net/cert/nss_cert_database.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/nss_cert_database.h"
   6
   7 #include <cert.h>
   8 #include <certdb.h>
   9 #include <keyhi.h>
  10 #include <pk11pub.h>
  11 #include <secmod.h>
  12
  13 #include "base/bind.h"
  14 #include "base/callback.h"
  15 #include "base/lazy_instance.h"
  16 #include "base/logging.h"
  17 #include "base/memory/scoped_ptr.h"
  18 #include "base/observer_list_threadsafe.h"
  19 #include "base/task_runner.h"
  20 #include "base/task_runner_util.h"
  21 #include "base/threading/worker_pool.h"
  22 #include "crypto/nss_util.h"
  23 #include "crypto/nss_util_internal.h"
  24 #include "crypto/scoped_nss_types.h"
  25 #include "net/base/crypto_module.h"
  26 #include "net/base/net_errors.h"
  27 #include "net/cert/cert_database.h"
  28 #include "net/cert/x509_certificate.h"
  29 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
  30 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
  31
  32 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
  33 // the new name of the macro.
  34 #if !defined(CERTDB_TERMINAL_RECORD)
  35 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER
  36 #endif
  37
  38 // PSM = Mozilla's Personal Security Manager.
  39 namespace psm = mozilla_security_manager;
  40
  41 namespace net {
  42
  43 namespace {
  44
  45 base::LazyInstance<NSSCertDatabase>::Leaky
  46     g_nss_cert_database = LAZY_INSTANCE_INITIALIZER;
  47
  48 }  // namespace
  49
  50 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
  51     const scoped_refptr<X509Certificate>& cert,
  52     int err)
  53     : certificate(cert), net_error(err) {}
  54
  55 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
  56
  57 // static
  58 NSSCertDatabase* NSSCertDatabase::GetInstance() {
  59   // TODO(mattm): Remove this ifdef guard once the linux impl of
  60   // GetNSSCertDatabaseForResourceContext does not call GetInstance.
  61 #if defined(OS_CHROMEOS)
  62   LOG(ERROR) << "NSSCertDatabase::GetInstance() is deprecated."
  63              << "See http://crbug.com/329735.";
  64 #endif
  65   return &g_nss_cert_database.Get();
  66 }
  67
  68 NSSCertDatabase::NSSCertDatabase()
  69     : observer_list_(new ObserverListThreadSafe<Observer>),
  70       weak_factory_(this) {
  71   // This also makes sure that NSS has been initialized.
  72   CertDatabase::GetInstance()->ObserveNSSCertDatabase(this);
  73
  74   psm::EnsurePKCS12Init();
  75 }
  76
  77 NSSCertDatabase::~NSSCertDatabase() {}
  78
  79 void NSSCertDatabase::ListCertsSync(CertificateList* certs) {
  80   ListCertsImpl(crypto::ScopedPK11Slot(), certs);
  81 }
  82
  83 void NSSCertDatabase::ListCerts(
  84     const base::Callback<void(scoped_ptr<CertificateList> certs)>& callback) {
  85   scoped_ptr<CertificateList> certs(new CertificateList());
  86
  87   // base::Passed will NULL out |certs|, so cache the underlying pointer here.
  88   CertificateList* raw_certs = certs.get();
  89   GetSlowTaskRunner()->PostTaskAndReply(
  90       FROM_HERE,
  91       base::Bind(&NSSCertDatabase::ListCertsImpl,
  92                  base::Passed(crypto::ScopedPK11Slot()),
  93                  base::Unretained(raw_certs)),
  94       base::Bind(callback, base::Passed(&certs)));
  95 }
  96
  97 void NSSCertDatabase::ListCertsInSlot(const ListCertsCallback& callback,
  98                                       PK11SlotInfo* slot) {
  99   DCHECK(slot);
 100   scoped_ptr<CertificateList> certs(new CertificateList());
 101
 102   // base::Passed will NULL out |certs|, so cache the underlying pointer here.
