Home | History | Annotate | Download | only in crypto 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "crypto/nss_util.h"
      6 #include "crypto/nss_util_internal.h"
      7 
      8 #include <nss.h>
      9 #include <pk11pub.h>
     10 #include <plarena.h>
     11 #include <prerror.h>
     12 #include <prinit.h>
     13 #include <prtime.h>
     14 #include <secmod.h>
     15 
     16 #if defined(OS_OPENBSD)
     17 #include <sys/mount.h>
     18 #include <sys/param.h>
     19 #endif
     20 
     21 #include <map>
     22 #include <vector>
     23 
     24 #include "base/base_paths.h"
     25 #include "base/bind.h"
     26 #include "base/cpu.h"
     27 #include "base/debug/alias.h"
     28 #include "base/debug/stack_trace.h"
     29 #include "base/environment.h"
     30 #include "base/file_util.h"
     31 #include "base/files/file_path.h"
     32 #include "base/lazy_instance.h"
     33 #include "base/logging.h"
     34 #include "base/memory/scoped_ptr.h"
     35 #include "base/message_loop/message_loop.h"
     36 #include "base/metrics/histogram.h"
     37 #include "base/native_library.h"
     38 #include "base/path_service.h"
     39 #include "base/stl_util.h"
     40 #include "base/strings/stringprintf.h"
     41 #include "base/threading/thread_checker.h"
     42 #include "base/threading/thread_restrictions.h"
     43 #include "base/threading/worker_pool.h"
     44 #include "build/build_config.h"
     45 
     46 // USE_NSS means we use NSS for everything crypto-related.  If USE_NSS is not
     47 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
     48 // use NSS for crypto or certificate verification, and we don't use the NSS
     49 // certificate and key databases.
     50 #if defined(USE_NSS)
     51 #include "base/synchronization/lock.h"
     52 #include "crypto/nss_crypto_module_delegate.h"
     53 #endif  // defined(USE_NSS)
     54 
     55 namespace crypto {
     56 
     57 namespace {
     58 
     59 #if defined(OS_CHROMEOS)
     60 const char kNSSDatabaseName[] = "Real NSS database";
     61 
     62 // Constants for loading the Chrome OS TPM-backed PKCS #11 library.
     63 const char kChapsModuleName[] = "Chaps";
     64 const char kChapsPath[] = "libchaps.so";
     65 
     66 // Fake certificate authority database used for testing.
     67 static const base::FilePath::CharType kReadOnlyCertDB[] =
     68     FILE_PATH_LITERAL("/etc/fake_root_ca/nssdb");
     69 #endif  // defined(OS_CHROMEOS)
     70 
     71 std::string GetNSSErrorMessage() {
     72   std::string result;
     73   if (PR_GetErrorTextLength()) {
     74     scoped_ptr<char[]> error_text(new char[PR_GetErrorTextLength() + 1]);
     75     PRInt32 copied = PR_GetErrorText(error_text.get());
     76     result = std::string(error_text.get(), copied);
     77   } else {
     78     result = base::StringPrintf("NSS error code: %d", PR_GetError());
     79   }
     80   return result;
     81 }
     82 
     83 #if defined(USE_NSS)
     84 base::FilePath GetDefaultConfigDirectory() {
     85   base::FilePath dir;
     86   PathService::Get(base::DIR_HOME, &dir);
     87   if (dir.empty()) {
     88     LOG(ERROR) << "Failed to get home directory.";
     89     return dir;
     90   }
     91   dir = dir.AppendASCII(".pki").AppendASCII("nssdb");
     92   if (!base::CreateDirectory(dir)) {
     93     LOG(ERROR) << "Failed to create " << dir.value() << " directory.";
     94     dir.clear();
     95   }
     96   DVLOG(2) << "DefaultConfigDirectory: " << dir.value();
     97   return dir;
     98 }
     99 
    100 // On non-Chrome OS platforms, return the default config directory. On Chrome OS
    101 // test images, return a read-only directory with fake root CA certs (which are
    102 // used by the local Google Accounts server mock we use when testing our login
    103 // code). On Chrome OS non-test images (where the read-only directory doesn't
    104 // exist), return an empty path.
    105 base::FilePath GetInitialConfigDirectory() {
    106 #if defined(OS_CHROMEOS)
    107   base::FilePath database_dir = base::FilePath(kReadOnlyCertDB);
    108   if (!base::PathExists(database_dir))
    109     database_dir.clear();
    110   return database_dir;
    111 #else
    112   return GetDefaultConfigDirectory();
    113 #endif  // defined(OS_CHROMEOS)
    114 }
    115 
    116 // This callback for NSS forwards all requests to a caller-specified
    117 // CryptoModuleBlockingPasswordDelegate object.
    118 char* PKCS11PasswordFunc(PK11SlotInfo* slot, PRBool retry, void* arg) {
    119   crypto::CryptoModuleBlockingPasswordDelegate* delegate =
    120       reinterpret_cast<crypto::CryptoModuleBlockingPasswordDelegate*>(arg);
    121   if (delegate) {
    122     bool cancelled = false;
    123     std::string password = delegate->RequestPassword(PK11_GetTokenName(slot),
    124                                                      retry != PR_FALSE,
    125                                                      &cancelled);
    126     if (cancelled)
    127       return NULL;
    128     char* result = PORT_Strdup(password.c_str());
    129     password.replace(0, password.size(), password.size(), 0);
    130     return result;
    131   }
    132   DLOG(ERROR) << "PK11 password requested with NULL arg";
    133   return NULL;
    134 }
    135 
    136 // NSS creates a local cache of the sqlite database if it detects that the
    137 // filesystem the database is on is much slower than the local disk.  The
    138 // detection doesn't work with the latest versions of sqlite, such as 3.6.22
    139 // (NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=578561).  So we set
    140 // the NSS environment variable NSS_SDB_USE_CACHE to "yes" to override NSS's
    141 // detection when database_dir is on NFS.  See http://crbug.com/48585.
    142 //
    143 // TODO(wtc): port this function to other USE_NSS platforms.  It is defined
    144 // only for OS_LINUX and OS_OPENBSD simply because the statfs structure
    145 // is OS-specific.
    146 //
    147 // Because this function sets an environment variable it must be run before we
    148 // go multi-threaded.
