content/child/webcrypto/nss/util_nss.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/child/webcrypto/nss/util_nss.h"
   6
   7 #include "base/lazy_instance.h"
   8 #include "content/child/webcrypto/crypto_data.h"
   9 #include "content/child/webcrypto/platform_crypto.h"
  10 #include "crypto/nss_util.h"
  11 #include "crypto/scoped_nss_types.h"
  12
  13 #if defined(USE_NSS)
  14 #include <dlfcn.h>
  15 #include <secoid.h>
  16 #endif
  17
  18 namespace content {
  19
  20 namespace webcrypto {
  21
  22 namespace {
  23 base::LazyInstance<NssRuntimeSupport>::Leaky g_nss_runtime_support =
  24     LAZY_INSTANCE_INITIALIZER;
  25 }  // namespace
  26
  27 // Creates a SECItem for the data in |buffer|. This does NOT make a copy, so
  28 // |buffer| should outlive the SECItem.
  29 SECItem MakeSECItemForBuffer(const CryptoData& buffer) {
  30   SECItem item = {
  31       siBuffer,
  32       // NSS requires non-const data even though it is just for input.
  33       const_cast<unsigned char*>(buffer.bytes()),
  34       buffer.byte_length()};
  35   return item;
  36 }
  37
  38 CryptoData SECItemToCryptoData(const SECItem& item) {
  39   return CryptoData(item.data, item.len);
  40 }
  41
  42 NssRuntimeSupport* NssRuntimeSupport::Get() {
  43   return &g_nss_runtime_support.Get();
  44 }
  45
  46 NssRuntimeSupport::NssRuntimeSupport() : internal_slot_does_oaep_(false) {
  47 #if !defined(USE_NSS)
  48   // Using a bundled version of NSS that is guaranteed to have this symbol.
  49   pk11_encrypt_func_ = PK11_Encrypt;
  50   pk11_decrypt_func_ = PK11_Decrypt;
  51   pk11_pub_encrypt_func_ = PK11_PubEncrypt;
  52   pk11_priv_decrypt_func_ = PK11_PrivDecrypt;
  53   internal_slot_does_oaep_ = true;
  54 #else
  55   // Using system NSS libraries and PCKS #11 modules, which may not have the
  56   // necessary function (PK11_Encrypt) or mechanism support (CKM_AES_GCM).
  57
  58   // If PK11_Encrypt() was successfully resolved, then NSS will support
  59   // AES-GCM directly. This was introduced in NSS 3.15.
  60   pk11_encrypt_func_ = reinterpret_cast<PK11_EncryptDecryptFunction>(
  61       dlsym(RTLD_DEFAULT, "PK11_Encrypt"));
  62   pk11_decrypt_func_ = reinterpret_cast<PK11_EncryptDecryptFunction>(
  63       dlsym(RTLD_DEFAULT, "PK11_Decrypt"));
  64
  65   // Even though NSS's pk11wrap layer may support
  66   // PK11_PubEncrypt/PK11_PubDecrypt (introduced in NSS 3.16.2), it may have
  67   // loaded a softoken that does not include OAEP support.
  68   pk11_pub_encrypt_func_ = reinterpret_cast<PK11_PubEncryptFunction>(
  69       dlsym(RTLD_DEFAULT, "PK11_PubEncrypt"));
  70   pk11_priv_decrypt_func_ = reinterpret_cast<PK11_PrivDecryptFunction>(
  71       dlsym(RTLD_DEFAULT, "PK11_PrivDecrypt"));
  72   if (pk11_priv_decrypt_func_ && pk11_pub_encrypt_func_) {
  73     crypto::ScopedPK11Slot slot(PK11_GetInternalKeySlot());
  74     internal_slot_does_oaep_ =
  75         !!PK11_DoesMechanism(slot.get(), CKM_RSA_PKCS_OAEP);
  76   }
  77 #endif
  78 }
  79
  80 void PlatformInit() {
  81   crypto::EnsureNSSInit();
  82 }
  83
  84 AlgorithmImplementation* CreatePlatformAesCtrImplementation() {
  85   // TODO(eroman): http://crbug.com/399084
  86   return NULL;
  87 }
  88
  89 AlgorithmImplementation* CreatePlatformRsaPssImplementation() {
  90   // TODO(eroman): http://crbug.com/399090
  91   return NULL;
  92 }
  93
  94 AlgorithmImplementation* CreatePlatformEcdsaImplementation() {
  95   // TODO(eroman): http://crbug.com/399094
  96   return NULL;
  97 }
  98
  99 AlgorithmImplementation* CreatePlatformEcdhImplementation() {
 100   // TODO(eroman): http://crbug.com/399093
 101   return NULL;
 102 }
 103
 104 AlgorithmImplementation* CreatePlatformHkdfImplementation() {
 105   // HKDF is only being imlemented for BoringSSL.
 106   return NULL;
 107 }
 108
 109 AlgorithmImplementation* CreatePlatformPbkdf2Implementation() {
 110   // PBKDF2 will only be implemented for BoringSSL, since the NSS
 111   // implementation is being deprecated.
 112   return NULL;
 113 }
 114
 115 }  // namespace webcrypto
 116
 117 }  // namespace content