 103   CertificateList* raw_certs = certs.get();
 104   GetSlowTaskRunner()->PostTaskAndReply(
 105       FROM_HERE,
 106       base::Bind(&NSSCertDatabase::ListCertsImpl,
 107                  base::Passed(crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot))),
 108                  base::Unretained(raw_certs)),
 109       base::Bind(callback, base::Passed(&certs)));
 110 }
 111
 112 crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
 113   return crypto::ScopedPK11Slot(crypto::GetPublicNSSKeySlot());
 114 }
 115
 116 crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
 117   return crypto::ScopedPK11Slot(crypto::GetPrivateNSSKeySlot());
 118 }
 119
 120 CryptoModule* NSSCertDatabase::GetPublicModule() const {
 121   crypto::ScopedPK11Slot slot(GetPublicSlot());
 122   return CryptoModule::CreateFromHandle(slot.get());
 123 }
 124
 125 CryptoModule* NSSCertDatabase::GetPrivateModule() const {
 126   crypto::ScopedPK11Slot slot(GetPrivateSlot());
 127   return CryptoModule::CreateFromHandle(slot.get());
 128 }
 129
 130 void NSSCertDatabase::ListModules(CryptoModuleList* modules,
 131                                   bool need_rw) const {
 132   modules->clear();
 133
 134   // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
 135   crypto::ScopedPK11SlotList slot_list(
 136       PK11_GetAllTokens(CKM_INVALID_MECHANISM,
 137                         need_rw ? PR_TRUE : PR_FALSE,  // needRW
 138                         PR_TRUE,                       // loadCerts (unused)
 139                         NULL));                        // wincx
 140   if (!slot_list) {
 141     LOG(ERROR) << "PK11_GetAllTokens failed: " << PORT_GetError();
 142     return;
 143   }
 144
 145   PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list.get());
 146   while (slot_element) {
 147     modules->push_back(CryptoModule::CreateFromHandle(slot_element->slot));
 148     slot_element = PK11_GetNextSafe(slot_list.get(), slot_element,
 149                                     PR_FALSE);  // restart
 150   }
 151 }
 152
 153 int NSSCertDatabase::ImportFromPKCS12(
 154     CryptoModule* module,
 155     const std::string& data,
 156     const base::string16& password,
 157     bool is_extractable,
 158     net::CertificateList* imported_certs) {
 159   DVLOG(1) << __func__ << " "
 160            << PK11_GetModuleID(module->os_module_handle()) << ":"
 161            << PK11_GetSlotID(module->os_module_handle());
 162   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
 163                                         data.data(), data.size(),
 164                                         password,
 165                                         is_extractable,
 166                                         imported_certs);
 167   if (result == net::OK)
 168     NotifyObserversOfCertAdded(NULL);
 169
 170   return result;
 171 }
 172
 173 int NSSCertDatabase::ExportToPKCS12(
 174     const CertificateList& certs,
 175     const base::string16& password,
 176     std::string* output) const {
 177   return psm::nsPKCS12Blob_Export(output, certs, password);
 178 }
 179
 180 X509Certificate* NSSCertDatabase::FindRootInList(
 181     const CertificateList& certificates) const {
 182   DCHECK_GT(certificates.size(), 0U);
 183
 184   if (certificates.size() == 1)
 185     return certificates[0].get();
 186
 187   X509Certificate* cert0 = certificates[0].get();
 188   X509Certificate* cert1 = certificates[1].get();
 189   X509Certificate* certn_2 = certificates[certificates.size() - 2].get();
 190   X509Certificate* certn_1 = certificates[certificates.size() - 1].get();
 191
 192   if (CERT_CompareName(&cert1->os_cert_handle()->issuer,
 193                        &cert0->os_cert_handle()->subject) == SECEqual)
 194     return cert0;
 195   if (CERT_CompareName(&certn_2->os_cert_handle()->issuer,
 196                        &certn_1->os_cert_handle()->subject) == SECEqual)
 197     return certn_1;
 198
 199   LOG(WARNING) << "certificate list is not a hierarchy";
 200   return cert0;
 201 }
 202
 203 bool NSSCertDatabase::ImportCACerts(const CertificateList& certificates,
 204                                     TrustBits trust_bits,
 205                                     ImportCertFailureList* not_imported) {
 206   crypto::ScopedPK11Slot slot(GetPublicSlot());
 207   X509Certificate* root = FindRootInList(certificates);
 208   bool success = psm::ImportCACerts(
 209       slot.get(), certificates, root, trust_bits, not_imported);
 210   if (success)
 211     NotifyObserversOfCACertChanged(NULL);
 212
 213   return success;
 214 }
 215
 216 bool NSSCertDatabase::ImportServerCert(const CertificateList& certificates,
 217                                        TrustBits trust_bits,
 218                                        ImportCertFailureList* not_imported) {
 219   crypto::ScopedPK11Slot slot(GetPublicSlot());
 220   return psm::ImportServerCert(
 221       slot.get(), certificates, trust_bits, not_imported);
 222 }
 223
 224 NSSCertDatabase::TrustBits NSSCertDatabase::GetCertTrust(
 225     const X509Certificate* cert,
 226     CertType type) const {
 227   CERTCertTrust trust;
 228   SECStatus srv = CERT_GetCertTrust(cert->os_cert_handle(), &trust);
 229   if (srv != SECSuccess) {
 230     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
 231     return TRUST_DEFAULT;
 232   }
 233   // We define our own more "friendly" TrustBits, which means we aren't able to
 234   // round-trip all possible NSS trust flag combinations.  We try to map them in
 235   // a sensible way.
