Give keys friendly names in NSS and OS X

net/base/keygen_handler_mac.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/keygen_handler.h"
 
 #include <Security/SecAsn1Coder.h>
 #include <Security/SecAsn1Templates.h>
 #include <Security/Security.h>
 
 #include "base/base64.h"
 #include "base/crypto/cssm_init.h"
 #include "base/lock.h"
 #include "base/logging.h"
 #include "base/scoped_cftyperef.h"
+#include "base/string_util.h"
+#include "base/sys_string_conversions.h"
 
 // These are in Security.framework but not declared in a public header.
 extern const SecAsn1Template kSecAsn1AlgorithmIDTemplate[];
 extern const SecAsn1Template kSecAsn1SubjectPublicKeyInfoTemplate[];
 
 namespace net {
 
 // Declarations of Netscape keygen cert structures for ASN.1 encoding:
 
 struct PublicKeyAndChallenge {
@@ skipping 56 matching lines @@
     SEC_ASN1_BIT_STRING,
     offsetof(SignedPublicKeyAndChallenge, signature)
   },
   {
     0
   }
 };
 
 
 static OSStatus CreateRSAKeyPair(int size_in_bits,
+                                 SecAccessRef initial_access,
                                  SecKeyRef* out_pub_key,
                                  SecKeyRef* out_priv_key);
 static OSStatus SignData(CSSM_DATA data,
                          SecKeyRef private_key,
                          CSSM_DATA* signature);
 
 std::string KeygenHandler::GenKeyAndSignChallenge() {
   std::string result;
   OSStatus err;
+  SecAccessRef initial_access = NULL;
   SecKeyRef public_key = NULL;
   SecKeyRef private_key = NULL;
   SecAsn1CoderRef coder = NULL;
   CSSM_DATA signature = {0, NULL};
 
   {
+    if (url_.has_host()) {
+      // TODO(davidben): Use something like "Key generated for
+      // example.com", but localize it.
+      scoped_cftyperef<CFStringRef> label(
+          base::SysUTF8ToCFStringRef(url_.host()));
+      // Create an initial access object to set the SecAccessRef. This
+      // sets a label on the Keychain dialogs. Pass NULL as the second
+      // argument to use the default trusted list; only allow the
+      // current application to access without user confirmation.
+      err = SecAccessCreate(label, NULL, &initial_access);
+      // If we fail, just continue without a label.
+      if (err)
+        base::LogCSSMError("SecAccessCreate", err);
+    }
+
     // Create the key-pair.
-    err = CreateRSAKeyPair(key_size_in_bits_, &public_key, &private_key);
+    err = CreateRSAKeyPair(key_size_in_bits_, initial_access,
+                           &public_key, &private_key);
     if (err)
       goto failure;
 
     // Get the public key data (DER sequence of modulus, exponent).
     CFDataRef key_data = NULL;
     err = SecKeychainItemExport(public_key, kSecFormatBSAFE, 0, NULL,
                                 &key_data);
     if (err) {
       base::LogCSSMError("SecKeychainItemExpor", err);
       goto failure;
@@ skipping 62 matching lines @@
     if (public_key)
       SecKeychainItemDelete(reinterpret_cast<SecKeychainItemRef>(public_key));
     if (private_key)
       SecKeychainItemDelete(reinterpret_cast<SecKeychainItemRef>(private_key));
   }
 
   // Clean up:
   free(signature.Data);
   if (coder)
     SecAsn1CoderRelease(coder);
+  if (initial_access)
+    CFRelease(initial_access);
   if (public_key)
     CFRelease(public_key);
   if (private_key)
     CFRelease(private_key);
   return result;
 }
 
 
 static OSStatus CreateRSAKeyPair(int size_in_bits,
+                                 SecAccessRef initial_access,
                                  SecKeyRef* out_pub_key,
                                  SecKeyRef* out_priv_key) {
   OSStatus err;
   SecKeychainRef keychain;
   err = SecKeychainCopyDefault(&keychain);
   if (err) {
     base::LogCSSMError("SecKeychainCopyDefault", err);
     return err;
   }
   scoped_cftyperef<SecKeychainRef> scoped_keychain(keychain);
   {
     AutoLock locked(base::GetMacSecurityServicesLock());
     err = SecKeyCreatePair(
         keychain,
         CSSM_ALGID_RSA,
         size_in_bits,
         0LL,
         // public key usage and attributes:
         CSSM_KEYUSE_ENCRYPT | CSSM_KEYUSE_VERIFY | CSSM_KEYUSE_WRAP,
         CSSM_KEYATTR_EXTRACTABLE | CSSM_KEYATTR_PERMANENT,
         // private key usage and attributes:
         CSSM_KEYUSE_DECRYPT | CSSM_KEYUSE_SIGN | CSSM_KEYUSE_UNWRAP,
         CSSM_KEYATTR_EXTRACTABLE | CSSM_KEYATTR_PERMANENT |
             CSSM_KEYATTR_SENSITIVE,
-        NULL,
+        initial_access,
         out_pub_key, out_priv_key);
   }
   if (err)
     base::LogCSSMError("SecKeyCreatePair", err);
   return err;
 }
 
 static OSStatus CreateSignatureContext(SecKeyRef key,
                                        CSSM_ALGORITHMS algorithm,
                                        CSSM_CC_HANDLE* out_cc_handle) {
@@ skipping 53 matching lines @@
     return err;
   }
   err = CSSM_SignData(cc_handle, &data, 1, CSSM_ALGID_NONE, signature);
   if (err)
     base::LogCSSMError("CSSM_SignData", err);
   CSSM_DeleteContext(cc_handle);
   return err;
 }
 
 }  // namespace net