NSS: PKCS 11 password prompt.

net/base/cert_database_nss_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
 #include "base/crypto/scoped_nss_types.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/nss_util.h"
 #include "base/nss_util_internal.h"
 #include "base/path_service.h"
 #include "base/scoped_temp_dir.h"
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/cert_database.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
+#include "net/base/pk11_slot.h"
 #include "net/base/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertTrust.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace psm = mozilla_security_manager;
 
 namespace net {
 
 namespace {
@@ skipping 74 matching lines @@
       ScopedTempDir* temp_db_dir = Singleton<
           ScopedTempDir,
           DefaultSingletonTraits<ScopedTempDir>,
           CertDatabaseNSSTest>::get();
       ASSERT_TRUE(temp_db_dir->CreateUniqueTempDir());
       ASSERT_TRUE(
           base::OpenTestNSSDB(temp_db_dir->path(), "CertDatabaseNSSTest db"));
       temp_db_initialized_ = true;
     }
     slot_.reset(base::GetDefaultNSSKeySlot());
+    slot_wrapper_ = PK11Slot::CreateFromHandle(slot_.get());
 
     // Test db should be empty at start of test.
     EXPECT_EQ(0U, ListCertsInSlot(slot_.get()).size());
   }
   virtual void TearDown() {
     // Don't try to cleanup if the setup failed.
     ASSERT_TRUE(temp_db_initialized_);
     ASSERT_TRUE(slot_.get());
 
     EXPECT_TRUE(CleanupSlotContents(slot_.get()));
     EXPECT_EQ(0U, ListCertsInSlot(slot_.get()).size());
   }
 
  protected:
   base::ScopedPK11Slot slot_;
+  scoped_refptr<PK11Slot> slot_wrapper_;

[wtc, 2010/12/15 20:54:36]

Nit: we only need one of slot_ and slot_wrapper_.
I suggest defining slot_ as
  scoped_refptr<PK11Slot> slot_;
and replacing the original slot_.get() with
  slot_->os_slot_handle()

At least consider adding a TODO comment for this.

[mattm, 2011/01/12 01:22:07]

Done.

   CertDatabase cert_db_;
 
  private:
   static bool temp_db_initialized_;
 };
 
 // static
 bool CertDatabaseNSSTest::temp_db_initialized_ = false;
 
 TEST_F(CertDatabaseNSSTest, ListCerts) {
   // This test isn't terribly useful, though it will at least let valgrind test
   // for leaks.
   CertificateList certs;
   cert_db_.ListCerts(&certs);
   // The test DB is empty, but let's assume there will always be something in
   // the other slots.
   EXPECT_LT(0U, certs.size());
 }
 
+TEST_F(CertDatabaseNSSTest, ListTokensForPKCS12) {
+  // This test isn't terribly useful, though it will at least let valgrind test
+  // for leaks.
+  PK11SlotList slots;
+  cert_db_.ListTokensForPKCS12(&slots);
+  // Should have the main slot and the temp test slot.
+  EXPECT_EQ(2U, slots.size());
+}
+
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12WrongPassword) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
   EXPECT_EQ(ERR_PKCS12_IMPORT_BAD_PASSWORD,
-            cert_db_.ImportFromPKCS12(pkcs12_data, ASCIIToUTF16("")));
+            cert_db_.ImportFromPKCS12(slot_wrapper_,
+                                      pkcs12_data,
+                                      ASCIIToUTF16("")));
 
   // Test db should still be empty.
   EXPECT_EQ(0U, ListCertsInSlot(slot_.get()).size());
 }
 
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AndExportAgain) {
   std::string pkcs12_data = ReadTestFile("client.p12");
 
-  EXPECT_EQ(OK, cert_db_.ImportFromPKCS12(pkcs12_data, ASCIIToUTF16("12345")));
+  EXPECT_EQ(OK, cert_db_.ImportFromPKCS12(slot_wrapper_,
+                                          pkcs12_data,
+                                          ASCIIToUTF16("12345")));
 
   CertificateList cert_list = ListCertsInSlot(slot_.get());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
 
   EXPECT_EQ("testusercert",
             cert->subject().common_name);
 
   // TODO(mattm): move export test to seperate test case?
   std::string exported_data;
@@ skipping 317 matching lines @@
       puny_cert.get(), CA_CERT,
       CertDatabase::TRUSTED_SSL | CertDatabase::TRUSTED_EMAIL));
 
   verify_result.Reset();
   error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0, verify_result.cert_status);
 }
 
 }  // namespace net