 236   switch (type) {
 237     case CA_CERT: {
 238       const unsigned kTrustedCA = CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA;
 239       const unsigned kCAFlags = kTrustedCA | CERTDB_TERMINAL_RECORD;
 240
 241       TrustBits trust_bits = TRUST_DEFAULT;
 242       if ((trust.sslFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 243         trust_bits |= DISTRUSTED_SSL;
 244       else if (trust.sslFlags & kTrustedCA)
 245         trust_bits |= TRUSTED_SSL;
 246
 247       if ((trust.emailFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 248         trust_bits |= DISTRUSTED_EMAIL;
 249       else if (trust.emailFlags & kTrustedCA)
 250         trust_bits |= TRUSTED_EMAIL;
 251
 252       if ((trust.objectSigningFlags & kCAFlags) == CERTDB_TERMINAL_RECORD)
 253         trust_bits |= DISTRUSTED_OBJ_SIGN;
 254       else if (trust.objectSigningFlags & kTrustedCA)
 255         trust_bits |= TRUSTED_OBJ_SIGN;
 256
 257       return trust_bits;
 258     }
 259     case SERVER_CERT:
 260       if (trust.sslFlags & CERTDB_TERMINAL_RECORD) {
 261         if (trust.sslFlags & CERTDB_TRUSTED)
 262           return TRUSTED_SSL;
 263         return DISTRUSTED_SSL;
 264       }
 265       return TRUST_DEFAULT;
 266     default:
 267       return TRUST_DEFAULT;
 268   }
 269 }
 270
 271 bool NSSCertDatabase::IsUntrusted(const X509Certificate* cert) const {
 272   CERTCertTrust nsstrust;
 273   SECStatus rv = CERT_GetCertTrust(cert->os_cert_handle(), &nsstrust);
 274   if (rv != SECSuccess) {
 275     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
 276     return false;
 277   }
 278
 279   // The CERTCertTrust structure contains three trust records:
 280   // sslFlags, emailFlags, and objectSigningFlags.  The three
 281   // trust records are independent of each other.
 282   //
 283   // If the CERTDB_TERMINAL_RECORD bit in a trust record is set,
 284   // then that trust record is a terminal record.  A terminal
 285   // record is used for explicit trust and distrust of an
 286   // end-entity or intermediate CA cert.
 287   //
 288   // In a terminal record, if neither CERTDB_TRUSTED_CA nor
 289   // CERTDB_TRUSTED is set, then the terminal record means
 290   // explicit distrust.  On the other hand, if the terminal
 291   // record has either CERTDB_TRUSTED_CA or CERTDB_TRUSTED bit
 292   // set, then the terminal record means explicit trust.
 293   //
 294   // For a root CA, the trust record does not have
 295   // the CERTDB_TERMINAL_RECORD bit set.
 296
 297   static const unsigned int kTrusted = CERTDB_TRUSTED_CA | CERTDB_TRUSTED;
 298   if ((nsstrust.sslFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 299       (nsstrust.sslFlags & kTrusted) == 0) {
 300     return true;
 301   }
 302   if ((nsstrust.emailFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 303       (nsstrust.emailFlags & kTrusted) == 0) {
 304     return true;
 305   }
 306   if ((nsstrust.objectSigningFlags & CERTDB_TERMINAL_RECORD) != 0 &&
 307       (nsstrust.objectSigningFlags & kTrusted) == 0) {
 308     return true;
 309   }
 310
 311   // Self-signed certificates that don't have any trust bits set are untrusted.
 312   // Other certificates that don't have any trust bits set may still be trusted
 313   // if they chain up to a trust anchor.
