Use NSS for symmetric key crypto operations on Windows and Mac.

chrome/renderer/chrome_render_process_observer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_process_observer.h"
 
 #include "base/allocator/allocator_extension.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
@@ skipping 168 matching lines @@
   if (PathService::Get(chrome::FILE_PDF_PLUGIN, &pdf) &&
       file_util::PathExists(pdf)) {
     g_iat_patch_createdca.Patch(
         pdf.value().c_str(), "gdi32.dll", "CreateDCA", CreateDCAPatch);
     g_iat_patch_get_font_data.Patch(
         pdf.value().c_str(), "gdi32.dll", "GetFontData", GetFontDataPatch);
   }
 #endif
 
 #if defined(OS_POSIX) && !defined(OS_MACOSX) && defined(USE_NSS)
-  // Remoting requires NSS to function properly.
+  // On Linux, NSS uses system libraries, so the .so's must be loaded.

[Nick Bray, 2012/06/14 20:37:06]

On a side note, ChromeOS uses a patched version of NSS that behaves differently
than Linux in some cases.  I've been burned by this.  Probably not relevant for
this CL, but beware of NSS skew for ChromeOS hardware.

[Ryan Sleevi, 2012/06/14 20:54:48]

Do you have an example of this?

Chrome on Linux/CrOS makes no statements about what version the system NSS must
be. It uses shared objects for both of them. There are no patches to NSS that
Chrome for Linux uses.

+  // (On all platforms, RNG is primed in WebKit (for window.crypto.getRandom()).

[Ryan Sleevi, 2012/06/14 19:35:26]

You can remove this second comment.

[ddorwin, 2012/06/14 20:44:19]

Done.

   if (!command_line.HasSwitch(switches::kSingleProcess)) {
     // We are going to fork to engage the sandbox and we have not loaded
     // any security modules so it is safe to disable the fork check in NSS.
     crypto::DisableNSSForkCheck();
     crypto::ForceNSSNoDBInit();
     crypto::EnsureNSSInit();
   }
 #elif defined(OS_WIN)
   // crypt32.dll is used to decode X509 certificates for Chromoting.
   // Only load this library when the feature is enabled.
@@ skipping 143 matching lines @@
   if (clear_cache_pending_) {
     clear_cache_pending_ = false;
     WebCache::clear();
   }
 }
 
 const RendererContentSettingRules*
 ChromeRenderProcessObserver::content_setting_rules() const {
   return &content_setting_rules_;
 }