    149 void UseLocalCacheOfNSSDatabaseIfNFS(const base::FilePath& database_dir) {
    150   bool db_on_nfs = false;
    151 #if defined(OS_LINUX)
    152   base::FileSystemType fs_type = base::FILE_SYSTEM_UNKNOWN;
    153   if (base::GetFileSystemType(database_dir, &fs_type))
    154     db_on_nfs = (fs_type == base::FILE_SYSTEM_NFS);
    155 #elif defined(OS_OPENBSD)
    156   struct statfs buf;
    157   if (statfs(database_dir.value().c_str(), &buf) == 0)
    158     db_on_nfs = (strcmp(buf.f_fstypename, MOUNT_NFS) == 0);
    159 #else
    160   NOTIMPLEMENTED();
    161 #endif
    162 
    163   if (db_on_nfs) {
    164     scoped_ptr<base::Environment> env(base::Environment::Create());
    165     static const char kUseCacheEnvVar[] = "NSS_SDB_USE_CACHE";
    166     if (!env->HasVar(kUseCacheEnvVar))
    167       env->SetVar(kUseCacheEnvVar, "yes");
    168   }
    169 }
    170 
    171 #endif  // defined(USE_NSS)
    172 
    173 // A singleton to initialize/deinitialize NSPR.
    174 // Separate from the NSS singleton because we initialize NSPR on the UI thread.
    175 // Now that we're leaking the singleton, we could merge back with the NSS
    176 // singleton.
    177 class NSPRInitSingleton {
    178  private:
    179   friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>;
    180 
    181   NSPRInitSingleton() {
    182     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
    183   }
    184 
    185   // NOTE(willchan): We don't actually execute this code since we leak NSS to
    186   // prevent non-joinable threads from using NSS after it's already been shut
    187   // down.
    188   ~NSPRInitSingleton() {
    189     PL_ArenaFinish();
    190     PRStatus prstatus = PR_Cleanup();
    191     if (prstatus != PR_SUCCESS)
    192       LOG(ERROR) << "PR_Cleanup failed; was NSPR initialized on wrong thread?";
    193   }
    194 };
    195 
    196 base::LazyInstance<NSPRInitSingleton>::Leaky
    197     g_nspr_singleton = LAZY_INSTANCE_INITIALIZER;
    198 
    199 // This is a LazyInstance so that it will be deleted automatically when the
    200 // unittest exits.  NSSInitSingleton is a LeakySingleton, so it would not be
    201 // deleted if it were a regular member.
    202 base::LazyInstance<base::ScopedTempDir> g_test_nss_db_dir =
    203     LAZY_INSTANCE_INITIALIZER;
    204 
    205 // Force a crash with error info on NSS_NoDB_Init failure.
    206 void CrashOnNSSInitFailure() {
    207   int nss_error = PR_GetError();
    208   int os_error = PR_GetOSError();
    209   base::debug::Alias(&nss_error);
    210   base::debug::Alias(&os_error);
    211   LOG(ERROR) << "Error initializing NSS without a persistent database: "
    212              << GetNSSErrorMessage();
    213   LOG(FATAL) << "nss_error=" << nss_error << ", os_error=" << os_error;
    214 }
    215 
    216 #if defined(OS_CHROMEOS)
    217 class ChromeOSUserData {
    218  public:
    219   ChromeOSUserData(ScopedPK11Slot public_slot, bool is_primary_user)
    220       : public_slot_(public_slot.Pass()),
    221         is_primary_user_(is_primary_user) {}
    222   ~ChromeOSUserData() {
    223     if (public_slot_ && !is_primary_user_) {
    224       SECStatus status = SECMOD_CloseUserDB(public_slot_.get());
    225       if (status != SECSuccess)
    226         PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
    227     }
    228   }
    229 
    230   ScopedPK11Slot GetPublicSlot() {
    231     return ScopedPK11Slot(
    232         public_slot_ ? PK11_ReferenceSlot(public_slot_.get()) : NULL);
    233   }
    234 
    235   ScopedPK11Slot GetPrivateSlot(
    236       const base::Callback<void(ScopedPK11Slot)>& callback) {
    237     if (private_slot_)
    238       return ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()));
    239     if (!callback.is_null())
    240       tpm_ready_callback_list_.push_back(callback);
    241     return ScopedPK11Slot();
    242   }
    243 
    244   void SetPrivateSlot(ScopedPK11Slot private_slot) {
    245     DCHECK(!private_slot_);
    246     private_slot_ = private_slot.Pass();
    247 
    248     SlotReadyCallbackList callback_list;
    249     callback_list.swap(tpm_ready_callback_list_);
    250     for (SlotReadyCallbackList::iterator i = callback_list.begin();
    251          i != callback_list.end();
    252          ++i) {
    253       (*i).Run(ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get())));
    254     }
    255   }
    256 
    257  private:
    258   ScopedPK11Slot public_slot_;
    259   ScopedPK11Slot private_slot_;
    260   bool is_primary_user_;
    261 
    262   typedef std::vector<base::Callback<void(ScopedPK11Slot)> >
    263       SlotReadyCallbackList;
    264   SlotReadyCallbackList tpm_ready_callback_list_;
    265 };
    266 #endif  // defined(OS_CHROMEOS)
    267 
    268 class NSSInitSingleton {
    269  public:
    270 #if defined(OS_CHROMEOS)
    271   // Used with PostTaskAndReply to pass handles to worker thread and back.
    272   struct TPMModuleAndSlot {
    273     explicit TPMModuleAndSlot(SECMODModule* init_chaps_module)
    274         : chaps_module(init_chaps_module), tpm_slot(NULL) {}
    275     SECMODModule* chaps_module;
    276     PK11SlotInfo* tpm_slot;
    277   };
    278 
    279   void OpenPersistentNSSDB() {
    280     DCHECK(thread_checker_.CalledOnValidThread());
    281 
    282     if (!chromeos_user_logged_in_) {
    283       // GetDefaultConfigDirectory causes us to do blocking IO on UI thread.
    284       // Temporarily allow it until we fix http://crbug.com/70119
    285       base::ThreadRestrictions::ScopedAllowIO allow_io;
    286       chromeos_user_logged_in_ = true;
    287 
    288       // This creates another DB slot in NSS that is read/write, unlike
    289       // the fake root CA cert DB and the "default" crypto key
    290       // provider, which are still read-only (because we initialized
    291       // NSS before we had a cryptohome mounted).