 314   if (CERT_CompareName(&cert->os_cert_handle()->issuer,
 315                        &cert->os_cert_handle()->subject) == SECEqual) {
 316     return (nsstrust.sslFlags & kTrusted) == 0 &&
 317            (nsstrust.emailFlags & kTrusted) == 0 &&
 318            (nsstrust.objectSigningFlags & kTrusted) == 0;
 319   }
 320
 321   return false;
 322 }
 323
 324 bool NSSCertDatabase::SetCertTrust(const X509Certificate* cert,
 325                                 CertType type,
 326                                 TrustBits trust_bits) {
 327   bool success = psm::SetCertTrust(cert, type, trust_bits);
 328   if (success)
 329     NotifyObserversOfCACertChanged(cert);
 330
 331   return success;
 332 }
 333
 334 bool NSSCertDatabase::DeleteCertAndKey(X509Certificate* cert) {
 335   if (!DeleteCertAndKeyImpl(cert))
 336     return false;
 337   NotifyObserversOfCertRemoved(cert);
 338   return true;
 339 }
 340
 341 void NSSCertDatabase::DeleteCertAndKeyAsync(
 342     const scoped_refptr<X509Certificate>& cert,
 343     const DeleteCertCallback& callback) {
 344   base::PostTaskAndReplyWithResult(
 345       GetSlowTaskRunner().get(),
 346       FROM_HERE,
 347       base::Bind(&NSSCertDatabase::DeleteCertAndKeyImpl, cert),
 348       base::Bind(&NSSCertDatabase::NotifyCertRemovalAndCallBack,
 349                  weak_factory_.GetWeakPtr(),
 350                  cert,
 351                  callback));
 352 }
 353
 354 bool NSSCertDatabase::IsReadOnly(const X509Certificate* cert) const {
 355   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
 356   return slot && PK11_IsReadOnly(slot);
 357 }
 358
 359 bool NSSCertDatabase::IsHardwareBacked(const X509Certificate* cert) const {
 360   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
 361   return slot && PK11_IsHW(slot);
 362 }
 363
 364 void NSSCertDatabase::AddObserver(Observer* observer) {
 365   observer_list_->AddObserver(observer);
 366 }
 367
 368 void NSSCertDatabase::RemoveObserver(Observer* observer) {
 369   observer_list_->RemoveObserver(observer);
 370 }
 371
 372 void NSSCertDatabase::SetSlowTaskRunnerForTest(
 373     const scoped_refptr<base::TaskRunner>& task_runner) {
 374   slow_task_runner_for_test_ = task_runner;
 375 }
 376
 377 // static
 378 void NSSCertDatabase::ListCertsImpl(crypto::ScopedPK11Slot slot,
 379                                     CertificateList* certs) {
 380   certs->clear();
 381
 382   CERTCertList* cert_list = NULL;
 383   if (slot)
 384     cert_list = PK11_ListCertsInSlot(slot.get());
 385   else
 386     cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
 387
 388   CERTCertListNode* node;
 389   for (node = CERT_LIST_HEAD(cert_list); !CERT_LIST_END(node, cert_list);
 390        node = CERT_LIST_NEXT(node)) {
 391     certs->push_back(X509Certificate::CreateFromHandle(
 392         node->cert, X509Certificate::OSCertHandles()));
 393   }
 394   CERT_DestroyCertList(cert_list);
 395 }
 396
 397 scoped_refptr<base::TaskRunner> NSSCertDatabase::GetSlowTaskRunner() const {
 398   if (slow_task_runner_for_test_)
 399     return slow_task_runner_for_test_;
 400   return base::WorkerPool::GetTaskRunner(true /*task is slow*/);
 401 }
 402
 403 void NSSCertDatabase::NotifyCertRemovalAndCallBack(
 404     scoped_refptr<X509Certificate> cert,
 405     const DeleteCertCallback& callback,
 406     bool success) {
 407   if (success)
 408     NotifyObserversOfCertRemoved(cert);
 409   callback.Run(success);
 410 }
 411
 412 void NSSCertDatabase::NotifyObserversOfCertAdded(const X509Certificate* cert) {
 413   observer_list_->Notify(&Observer::OnCertAdded, make_scoped_refptr(cert));
 414 }
 415
 416 void NSSCertDatabase::NotifyObserversOfCertRemoved(
 417     const X509Certificate* cert) {
 418   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 419 }
 420
 421 void NSSCertDatabase::NotifyObserversOfCACertChanged(
 422     const X509Certificate* cert) {
 423   observer_list_->Notify(
 424       &Observer::OnCACertChanged, make_scoped_refptr(cert));
 425 }
 426
 427 // static
 428 bool NSSCertDatabase::DeleteCertAndKeyImpl(
 429     scoped_refptr<X509Certificate> cert) {
 430   // For some reason, PK11_DeleteTokenCertAndKey only calls
 431   // SEC_DeletePermCertificate if the private key is found.  So, we check
 432   // whether a private key exists before deciding which function to call to
 433   // delete the cert.
 434   SECKEYPrivateKey* privKey =
 435       PK11_FindKeyByAnyCert(cert->os_cert_handle(), NULL);
 436   if (privKey) {
 437     SECKEY_DestroyPrivateKey(privKey);
 438     if (PK11_DeleteTokenCertAndKey(cert->os_cert_handle(), NULL)) {
 439       LOG(ERROR) << "PK11_DeleteTokenCertAndKey failed: " << PORT_GetError();
 440       return false;
 441     }
 442   } else {
 443     if (SEC_DeletePermCertificate(cert->os_cert_handle())) {
 444       LOG(ERROR) << "SEC_DeletePermCertificate failed: " << PORT_GetError();
 445       return false;
 446     }
 447   }
 448   return true;
 449 }
 450
 451 }  // namespace net