1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
// Copyright (c) 2008-2009 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "base/nss_init.h"
#include <dlfcn.h>
#include <nss.h>
#include <plarena.h>
#include <prerror.h>
#include <prinit.h>
#include <pk11pub.h>
#include <secmod.h>
#include <ssl.h>
#include "base/file_util.h"
#include "base/logging.h"
#include "base/singleton.h"
#include "base/string_util.h"
namespace {
std::string GetDefaultConfigDirectory() {
const char* home = getenv("HOME");
if (home == NULL) {
LOG(ERROR) << "$HOME is not set.";
return "";
}
FilePath dir(home);
dir = dir.AppendASCII(".pki").AppendASCII("nssdb");
if (!file_util::CreateDirectory(dir)) {
LOG(ERROR) << "Failed to create ~/.pki/nssdb directory.";
return "";
}
return dir.value();
}
// Load nss's built-in root certs.
SECMODModule *InitDefaultRootCerts() {
const char* kModulePath = "libnssckbi.so";
char modparams[1024];
snprintf(modparams, sizeof(modparams),
"name=\"Root Certs\" library=\"%s\"", kModulePath);
SECMODModule *root = SECMOD_LoadUserModule(modparams, NULL, PR_FALSE);
if (root)
return root;
// Aw, snap. Can't find/load root cert shared library.
// This will make it hard to talk to anybody via https.
NOTREACHED();
return NULL;
}
// A singleton to initialize/deinitialize NSPR.
// Separate from the NSS singleton because we initialize NSPR on the UI thread.
class NSPRInitSingleton {
public:
NSPRInitSingleton() {
PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
}
~NSPRInitSingleton() {
PRStatus prstatus = PR_Cleanup();
if (prstatus != PR_SUCCESS) {
LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
}
}
};
class NSSInitSingleton {
public:
NSSInitSingleton() {
base::EnsureNSPRInit();
SECStatus status = SECFailure;
std::string database_dir = GetDefaultConfigDirectory();
if (!database_dir.empty()) {
// Initialize with a persistant database (~/.pki/nssdb).
// Use "sql:" which can be shared by multiple processes safely.
std::string nss_config_dir =
StringPrintf("sql:%s", database_dir.c_str());
status = NSS_InitReadWrite(nss_config_dir.c_str());
if (status != SECSuccess) {
LOG(ERROR) << "Error initializing NSS with a persistent "
"database (" << nss_config_dir
<< "): NSS error code " << PR_GetError();
}
}
if (status != SECSuccess) {
LOG(WARNING) << "Initialize NSS without a persistent database "
"(~/.pki/nssdb).";
status = NSS_NoDB_Init(NULL);
if (status != SECSuccess) {
LOG(ERROR) << "Error initializing NSS without a persistent "
"database: NSS error code " << PR_GetError();
}
}
// If we haven't initialized the password for the NSS databases,
// initialize an empty-string password so that we don't need to
// log in.
PK11SlotInfo* slot = PK11_GetInternalKeySlot();
if (slot) {
if (PK11_NeedUserInit(slot))
PK11_InitPin(slot, NULL, NULL);
PK11_FreeSlot(slot);
}
root_ = InitDefaultRootCerts();
NSS_SetDomesticPolicy();
#if defined(USE_SYSTEM_SSL)
// Use late binding to avoid scary but benign warning
// "Symbol `SSL_ImplementedCiphers' has different size in shared object,
// consider re-linking"
const PRUint16* pSSL_ImplementedCiphers = static_cast<const PRUint16*>(
dlsym(RTLD_DEFAULT, "SSL_ImplementedCiphers"));
if (pSSL_ImplementedCiphers == NULL) {
NOTREACHED() << "Can't get list of supported ciphers";
return;
}
#else
#define pSSL_ImplementedCiphers SSL_ImplementedCiphers
#endif
// Explicitly enable exactly those ciphers with keys of at least 80 bits
for (int i = 0; i < SSL_NumImplementedCiphers; i++) {
SSLCipherSuiteInfo info;
if (SSL_GetCipherSuiteInfo(pSSL_ImplementedCiphers[i], &info,
sizeof(info)) == SECSuccess) {
SSL_CipherPrefSetDefault(pSSL_ImplementedCiphers[i],
(info.effectiveKeyBits >= 80));
}
}
// Enable SSL
SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE);
// All other SSL options are set per-session by SSLClientSocket.
}
~NSSInitSingleton() {
if (root_) {
SECMOD_UnloadUserModule(root_);
SECMOD_DestroyModule(root_);
root_ = NULL;
}
// Have to clear the cache, or NSS_Shutdown fails with SEC_ERROR_BUSY
SSL_ClearSessionCache();
SECStatus status = NSS_Shutdown();
if (status != SECSuccess) {
// We LOG(INFO) because this failure is relatively harmless
// (leaking, but we're shutting down anyway).
LOG(INFO) << "NSS_Shutdown failed; see "
"http://code.google.com/p/chromium/issues/detail?id=4609";
}
PL_ArenaFinish();
}
private:
SECMODModule *root_;
};
} // namespace
namespace base {
void EnsureNSPRInit() {
Singleton<NSPRInitSingleton>::get();
}
void EnsureNSSInit() {
Singleton<NSSInitSingleton>::get();
}
} // namespace base
|