    292       software_slot_ = OpenUserDB(GetDefaultConfigDirectory(),
    293                                   kNSSDatabaseName);
    294     }
    295   }
    296 
    297   PK11SlotInfo* OpenPersistentNSSDBForPath(const base::FilePath& path) {
    298     DCHECK(thread_checker_.CalledOnValidThread());
    299     // NSS is allowed to do IO on the current thread since dispatching
    300     // to a dedicated thread would still have the affect of blocking
    301     // the current thread, due to NSS's internal locking requirements
    302     base::ThreadRestrictions::ScopedAllowIO allow_io;
    303 
    304     base::FilePath nssdb_path = path.AppendASCII(".pki").AppendASCII("nssdb");
    305     if (!base::CreateDirectory(nssdb_path)) {
    306       LOG(ERROR) << "Failed to create " << nssdb_path.value() << " directory.";
    307       return NULL;
    308     }
    309     return OpenUserDB(nssdb_path, kNSSDatabaseName);
    310   }
    311 
    312   void EnableTPMTokenForNSS() {
    313     DCHECK(thread_checker_.CalledOnValidThread());
    314 
    315     // If this gets set, then we'll use the TPM for certs with
    316     // private keys, otherwise we'll fall back to the software
    317     // implementation.
    318     tpm_token_enabled_for_nss_ = true;
    319   }
    320 
    321   bool IsTPMTokenEnabledForNSS() {
    322     DCHECK(thread_checker_.CalledOnValidThread());
    323     return tpm_token_enabled_for_nss_;
    324   }
    325 
    326   void InitializeTPMToken(int token_slot_id,
    327                           const base::Callback<void(bool)>& callback) {
    328     DCHECK(thread_checker_.CalledOnValidThread());
    329     // Should not be called while there is already an initialization in
    330     // progress.
    331     DCHECK(!initializing_tpm_token_);
    332     // If EnableTPMTokenForNSS hasn't been called, return false.
    333     if (!tpm_token_enabled_for_nss_) {
    334       base::MessageLoop::current()->PostTask(FROM_HERE,
    335                                              base::Bind(callback, false));
    336       return;
    337     }
    338 
    339     // If everything is already initialized, then return true.
    340     // Note that only |tpm_slot_| is checked, since |chaps_module_| could be
    341     // NULL in tests while |tpm_slot_| has been set to the test DB.
    342     if (tpm_slot_) {
    343       base::MessageLoop::current()->PostTask(FROM_HERE,
    344                                              base::Bind(callback, true));
    345       return;
    346     }
    347 
    348     // Note that a reference is not taken to chaps_module_. This is safe since
    349     // NSSInitSingleton is Leaky, so the reference it holds is never released.
    350     scoped_ptr<TPMModuleAndSlot> tpm_args(new TPMModuleAndSlot(chaps_module_));
    351     TPMModuleAndSlot* tpm_args_ptr = tpm_args.get();
    352     if (base::WorkerPool::PostTaskAndReply(
    353             FROM_HERE,
    354             base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread,
    355                        token_slot_id,
    356                        tpm_args_ptr),
    357             base::Bind(&NSSInitSingleton::OnInitializedTPMToken,
    358                        base::Unretained(this),  // NSSInitSingleton is leaky
    359                        callback,
    360                        base::Passed(&tpm_args)),
    361             true /* task_is_slow */
    362             )) {
    363       initializing_tpm_token_ = true;
    364     } else {
    365       base::MessageLoop::current()->PostTask(FROM_HERE,
    366                                              base::Bind(callback, false));
    367     }
    368   }
    369 
    370   static void InitializeTPMTokenOnWorkerThread(CK_SLOT_ID token_slot_id,
    371                                                TPMModuleAndSlot* tpm_args) {
    372     // This tries to load the Chaps module so NSS can talk to the hardware
    373     // TPM.
    374     if (!tpm_args->chaps_module) {
    375       DVLOG(3) << "Loading chaps...";
    376       tpm_args->chaps_module = LoadModule(
    377           kChapsModuleName,
    378           kChapsPath,
    379           // For more details on these parameters, see:
    380           // https://developer.mozilla.org/en/PKCS11_Module_Specs
    381           // slotFlags=[PublicCerts] -- Certificates and public keys can be
    382           //   read from this slot without requiring a call to C_Login.
    383           // askpw=only -- Only authenticate to the token when necessary.
    384           "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\"");
    385     }
    386     if (tpm_args->chaps_module) {
    387       tpm_args->tpm_slot =
    388           GetTPMSlotForIdOnWorkerThread(tpm_args->chaps_module, token_slot_id);
    389     }
    390   }
    391 
    392   void OnInitializedTPMToken(const base::Callback<void(bool)>& callback,
    393                              scoped_ptr<TPMModuleAndSlot> tpm_args) {
    394     DCHECK(thread_checker_.CalledOnValidThread());
    395     DVLOG(2) << "Loaded chaps: " << !!tpm_args->chaps_module
    396              << ", got tpm slot: " << !!tpm_args->tpm_slot;
    397 
    398     chaps_module_ = tpm_args->chaps_module;
    399     tpm_slot_ = tpm_args->tpm_slot;
    400     if (!chaps_module_ && test_slot_) {
    401       // chromeos_unittests try to test the TPM initialization process. If we
    402       // have a test DB open, pretend that it is the TPM slot.
    403       tpm_slot_ = PK11_ReferenceSlot(test_slot_);
    404     }
    405     initializing_tpm_token_ = false;
    406 
    407     if (tpm_slot_) {
    408       TPMReadyCallbackList callback_list;
    409       callback_list.swap(tpm_ready_callback_list_);
    410       for (TPMReadyCallbackList::iterator i = callback_list.begin();
    411            i != callback_list.end();
    412            ++i) {
    413         (*i).Run();
    414       }
    415     }
    416 
    417     callback.Run(!!tpm_slot_);
    418   }
    419 
    420   bool IsTPMTokenReady(const base::Closure& callback) {
    421     if (!callback.is_null()) {
    422       // Cannot DCHECK in the general case yet, but since the callback is
    423       // a new addition to the API, DCHECK to make sure at least the new uses
    424       // don't regress.
    425       DCHECK(thread_checker_.CalledOnValidThread());
    426     } else if (!thread_checker_.CalledOnValidThread()) {
    427       // TODO(mattm): Change to DCHECK when callers have been fixed.
