotInfo* slot = cert->slot;
bool is_hardware_backed = slot && PK11_IsHW(slot);
bool is_on_system_slot = slot == system_slot.get();
int cert_slot_id = static_cast<int>(PK11_GetSlotID(slot));
// Get information about the corresponding private key: the slot id it is on
// and the pkcs11 object ID.
int key_slot_id = -1;
std::string key_pkcs11_id;
SECKEYPrivateKey* private_key =
PK11_FindKeyByAnyCert(cert, nullptr /* wincx */);
if (private_key) {
key_slot_id = static_cast<int>(PK11_GetSlotID(private_key->pkcs11Slot));
// Get the CKA_ID attribute for a key.
SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(private_key);
if (sec_item) {
key_pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
SECITEM_FreeItem(sec_item, PR_TRUE);
}
SECKEY_DestroyPrivateKey(private_key);
}
VLOG(0) << "UserCertLogging: Cert with issuer=" << issuer_name
<< ", cert_slot_id=" << cert_slot_id
<< ", is_hw_backed=" << is_hardware_backed
<< ", is_on_system_slot=" << is_on_system_slot
<< ", key_slot_id=" << key_slot_id
<< ", key_pkcs11_id=" << key_pkcs11_id;
}
CERT_DestroyCertList(cert_list);
}
} // namespace net
|
