Refactor X509Certificate caching to cache the OS handle, rather than the X509Certificate

net/base/x509_certificate_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include "base/crypto/rsa_private_key.h"
 #include "base/crypto/scoped_capi_types.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ skipping 518 matching lines @@
   system_time.wSecond = exploded.second;
   system_time.wMilliseconds = exploded.millisecond;
 
   PCCERT_CONTEXT cert_handle =
       CertCreateSelfSignCertificate(key->provider(), &subject_name,
                                     CERT_CREATE_SELFSIGN_NO_KEY_INFO,
                                     NULL, &sign_algo, 0, &system_time, 0);
   DCHECK(cert_handle) << "Failed to create self-signed certificate: "
                       << logging::GetLastSystemErrorCode();
 
-  X509Certificate* cert = CreateFromHandle(cert_handle,
-                                           SOURCE_LONE_CERT_IMPORT,
-                                           OSCertHandles());
+  X509Certificate* cert = CreateFromHandle(cert_handle, OSCertHandles());
   FreeOSCertHandle(cert_handle);
   return cert;
 }
 
 void X509Certificate::GetDNSNames(std::vector<std::string>* dns_names) const {
   dns_names->clear();
   if (cert_handle_) {
     scoped_ptr_malloc<CERT_ALT_NAME_INFO> alt_name_info;
     GetCertSubjectAltName(cert_handle_, &alt_name_info);
     CERT_ALT_NAME_INFO* alt_name = alt_name_info.get();
@@ skipping 35 matching lines @@
 };
 
 static base::LazyInstance<GlobalCertStore> g_cert_store(
     base::LINKER_INITIALIZED);
 
 // static
 HCERTSTORE X509Certificate::cert_store() {
   return g_cert_store.Get().cert_store();
 }
 
+X509Certificate::OSCertListHandle
+X509Certificate::CreateOSCertListHandle() const {
+  // Create a temporary certificate store to hold |cert_handle_| and any
+  // associated intermediates. The store will be referenced in the returned
+  // OSCertListHandle, and will not be freed until the OSCertListHandle is
+  // freed.
+  OSCertListHandle cert_list = NULL;
+  DWORD flags = CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG;
+  HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0,
+                                   NULL, flags, NULL);
+
+  if (store) {
+    // NOTE: This preserves all of the properties of |cert_handle_| except for
+    // CERT_KEY_PROV_HANDLE_PROP_ID and CERT_KEY_CONTEXT_PROP_ID - the two
+    // properties that hold access to already-opened private keys. If a handle
+    // has already been unlocked (eg: PIN prompt), then the first time that
+    // the identity is used for client auth, it may prompt the user again.
+    BOOL ok = CertAddCertificateContextToStore(store, cert_handle_,
+                                               CERT_STORE_ADD_ALWAYS,
+                                               &cert_list);
+    if (ok && cert_list) {
+      for (size_t i = 0; ok && i < intermediate_ca_certs_.size(); ++i) {
+        ok = CertAddCertificateContextToStore(store, intermediate_ca_certs_[i],
+                                              CERT_STORE_ADD_ALWAYS, NULL);
+      }
+    }
+
+    // If |cert_list| points to a valid certificate, this will not actually
+    // close and free |store| until |cert_list| is freed.
+    CertCloseStore(store, 0);
+
+    if (!ok) {
+      FreeOSCertListHandle(cert_list);
+      return NULL;
+    }
+  }
+
+  return cert_list;
+}
+
 int X509Certificate::Verify(const std::string& hostname,
                             int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
   if (!cert_handle_)
     return ERR_UNEXPECTED;
 
   // Build and validate certificate chain.
 
   CERT_CHAIN_PARA chain_para;
@@ skipping 48 matching lines @@
   // corresponds to HCCE_CURRENT_USER and is is initialized as needed by
   // crypt32. However, when testing, it is necessary to create a new
   // HCERTCHAINENGINE and use that instead. This is because each
   // HCERTCHAINENGINE maintains a cache of information about certificates
   // encountered, and each test run may modify the trust status of a
   // certificate.
   ScopedHCERTCHAINENGINE chain_engine(NULL);
   if (TestRootCerts::HasInstance())
     chain_engine.reset(TestRootCerts::GetInstance()->GetChainEngine());
 
+  OSCertListHandle cert_list = CreateOSCertListHandle();
   PCCERT_CHAIN_CONTEXT chain_context;
   // IE passes a non-NULL pTime argument that specifies the current system
   // time.  IE passes CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT as the
   // chain_flags argument.
   if (!CertGetCertificateChain(
            chain_engine,
-           cert_handle_,
+           cert_list,
            NULL,  // current system time
-           cert_handle_->hCertStore,
+           cert_list->hCertStore,
            &chain_para,
            chain_flags,
            NULL,  // reserved
            &chain_context)) {
+    FreeOSCertListHandle(cert_list);
     return MapSecurityError(GetLastError());
   }
+  FreeOSCertListHandle(cert_list);
+
   if (chain_context->TrustStatus.dwErrorStatus &
       CERT_TRUST_IS_NOT_VALID_FOR_USAGE) {
     ev_policy_oid = NULL;
     chain_para.RequestedIssuancePolicy.Usage.cUsageIdentifier = 0;
     chain_para.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier = NULL;
     CertFreeCertificateChain(chain_context);
     if (!CertGetCertificateChain(
              chain_engine,
              cert_handle_,
              NULL,  // current system time
@@ skipping 214 matching lines @@
     OSCertHandle cert_handle) {
   return CertDuplicateCertificateContext(cert_handle);
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   CertFreeCertificateContext(cert_handle);
 }
 
 // static
+void X509Certificate::FreeOSCertListHandle(OSCertListHandle cert_list) {
+  CertFreeCertificateContext(cert_list);
+}
+
+// static
 SHA1Fingerprint X509Certificate::CalculateFingerprint(
     OSCertHandle cert) {
   DCHECK(NULL != cert->pbCertEncoded);
   DCHECK(0 != cert->cbCertEncoded);
 
   BOOL rv;
   SHA1Fingerprint sha1;
   DWORD sha1_size = sizeof(sha1.data);
   rv = CryptHashCertificate(NULL, CALG_SHA1, 0, cert->pbCertEncoded,
                             cert->cbCertEncoded, sha1.data, &sha1_size);
@@ skipping 38 matching lines @@
                                             &length))
     return false;
 
   return pickle->WriteData(reinterpret_cast<const char*>(&buffer[0]),
                            length);
 }
 
 
 
 }  // namespace net