    428       DVLOG(1) << "Called on wrong thread.\n"
    429                << base::debug::StackTrace().ToString();
    430     }
    431 
    432     if (tpm_slot_ != NULL)
    433       return true;
    434 
    435     if (!callback.is_null())
    436       tpm_ready_callback_list_.push_back(callback);
    437 
    438     return false;
    439   }
    440 
    441   // Note that CK_SLOT_ID is an unsigned long, but cryptohome gives us the slot
    442   // id as an int. This should be safe since this is only used with chaps, which
    443   // we also control.
    444   static PK11SlotInfo* GetTPMSlotForIdOnWorkerThread(SECMODModule* chaps_module,
    445                                                      CK_SLOT_ID slot_id) {
    446     DCHECK(chaps_module);
    447 
    448     DVLOG(3) << "Poking chaps module.";
    449     SECStatus rv = SECMOD_UpdateSlotList(chaps_module);
    450     if (rv != SECSuccess)
    451       PLOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError();
    452 
    453     PK11SlotInfo* slot = SECMOD_LookupSlot(chaps_module->moduleID, slot_id);
    454     if (!slot)
    455       LOG(ERROR) << "TPM slot " << slot_id << " not found.";
    456     return slot;
    457   }
    458 
    459   bool InitializeNSSForChromeOSUser(
    460       const std::string& email,
    461       const std::string& username_hash,
    462       bool is_primary_user,
    463       const base::FilePath& path) {
    464     DCHECK(thread_checker_.CalledOnValidThread());
    465     if (chromeos_user_map_.find(username_hash) != chromeos_user_map_.end()) {
    466       // This user already exists in our mapping.
    467       DVLOG(2) << username_hash << " already initialized.";
    468       return false;
    469     }
    470     ScopedPK11Slot public_slot;
    471     if (is_primary_user) {
    472       DVLOG(2) << "Primary user, using GetPublicNSSKeySlot()";
    473       public_slot.reset(GetPublicNSSKeySlot());
    474     } else {
    475       DVLOG(2) << "Opening NSS DB " << path.value();
    476       public_slot.reset(OpenPersistentNSSDBForPath(path));
    477     }
    478     chromeos_user_map_[username_hash] =
    479         new ChromeOSUserData(public_slot.Pass(), is_primary_user);
    480     return true;
    481   }
    482 
    483   void InitializeTPMForChromeOSUser(const std::string& username_hash,
    484                                     CK_SLOT_ID slot_id) {
    485     DCHECK(thread_checker_.CalledOnValidThread());
    486     DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end());
    487 
    488     if (!chaps_module_)
    489       return;
    490 
    491     // Note that a reference is not taken to chaps_module_. This is safe since
    492     // NSSInitSingleton is Leaky, so the reference it holds is never released.
    493     scoped_ptr<TPMModuleAndSlot> tpm_args(new TPMModuleAndSlot(chaps_module_));
    494     TPMModuleAndSlot* tpm_args_ptr = tpm_args.get();
    495     base::WorkerPool::PostTaskAndReply(
    496         FROM_HERE,
    497         base::Bind(&NSSInitSingleton::InitializeTPMTokenOnWorkerThread,
    498                    slot_id,
    499                    tpm_args_ptr),
    500         base::Bind(&NSSInitSingleton::OnInitializedTPMForChromeOSUser,
    501                    base::Unretained(this),  // NSSInitSingleton is leaky
    502                    username_hash,
    503                    base::Passed(&tpm_args)),
    504         true /* task_is_slow */
    505         );
    506   }
    507 
    508   void OnInitializedTPMForChromeOSUser(const std::string& username_hash,
    509                                        scoped_ptr<TPMModuleAndSlot> tpm_args) {
    510     DCHECK(thread_checker_.CalledOnValidThread());
    511     DVLOG(2) << "Got tpm slot for " << username_hash << " "
    512              << !!tpm_args->tpm_slot;
    513     chromeos_user_map_[username_hash]->SetPrivateSlot(
    514         ScopedPK11Slot(tpm_args->tpm_slot));
    515   }
    516 
    517   void InitializePrivateSoftwareSlotForChromeOSUser(
    518       const std::string& username_hash) {
    519     DCHECK(thread_checker_.CalledOnValidThread());
    520     VLOG(1) << "using software private slot for " << username_hash;
    521     DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end());
    522     chromeos_user_map_[username_hash]->SetPrivateSlot(
    523         chromeos_user_map_[username_hash]->GetPublicSlot());
    524   }
    525 
    526   ScopedPK11Slot GetPublicSlotForChromeOSUser(
    527       const std::string& username_hash) {
    528     DCHECK(thread_checker_.CalledOnValidThread());
    529 
    530     if (username_hash.empty()) {
    531       DVLOG(2) << "empty username_hash";
    532       return ScopedPK11Slot();
    533     }
    534 
    535     if (test_slot_) {
    536       DVLOG(2) << "returning test_slot_ for " << username_hash;
    537       return ScopedPK11Slot(PK11_ReferenceSlot(test_slot_));
    538     }
    539 
    540     if (chromeos_user_map_.find(username_hash) == chromeos_user_map_.end()) {
    541       LOG(ERROR) << username_hash << " not initialized.";
    542       return ScopedPK11Slot();
    543     }
    544     return chromeos_user_map_[username_hash]->GetPublicSlot();
    545   }
    546 
    547   ScopedPK11Slot GetPrivateSlotForChromeOSUser(
    548       const std::string& username_hash,
    549       const base::Callback<void(ScopedPK11Slot)>& callback) {
    550     DCHECK(thread_checker_.CalledOnValidThread());
    551 
    552     if (username_hash.empty()) {
    553       DVLOG(2) << "empty username_hash";
    554       if (!callback.is_null()) {
    555         base::MessageLoop::current()->PostTask(
    556             FROM_HERE, base::Bind(callback, base::Passed(ScopedPK11Slot())));
    557       }
    558       return ScopedPK11Slot();
    559     }
    560 
    561     DCHECK(chromeos_user_map_.find(username_hash) != chromeos_user_map_.end());
    562 
    563     if (test_slot_) {
    564       DVLOG(2) << "returning test_slot_ for " << username_hash;
    565       return ScopedPK11Slot(PK11_ReferenceSlot(test_slot_));
    566     }
    567 
    568     return chromeos_user_map_[username_hash]->GetPrivateSlot(callback);
    569   }
    570 
    571   void CloseTestChromeOSUser(const std::string& username_hash) {
