NSS: PKCS 11 password prompt.

net/base/cert_database_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
 #include "base/logging.h"
 #include "base/nss_util.h"
 #include "base/scoped_ptr.h"
 #include "net/base/net_errors.h"
+#include "net/base/pk11_slot.h"
 #include "net/base/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertTrust.h"
 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
 
 // PSM = Mozilla's Personal Security Manager.
 namespace psm = mozilla_security_manager;
 
 namespace net {
 
@@ skipping 72 matching lines @@
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node)) {
     certs->push_back(X509Certificate::CreateFromHandle(
         node->cert,
         X509Certificate::SOURCE_LONE_CERT_IMPORT,
         X509Certificate::OSCertHandles()));
   }
   CERT_DestroyCertList(cert_list);
 }
 
+void CertDatabase::ListTokensForPKCS12(PK11SlotList* slots) const {
+  slots->clear();
+
+  ::PK11SlotList* slot_list = NULL;
+  slot_list = PK11_GetAllTokens(CKM_RSA_PKCS,

[wtc, 2010/12/15 20:54:36]

BUG: I think you should pass CKM_INVALID_MECHANISM instead
of CKM_RSA_PKCS as the first argument.  See
http://mxr.mozilla.org/security/ident?i=PK11_GetAllTokens

Add a null pointer check for slot_list.

[mattm, 2011/01/12 01:22:07]

Done.
Done.

+                                PR_TRUE,  // needRW
+                                PR_TRUE,  // loadCerts (unused)
+                                NULL);  // wincx
+
+  ::PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list);
+  while (slot_element) {
+    slots->push_back(PK11Slot::CreateFromHandle(slot_element->slot));
+    slot_element = PK11_GetNextSafe(slot_list, slot_element,
+                                    PR_FALSE);  // restart
+  }
+
+  PK11_FreeSlotList(slot_list);
+}
+
 int CertDatabase::ImportFromPKCS12(
-    const std::string& data, const string16& password) {
-  return psm::nsPKCS12Blob_Import(data.data(), data.size(), password);
+    net::PK11Slot* slot, const std::string& data, const string16& password) {

[wtc, 2010/12/15 20:54:36]

Nit: in this form, we probably should list one parameter per
line.

[mattm, 2011/01/12 01:22:07]

Done.

+  return psm::nsPKCS12Blob_Import(slot->os_slot_handle(),
+                                  data.data(), data.size(),
+                                  password);
 }
 
 int CertDatabase::ExportToPKCS12(
     const CertificateList& certs,
     const string16& password,
     std::string* output) const {
   return psm::nsPKCS12Blob_Export(output, certs, password);
 }
 
 X509Certificate* CertDatabase::FindRootInList(
@@ skipping 81 matching lines @@
   }
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net