1 // Copyright 2020 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "crypto/chaps_support.h"
6
7 #include <dlfcn.h>
8 #include <secmod.h>
9 #include <secmodt.h>
10
11 #include <string_view>
12
13 #include "base/logging.h"
14 #include "base/memory/raw_ptr_exclusion.h"
15 #include "base/memory/stack_allocated.h"
16 #include "base/threading/scoped_blocking_call.h"
17 #include "crypto/scoped_nss_types.h"
18 #include "nss_util_internal.h"
19
20 namespace crypto {
21
22 namespace {
23
24 // Constants for loading the Chrome OS TPM-backed PKCS #11 library.
25 const char kChapsModuleName[] = "Chaps";
26 const char kChapsPath[] = "libchaps.so";
27
28 class ScopedChapsLoadFixup {
29 STACK_ALLOCATED();
30
31 public:
32 ScopedChapsLoadFixup();
33 ~ScopedChapsLoadFixup();
34
35 private:
36 #if defined(COMPONENT_BUILD)
37 // This field stores a handle and is not a pointer to PA memory.
38 // Also, this class is always stack-allocated and visibility is limited.
39 // Hence no benefit from using raw_ptr<void>.
40 RAW_PTR_EXCLUSION void* chaps_handle_;
41 #endif
42 };
43
44 #if defined(COMPONENT_BUILD)
45
ScopedChapsLoadFixup()46 ScopedChapsLoadFixup::ScopedChapsLoadFixup() {
47 // HACK: libchaps links the system protobuf and there are symbol conflicts
48 // with the bundled copy. Load chaps with RTLD_DEEPBIND to workaround.
49 chaps_handle_ = dlopen(kChapsPath, RTLD_LOCAL | RTLD_NOW | RTLD_DEEPBIND);
50 }
51
~ScopedChapsLoadFixup()52 ScopedChapsLoadFixup::~ScopedChapsLoadFixup() {
53 // LoadNSSModule() will have taken a 2nd reference.
54 if (chaps_handle_)
55 dlclose(chaps_handle_);
56 }
57
58 #else
59
60 ScopedChapsLoadFixup::ScopedChapsLoadFixup() = default;
61 ScopedChapsLoadFixup::~ScopedChapsLoadFixup() = default;
62
63 #endif // defined(COMPONENT_BUILD)
64
65 } // namespace
66
LoadChaps()67 SECMODModule* LoadChaps() {
68 // NSS functions may reenter //net via extension hooks. If the reentered
69 // code needs to synchronously wait for a task to run but the thread pool in
70 // which that task must run doesn't have enough threads to schedule it, a
71 // deadlock occurs. To prevent that, the base::ScopedBlockingCall below
72 // increments the thread pool capacity for the duration of the TPM
73 // initialization.
74 base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
75 base::BlockingType::WILL_BLOCK);
76
77 ScopedChapsLoadFixup chaps_loader;
78
79 DVLOG(3) << "Loading chaps...";
80 return LoadNSSModule(
81 kChapsModuleName, kChapsPath,
82 // For more details on these parameters, see:
83 // https://developer.mozilla.org/en/PKCS11_Module_Specs
84 // slotFlags=[PublicCerts] -- Certificates and public keys can be
85 // read from this slot without requiring a call to C_Login.
86 // askpw=only -- Only authenticate to the token when necessary.
87 "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\"");
88 }
89
GetChapsSlot(SECMODModule * chaps_module,CK_SLOT_ID slot_id)90 ScopedPK11Slot GetChapsSlot(SECMODModule* chaps_module, CK_SLOT_ID slot_id) {
91 DCHECK(chaps_module);
92
93 // NSS functions may reenter //net via extension hooks. If the reentered
94 // code needs to synchronously wait for a task to run but the thread pool in
95 // which that task must run doesn't have enough threads to schedule it, a
96 // deadlock occurs. To prevent that, the base::ScopedBlockingCall below
97 // increments the thread pool capacity for the duration of the TPM
98 // initialization.
99 base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
100 base::BlockingType::WILL_BLOCK);
101
102 DVLOG(3) << "Poking chaps module.";
103 SECStatus rv = SECMOD_UpdateSlotList(chaps_module);
104 if (rv != SECSuccess)
105 LOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError();
106
107 ScopedPK11Slot slot =
108 ScopedPK11Slot(SECMOD_LookupSlot(chaps_module->moduleID, slot_id));
109 if (!slot)
110 LOG(ERROR) << "TPM slot " << slot_id << " not found.";
111 return slot;
112 }
113
IsChapsModule(SECMODModule * pk11_module)114 bool IsChapsModule(SECMODModule* pk11_module) {
115 return pk11_module && std::string_view(pk11_module->commonName) ==
116 std::string_view(kChapsModuleName);
117 }
118
IsSlotProvidedByChaps(PK11SlotInfo * slot)119 bool IsSlotProvidedByChaps(PK11SlotInfo* slot) {
120 return slot && IsChapsModule(PK11_GetModule(slot));
121 }
122
123 } // namespace crypto
124