    572     DCHECK(thread_checker_.CalledOnValidThread());
    573     ChromeOSUserMap::iterator i = chromeos_user_map_.find(username_hash);
    574     DCHECK(i != chromeos_user_map_.end());
    575     delete i->second;
    576     chromeos_user_map_.erase(i);
    577   }
    578 #endif  // defined(OS_CHROMEOS)
    579 
    580 
    581   bool OpenTestNSSDB() {
    582     DCHECK(thread_checker_.CalledOnValidThread());
    583     // NSS is allowed to do IO on the current thread since dispatching
    584     // to a dedicated thread would still have the affect of blocking
    585     // the current thread, due to NSS's internal locking requirements
    586     base::ThreadRestrictions::ScopedAllowIO allow_io;
    587 
    588     if (test_slot_)
    589       return true;
    590     if (!g_test_nss_db_dir.Get().CreateUniqueTempDir())
    591       return false;
    592     test_slot_ = OpenUserDB(g_test_nss_db_dir.Get().path(), kTestTPMTokenName);
    593     return !!test_slot_;
    594   }
    595 
    596   void CloseTestNSSDB() {
    597     DCHECK(thread_checker_.CalledOnValidThread());
    598     // NSS is allowed to do IO on the current thread since dispatching
    599     // to a dedicated thread would still have the affect of blocking
    600     // the current thread, due to NSS's internal locking requirements
    601     base::ThreadRestrictions::ScopedAllowIO allow_io;
    602 
    603     if (!test_slot_)
    604       return;
    605     SECStatus status = SECMOD_CloseUserDB(test_slot_);
    606     if (status != SECSuccess)
    607       PLOG(ERROR) << "SECMOD_CloseUserDB failed: " << PORT_GetError();
    608     PK11_FreeSlot(test_slot_);
    609     test_slot_ = NULL;
    610     ignore_result(g_test_nss_db_dir.Get().Delete());
    611   }
    612 
    613   PK11SlotInfo* GetPublicNSSKeySlot() {
    614     // TODO(mattm): Change to DCHECK when callers have been fixed.
    615     if (!thread_checker_.CalledOnValidThread()) {
    616       DVLOG(1) << "Called on wrong thread.\n"
    617                << base::debug::StackTrace().ToString();
    618     }
    619 
    620     if (test_slot_)
    621       return PK11_ReferenceSlot(test_slot_);
    622     if (software_slot_)
    623       return PK11_ReferenceSlot(software_slot_);
    624     return PK11_GetInternalKeySlot();
    625   }
    626 
    627   PK11SlotInfo* GetPrivateNSSKeySlot() {
    628     // TODO(mattm): Change to DCHECK when callers have been fixed.
    629     if (!thread_checker_.CalledOnValidThread()) {
    630       DVLOG(1) << "Called on wrong thread.\n"
    631                << base::debug::StackTrace().ToString();
    632     }
    633 
    634     if (test_slot_)
    635       return PK11_ReferenceSlot(test_slot_);
    636 
    637 #if defined(OS_CHROMEOS)
    638     if (tpm_token_enabled_for_nss_) {
    639       if (IsTPMTokenReady(base::Closure())) {
    640         return PK11_ReferenceSlot(tpm_slot_);
    641       } else {
    642         // If we were supposed to get the hardware token, but were
    643         // unable to, return NULL rather than fall back to sofware.
    644         return NULL;
    645       }
    646     }
    647 #endif
    648     // If we weren't supposed to enable the TPM for NSS, then return
    649     // the software slot.
    650     if (software_slot_)
    651       return PK11_ReferenceSlot(software_slot_);
    652     return PK11_GetInternalKeySlot();
    653   }
    654 
    655 #if defined(USE_NSS)
    656   base::Lock* write_lock() {
    657     return &write_lock_;
    658   }
    659 #endif  // defined(USE_NSS)
    660 
    661   // This method is used to force NSS to be initialized without a DB.
    662   // Call this method before NSSInitSingleton() is constructed.
    663   static void ForceNoDBInit() {
    664     force_nodb_init_ = true;
    665   }
    666 
    667  private:
    668   friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>;
    669 
    670   NSSInitSingleton()
    671       : tpm_token_enabled_for_nss_(false),
    672         initializing_tpm_token_(false),
    673         chaps_module_(NULL),
    674         software_slot_(NULL),
    675         test_slot_(NULL),
    676         tpm_slot_(NULL),
    677         root_(NULL),
    678         chromeos_user_logged_in_(false) {
    679     base::TimeTicks start_time = base::TimeTicks::Now();
    680 
    681     // It's safe to construct on any thread, since LazyInstance will prevent any
    682     // other threads from accessing until the constructor is done.
    683     thread_checker_.DetachFromThread();
    684 
    685     DisableAESNIIfNeeded();
    686 
    687     EnsureNSPRInit();
    688 
    689     // We *must* have NSS >= 3.14.3.
    690     COMPILE_ASSERT(
    691         (NSS_VMAJOR == 3 && NSS_VMINOR == 14 && NSS_VPATCH >= 3) ||
    692         (NSS_VMAJOR == 3 && NSS_VMINOR > 14) ||
    693         (NSS_VMAJOR > 3),
    694         nss_version_check_failed);
    695     // Also check the run-time NSS version.
    696     // NSS_VersionCheck is a >= check, not strict equality.
    697     if (!NSS_VersionCheck("3.14.3")) {
    698       LOG(FATAL) << "NSS_VersionCheck(\"3.14.3\") failed. NSS >= 3.14.3 is "
    699                     "required. Please upgrade to the latest NSS, and if you "
    700                     "still get this error, contact your distribution "
    701                     "maintainer.";
    702     }
    703 
    704     SECStatus status = SECFailure;
    705     bool nodb_init = force_nodb_init_;
    706 
    707 #if !defined(USE_NSS)
    708     // Use the system certificate store, so initialize NSS without database.
    709     nodb_init = true;
    710 #endif
    711 
    712     if (nodb_init) {
    713       status = NSS_NoDB_Init(NULL);
    714       if (status != SECSuccess) {
    715         CrashOnNSSInitFailure();
    716         return;
    717       }
    718 #if defined(OS_IOS)
    719       root_ = InitDefaultRootCerts();
    720 #endif  // defined(OS_IOS)
    721     } else {
    722 #if defined(USE_NSS)
    723       base::FilePath database_dir = GetInitialConfigDirectory();
    724       if (!database_dir.empty()) {
    725         // This duplicates the work which should have been done in
    726         // EarlySetupForNSSInit. However, this function is idempotent so
    727         // there's no harm done.
