NSS: PKCS 11 password prompt.

net/base/keygen_handler_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/keygen_handler.h"
 
+#include "base/crypto/pk11_blocking_password_delegate.h"
+#include "base/crypto/scoped_nss_types.h"
+#include "base/logging.h"
+#include "base/nss_util.h"
+#include "base/nss_util_internal.h"
 #include "net/third_party/mozilla_security_manager/nsKeygenHandler.h"
 
 // PSM = Mozilla's Personal Security Manager.
 namespace psm = mozilla_security_manager;
 
 namespace net {
 
 std::string KeygenHandler::GenKeyAndSignChallenge() {
+  // Ensure NSS is initialized.
+  base::EnsureNSSInit();
+
+  // TODO(mattm): allow choosing which slot to store the generated key?

[wtc, 2010/12/15 20:54:36]

Nit: store the generated key => generate and store the key

[mattm, 2011/01/12 01:22:07]

Done.

+  base::ScopedPK11Slot slot(base::GetDefaultNSSKeySlot());
+  if (!slot.get()) {
+    LOG(ERROR) << "Couldn't get Internal key slot!";

[wtc, 2010/12/15 20:54:36]

Nit: lowercase "internal".

[mattm, 2011/01/12 01:22:07]

Done.

+    return std::string();
+  }
+
+  // Authenticate to the token.
+  if (SECSuccess != PK11_Authenticate(slot.get(), PR_TRUE,
+                                      pk11_password_delegate_.get())) {
+    LOG(ERROR) << "Couldn't authenticate to PK11 token!";

[wtc, 2010/12/15 20:54:36]

Nit: this probably should also say "internal key slot" for
consistency with the error message above, because both refer
to the same slot/token.

At least change "PK11" to "PKCS #11" or just remove "PK11".

[mattm, 2011/01/12 01:22:07]

Done.

+    return std::string();
+  }
+
   return psm::GenKeyAndSignChallenge(key_size_in_bits_, challenge_, url_,
-                                     stores_key_);
+                                     slot.get(), stores_key_);
+}
+
+void KeygenHandler::set_pk11_password_delegate(
+    base::PK11BlockingPasswordDelegate* delegate) {
+  pk11_password_delegate_.reset(delegate);
 }
 
 }  // namespace net