chaps_support.cc

// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "crypto/chaps_support.h"

#include <dlfcn.h>
#include <secmod.h>
#include <secmodt.h>

#include <string_view>

#include "base/logging.h"
#include "base/memory/raw_ptr_exclusion.h"
#include "base/memory/stack_allocated.h"
#include "base/threading/scoped_blocking_call.h"
#include "crypto/scoped_nss_types.h"
#include "nss_util_internal.h"

namespace crypto {

namespace {

// Constants for loading the Chrome OS TPM-backed PKCS #11 library.
const char kChapsModuleName[] = "Chaps";
const char kChapsPath[] = "libchaps.so";

class ScopedChapsLoadFixup {
  STACK_ALLOCATED();

 public:
  ScopedChapsLoadFixup();
  ~ScopedChapsLoadFixup();

 private:
#if defined(COMPONENT_BUILD)
  // This field stores a handle and is not a pointer to PA memory.
  // Also, this class is always stack-allocated and visibility is limited.
  // Hence no benefit from using raw_ptr<void>.
  RAW_PTR_EXCLUSION void* chaps_handle_;
#endif
};

#if defined(COMPONENT_BUILD)

ScopedChapsLoadFixup::ScopedChapsLoadFixup() {
  // HACK: libchaps links the system protobuf and there are symbol conflicts
  // with the bundled copy. Load chaps with RTLD_DEEPBIND to workaround.
  chaps_handle_ = dlopen(kChapsPath, RTLD_LOCAL | RTLD_NOW | RTLD_DEEPBIND);
}

ScopedChapsLoadFixup::~ScopedChapsLoadFixup() {
  // LoadNSSModule() will have taken a 2nd reference.
  if (chaps_handle_)
    dlclose(chaps_handle_);
}

#else

ScopedChapsLoadFixup::ScopedChapsLoadFixup() = default;
ScopedChapsLoadFixup::~ScopedChapsLoadFixup() = default;

#endif  // defined(COMPONENT_BUILD)

}  // namespace

SECMODModule* LoadChaps() {
  // NSS functions may reenter //net via extension hooks. If the reentered
  // code needs to synchronously wait for a task to run but the thread pool in
  // which that task must run doesn't have enough threads to schedule it, a
  // deadlock occurs. To prevent that, the base::ScopedBlockingCall below
  // increments the thread pool capacity for the duration of the TPM
  // initialization.
  base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
                                                base::BlockingType::WILL_BLOCK);

  ScopedChapsLoadFixup chaps_loader;

  DVLOG(3) << "Loading chaps...";
  return LoadNSSModule(
      kChapsModuleName, kChapsPath,
      // For more details on these parameters, see:
      // https://developer.mozilla.org/en/PKCS11_Module_Specs
      // slotFlags=[PublicCerts] -- Certificates and public keys can be
      //   read from this slot without requiring a call to C_Login.
      // askpw=only -- Only authenticate to the token when necessary.
      "NSS=\"slotParams=(0={slotFlags=[PublicCerts] askpw=only})\"");
}

ScopedPK11Slot GetChapsSlot(SECMODModule* chaps_module, CK_SLOT_ID slot_id) {
  DCHECK(chaps_module);

  // NSS functions may reenter //net via extension hooks. If the reentered
  // code needs to synchronously wait for a task to run but the thread pool in
  // which that task must run doesn't have enough threads to schedule it, a
  // deadlock occurs. To prevent that, the base::ScopedBlockingCall below
  // increments the thread pool capacity for the duration of the TPM
  // initialization.
  base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
                                                base::BlockingType::WILL_BLOCK);

  DVLOG(3) << "Poking chaps module.";
  SECStatus rv = SECMOD_UpdateSlotList(chaps_module);
  if (rv != SECSuccess)
    LOG(ERROR) << "SECMOD_UpdateSlotList failed: " << PORT_GetError();

  ScopedPK11Slot slot =
      ScopedPK11Slot(SECMOD_LookupSlot(chaps_module->moduleID, slot_id));
  if (!slot)
    LOG(ERROR) << "TPM slot " << slot_id << " not found.";
  return slot;
}

bool IsChapsModule(SECMODModule* pk11_module) {
  return pk11_module && std::string_view(pk11_module->commonName) ==
                            std::string_view(kChapsModuleName);
}

bool IsSlotProvidedByChaps(PK11SlotInfo* slot) {
  return slot && IsChapsModule(PK11_GetModule(slot));
}

}  // namespace crypto