    728         UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
    729 
    730         // Initialize with a persistent database (likely, ~/.pki/nssdb).
    731         // Use "sql:" which can be shared by multiple processes safely.
    732         std::string nss_config_dir =
    733             base::StringPrintf("sql:%s", database_dir.value().c_str());
    734 #if defined(OS_CHROMEOS)
    735         status = NSS_Init(nss_config_dir.c_str());
    736 #else
    737         status = NSS_InitReadWrite(nss_config_dir.c_str());
    738 #endif
    739         if (status != SECSuccess) {
    740           LOG(ERROR) << "Error initializing NSS with a persistent "
    741                         "database (" << nss_config_dir
    742                      << "): " << GetNSSErrorMessage();
    743         }
    744       }
    745       if (status != SECSuccess) {
    746         VLOG(1) << "Initializing NSS without a persistent database.";
    747         status = NSS_NoDB_Init(NULL);
    748         if (status != SECSuccess) {
    749           CrashOnNSSInitFailure();
    750           return;
    751         }
    752       }
    753 
    754       PK11_SetPasswordFunc(PKCS11PasswordFunc);
    755 
    756       // If we haven't initialized the password for the NSS databases,
    757       // initialize an empty-string password so that we don't need to
    758       // log in.
    759       PK11SlotInfo* slot = PK11_GetInternalKeySlot();
    760       if (slot) {
    761         // PK11_InitPin may write to the keyDB, but no other thread can use NSS
    762         // yet, so we don't need to lock.
    763         if (PK11_NeedUserInit(slot))
    764           PK11_InitPin(slot, NULL, NULL);
    765         PK11_FreeSlot(slot);
    766       }
    767 
    768       root_ = InitDefaultRootCerts();
    769 #endif  // defined(USE_NSS)
    770     }
    771 
    772     // Disable MD5 certificate signatures. (They are disabled by default in
    773     // NSS 3.14.)
    774     NSS_SetAlgorithmPolicy(SEC_OID_MD5, 0, NSS_USE_ALG_IN_CERT_SIGNATURE);
    775     NSS_SetAlgorithmPolicy(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION,
    776                            0, NSS_USE_ALG_IN_CERT_SIGNATURE);
    777 
    778     // The UMA bit is conditionally set for this histogram in
    779     // chrome/common/startup_metric_utils.cc .
    780     HISTOGRAM_CUSTOM_TIMES("Startup.SlowStartupNSSInit",
    781                            base::TimeTicks::Now() - start_time,
    782                            base::TimeDelta::FromMilliseconds(10),
    783                            base::TimeDelta::FromHours(1),
    784                            50);
    785   }
    786 
    787   // NOTE(willchan): We don't actually execute this code since we leak NSS to
    788   // prevent non-joinable threads from using NSS after it's already been shut
    789   // down.
    790   ~NSSInitSingleton() {
    791 #if defined(OS_CHROMEOS)
    792     STLDeleteValues(&chromeos_user_map_);
    793 #endif
    794     if (tpm_slot_) {
    795       PK11_FreeSlot(tpm_slot_);
    796       tpm_slot_ = NULL;
    797     }
    798     if (software_slot_) {
    799       SECMOD_CloseUserDB(software_slot_);
    800       PK11_FreeSlot(software_slot_);
    801       software_slot_ = NULL;
    802     }
    803     CloseTestNSSDB();
    804     if (root_) {
    805       SECMOD_UnloadUserModule(root_);
    806       SECMOD_DestroyModule(root_);
    807       root_ = NULL;
    808     }
    809     if (chaps_module_) {
    810       SECMOD_UnloadUserModule(chaps_module_);
    811       SECMOD_DestroyModule(chaps_module_);
    812       chaps_module_ = NULL;
    813     }
    814 
    815     SECStatus status = NSS_Shutdown();
    816     if (status != SECSuccess) {
    817       // We VLOG(1) because this failure is relatively harmless (leaking, but
    818       // we're shutting down anyway).
    819       VLOG(1) << "NSS_Shutdown failed; see http://crbug.com/4609";
    820     }
    821   }
    822 
    823 #if defined(USE_NSS) || defined(OS_IOS)
    824   // Load nss's built-in root certs.
    825   SECMODModule* InitDefaultRootCerts() {
    826     SECMODModule* root = LoadModule("Root Certs", "libnssckbi.so", NULL);
    827     if (root)
    828       return root;
    829 
    830     // Aw, snap.  Can't find/load root cert shared library.
    831     // This will make it hard to talk to anybody via https.
    832     // TODO(mattm): Re-add the NOTREACHED here when crbug.com/310972 is fixed.
    833     return NULL;
    834   }
    835 
    836   // Load the given module for this NSS session.
    837   static SECMODModule* LoadModule(const char* name,
    838                                   const char* library_path,
    839                                   const char* params) {
    840     std::string modparams = base::StringPrintf(
    841         "name=\"%s\" library=\"%s\" %s",
    842         name, library_path, params ? params : "");
    843 
    844     // Shouldn't need to const_cast here, but SECMOD doesn't properly
    845     // declare input string arguments as const.  Bug
    846     // https://bugzilla.mozilla.org/show_bug.cgi?id=642546 was filed
    847     // on NSS codebase to address this.
    848     SECMODModule* module = SECMOD_LoadUserModule(
    849         const_cast<char*>(modparams.c_str()), NULL, PR_FALSE);
    850     if (!module) {
    851       LOG(ERROR) << "Error loading " << name << " module into NSS: "
    852                  << GetNSSErrorMessage();
    853       return NULL;
    854     }
    855     if (!module->loaded) {
    856       LOG(ERROR) << "After loading " << name << ", loaded==false: "
    857                  << GetNSSErrorMessage();
    858       SECMOD_DestroyModule(module);
    859       return NULL;
    860     }
    861     return module;
    862   }
    863 #endif
    864 
    865   static PK11SlotInfo* OpenUserDB(const base::FilePath& path,
    866                                   const char* description) {
    867     const std::string modspec =
    868         base::StringPrintf("configDir='sql:%s' tokenDescription='%s'",
    869                            path.value().c_str(), description);
    870     PK11SlotInfo* db_slot = SECMOD_OpenUserDB(modspec.c_str());
    871     if (db_slot) {
    872       if (PK11_NeedUserInit(db_slot))
    873         PK11_InitPin(db_slot, NULL, NULL);
    874     }
    875     else {
    876       LOG(ERROR) << "Error opening persistent database (" << modspec
    877                  << "): " << GetNSSErrorMessage();
    878     }
    879     return db_slot;
    880   }
    881 
    882   static void DisableAESNIIfNeeded() {
    883     if (NSS_VersionCheck("3.15") && !NSS_VersionCheck("3.15.4")) {
    884       // Some versions of NSS have a bug that causes AVX instructions to be
    885       // used without testing whether XSAVE is enabled by the operating system.
    886       // In order to work around this, we disable AES-NI in NSS when we find
    887       // that |has_avx()| is false (which includes the XSAVE test). See
    888       // https://bugzilla.mozilla.org/show_bug.cgi?id=940794
    889       base::CPU cpu;
    890 
    891       if (cpu.has_avx_hardware() && !cpu.has_avx()) {
    892         base::Environment::Create()->SetVar("NSS_DISABLE_HW_AES", "1");
    893       }
    894     }
    895   }
    896 
    897   // If this is set to true NSS is forced to be initialized without a DB.
    898   static bool force_nodb_init_;
    899 
    900   bool tpm_token_enabled_for_nss_;
    901   bool initializing_tpm_token_;
    902   typedef std::vector<base::Closure> TPMReadyCallbackList;
    903   TPMReadyCallbackList tpm_ready_callback_list_;
    904   SECMODModule* chaps_module_;
    905   PK11SlotInfo* software_slot_;
    906   PK11SlotInfo* test_slot_;
    907   PK11SlotInfo* tpm_slot_;
    908   SECMODModule* root_;
    909   bool chromeos_user_logged_in_;
    910 #if defined(OS_CHROMEOS)
    911   typedef std::map<std::string, ChromeOSUserData*> ChromeOSUserMap;
    912   ChromeOSUserMap chromeos_user_map_;
    913 #endif
    914 #if defined(USE_NSS)
    915   // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
    916   // is fixed, we will no longer need the lock.
    917   base::Lock write_lock_;
    918 #endif  // defined(USE_NSS)
    919 
    920   base::ThreadChecker thread_checker_;
    921 };
    922 
    923 // static
    924 bool NSSInitSingleton::force_nodb_init_ = false;
    925 
    926 base::LazyInstance<NSSInitSingleton>::Leaky
    927     g_nss_singleton = LAZY_INSTANCE_INITIALIZER;
    928 }  // namespace
    929 
    930 const char kTestTPMTokenName[] = "Test DB";
    931 
    932 #if defined(USE_NSS)
    933 void EarlySetupForNSSInit() {
    934   base::FilePath database_dir = GetInitialConfigDirectory();
    935   if (!database_dir.empty())
    936     UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
    937 }
    938 #endif
    939 
    940 void EnsureNSPRInit() {
    941   g_nspr_singleton.Get();
    942 }
    943 
    944 void InitNSSSafely() {
    945   // We might fork, but we haven't loaded any security modules.
    946   DisableNSSForkCheck();
    947   // If we're sandboxed, we shouldn't be able to open user security modules,
    948   // but it's more correct to tell NSS to not even try.
    949   // Loading user security modules would have security implications.
    950   ForceNSSNoDBInit();
    951   // Initialize NSS.
    952   EnsureNSSInit();
    953 }
    954 
    955 void EnsureNSSInit() {
    956   // Initializing SSL causes us to do blocking IO.
    957   // Temporarily allow it until we fix
    958   //   http://code.google.com/p/chromium/issues/detail?id=59847
    959   base::ThreadRestrictions::ScopedAllowIO allow_io;
    960   g_nss_singleton.Get();
    961 }
    962 
    963 void ForceNSSNoDBInit() {
    964   NSSInitSingleton::ForceNoDBInit();
    965 }
    966 
    967 void DisableNSSForkCheck() {
    968   scoped_ptr<base::Environment> env(base::Environment::Create());
    969   env->SetVar("NSS_STRICT_NOFORK", "DISABLED");
    970 }
    971 
    972 void LoadNSSLibraries() {
    973   // Some NSS libraries are linked dynamically so load them here.
    974 #if defined(USE_NSS)
    975   // Try to search for multiple directories to load the libraries.
    976   std::vector<base::FilePath> paths;
    977 
    978   // Use relative path to Search PATH for the library files.
    979   paths.push_back(base::FilePath());
    980 
    981   // For Debian derivatives NSS libraries are located here.
    982   paths.push_back(base::FilePath("/usr/lib/nss"));
    983 
    984   // Ubuntu 11.10 (Oneiric) and Debian Wheezy place the libraries here.
    985 #if defined(ARCH_CPU_X86_64)
    986   paths.push_back(base::FilePath("/usr/lib/x86_64-linux-gnu/nss"));
    987 #elif defined(ARCH_CPU_X86)
    988   paths.push_back(base::FilePath("/usr/lib/i386-linux-gnu/nss"));
    989 #elif defined(ARCH_CPU_ARMEL)
    990 #if defined(__ARM_PCS_VFP)
    991   paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabihf/nss"));
    992 #else
    993   paths.push_back(base::FilePath("/usr/lib/arm-linux-gnueabi/nss"));
    994 #endif  // defined(__ARM_PCS_VFP)
    995 #elif defined(ARCH_CPU_MIPSEL)
    996   paths.push_back(base::FilePath("/usr/lib/mipsel-linux-gnu/nss"));
    997 #endif  // defined(ARCH_CPU_X86_64)
    998 
    999   // A list of library files to load.
   1000   std::vector<std::string> libs;
   1001   libs.push_back("libsoftokn3.so");
   1002   libs.push_back("libfreebl3.so");
   1003 
   1004   // For each combination of library file and path, check for existence and
   1005   // then load.
   1006   size_t loaded = 0;
   1007   for (size_t i = 0; i < libs.size(); ++i) {
   1008     for (size_t j = 0; j < paths.size(); ++j) {
   1009       base::FilePath path = paths[j].Append(libs[i]);
   1010       base::NativeLibrary lib = base::LoadNativeLibrary(path, NULL);
   1011       if (lib) {
   1012         ++loaded;
   1013         break;
   1014       }
   1015     }
   1016   }
   1017 
   1018   if (loaded == libs.size()) {
   1019     VLOG(3) << "NSS libraries loaded.";
   1020   } else {
   1021     LOG(ERROR) << "Failed to load NSS libraries.";
   1022   }
   1023 #endif  // defined(USE_NSS)
   1024 }
   1025 
   1026 bool CheckNSSVersion(const char* version) {
   1027   return !!NSS_VersionCheck(version);
   1028 }
   1029 
   1030 #if defined(USE_NSS)
   1031 ScopedTestNSSDB::ScopedTestNSSDB()
   1032   : is_open_(g_nss_singleton.Get().OpenTestNSSDB()) {
   1033 }
   1034 
   1035 ScopedTestNSSDB::~ScopedTestNSSDB() {
   1036   // Don't close when NSS is < 3.15.1, because it would require an additional
   1037   // sleep for 1 second after closing the database, due to
   1038   // http://bugzil.la/875601.
   1039   if (NSS_VersionCheck("3.15.1")) {
   1040     g_nss_singleton.Get().CloseTestNSSDB();
   1041   }
   1042 }
   1043 
   1044 base::Lock* GetNSSWriteLock() {
   1045   return g_nss_singleton.Get().write_lock();
   1046 }
   1047 
   1048 AutoNSSWriteLock::AutoNSSWriteLock() : lock_(GetNSSWriteLock()) {
   1049   // May be NULL if the lock is not needed in our version of NSS.
   1050   if (lock_)
   1051     lock_->Acquire();
   1052 }
   1053 
   1054 AutoNSSWriteLock::~AutoNSSWriteLock() {
   1055   if (lock_) {
   1056     lock_->AssertAcquired();
   1057     lock_->Release();
   1058   }
   1059 }
   1060 
   1061 AutoSECMODListReadLock::AutoSECMODListReadLock()
   1062       : lock_(SECMOD_GetDefaultModuleListLock()) {
   1063     SECMOD_GetReadLock(lock_);
   1064   }
   1065 
   1066 AutoSECMODListReadLock::~AutoSECMODListReadLock() {
   1067   SECMOD_ReleaseReadLock(lock_);
   1068 }
   1069 
   1070 #endif  // defined(USE_NSS)
   1071 
   1072 #if defined(OS_CHROMEOS)
   1073 void OpenPersistentNSSDB() {
   1074   g_nss_singleton.Get().OpenPersistentNSSDB();
   1075 }
   1076 
   1077 void EnableTPMTokenForNSS() {
   1078   g_nss_singleton.Get().EnableTPMTokenForNSS();
   1079 }
   1080 
   1081 bool IsTPMTokenEnabledForNSS() {
   1082   return g_nss_singleton.Get().IsTPMTokenEnabledForNSS();
   1083 }
   1084 
   1085 bool IsTPMTokenReady(const base::Closure& callback) {
   1086   return g_nss_singleton.Get().IsTPMTokenReady(callback);
   1087 }
   1088 
   1089 void InitializeTPMToken(int token_slot_id,
   1090                         const base::Callback<void(bool)>& callback) {
   1091   g_nss_singleton.Get().InitializeTPMToken(token_slot_id, callback);
   1092 }
   1093 
   1094 ScopedTestNSSChromeOSUser::ScopedTestNSSChromeOSUser(
   1095     const std::string& username_hash)
   1096     : username_hash_(username_hash), constructed_successfully_(false) {
   1097   if (!temp_dir_.CreateUniqueTempDir())
   1098     return;
   1099   constructed_successfully_ =
   1100       InitializeNSSForChromeOSUser(username_hash,
   1101                                    username_hash,
   1102                                    false /* is_primary_user */,
   1103                                    temp_dir_.path());
   1104 }
   1105 
   1106 ScopedTestNSSChromeOSUser::~ScopedTestNSSChromeOSUser() {
   1107   if (constructed_successfully_)
   1108     g_nss_singleton.Get().CloseTestChromeOSUser(username_hash_);
   1109 }
   1110 
   1111 void ScopedTestNSSChromeOSUser::FinishInit() {
   1112   InitializePrivateSoftwareSlotForChromeOSUser(username_hash_);
   1113 }
   1114 
   1115 bool InitializeNSSForChromeOSUser(
   1116     const std::string& email,
   1117     const std::string& username_hash,
   1118     bool is_primary_user,
   1119     const base::FilePath& path) {
   1120   return g_nss_singleton.Get().InitializeNSSForChromeOSUser(
   1121       email, username_hash, is_primary_user, path);
   1122 }
   1123 void InitializeTPMForChromeOSUser(
   1124     const std::string& username_hash,
   1125     CK_SLOT_ID slot_id) {
   1126   g_nss_singleton.Get().InitializeTPMForChromeOSUser(username_hash, slot_id);
   1127 }
   1128 void InitializePrivateSoftwareSlotForChromeOSUser(
   1129     const std::string& username_hash) {
   1130   g_nss_singleton.Get().InitializePrivateSoftwareSlotForChromeOSUser(
   1131       username_hash);
   1132 }
   1133 ScopedPK11Slot GetPublicSlotForChromeOSUser(const std::string& username_hash) {
   1134   return g_nss_singleton.Get().GetPublicSlotForChromeOSUser(username_hash);
   1135 }
   1136 ScopedPK11Slot GetPrivateSlotForChromeOSUser(
   1137     const std::string& username_hash,
   1138     const base::Callback<void(ScopedPK11Slot)>& callback) {
   1139   return g_nss_singleton.Get().GetPrivateSlotForChromeOSUser(username_hash,
   1140                                                              callback);
   1141 }
   1142 #endif  // defined(OS_CHROMEOS)
   1143 
   1144 base::Time PRTimeToBaseTime(PRTime prtime) {
   1145   return base::Time::FromInternalValue(
   1146       prtime + base::Time::UnixEpoch().ToInternalValue());
   1147 }
   1148 
   1149 PRTime BaseTimeToPRTime(base::Time time) {
   1150   return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue();
   1151 }
   1152 
   1153 PK11SlotInfo* GetPublicNSSKeySlot() {
   1154   return g_nss_singleton.Get().GetPublicNSSKeySlot();
   1155 }
   1156 
   1157 PK11SlotInfo* GetPrivateNSSKeySlot() {
   1158   return g_nss_singleton.Get().GetPrivateNSSKeySlot();
   1159 }
   1160 
   1161 }  // namespace crypto
   1162