For PKCS#12 imports, only mark key as unextractable if the PKCS#12 file includes it

net/base/cert_database_nss_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
 #include "base/file_path.h"
@@ skipping 202 matching lines @@
   scoped_refptr<X509Certificate> cert(cert_list[0]);
 
   EXPECT_EQ("testusercert",
             cert->subject().common_name);
 
   std::string exported_data;
   EXPECT_EQ(0, cert_db_.ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"),
                                        &exported_data));
 }
 
+// Importing a Pkcs#12 file with a certificate but no corresponding
+// private key should not mark an existing private key as unextractable.
+TEST_F(CertDatabaseNSSTest, ImportFromPKCS12OnlyMarkIncludedKey) {
+  std::string pkcs12_data = ReadTestFile("client.p12");
+  EXPECT_EQ(OK, cert_db_.ImportFromPKCS12(slot_,
+                                          pkcs12_data,
+                                          ASCIIToUTF16("12345"),
+                                          true));  // is_extractable
+
+  CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
+  ASSERT_EQ(1U, cert_list.size());
+
+  // Now import a Pkcs#12 file with just a certificate but no private key.
+  pkcs12_data = ReadTestFile("client-nokey.p12");
+  EXPECT_EQ(OK, cert_db_.ImportFromPKCS12(slot_,
+                                          pkcs12_data,
+                                          ASCIIToUTF16("12345"),
+                                          false));  // is_extractable
+
+  cert_list = ListCertsInSlot(slot_->os_module_handle());
+  ASSERT_EQ(1U, cert_list.size());
+
+  // Make sure the imported private key is still extractable.
+  std::string exported_data;
+  EXPECT_EQ(1, cert_db_.ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"),
+                                       &exported_data));
+  ASSERT_LT(0U, exported_data.size());
+}
+
 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12InvalidFile) {
   std::string pkcs12_data = "Foobarbaz";
 
   EXPECT_EQ(ERR_PKCS12_IMPORT_INVALID_FILE,
             cert_db_.ImportFromPKCS12(slot_,
                                       pkcs12_data,
                                       ASCIIToUTF16(""),
                                       true));  // is_extractable
 
   // Test db should still be empty.
@@ skipping 313 matching lines @@
       puny_cert.get(), CA_CERT,
       CertDatabase::TRUSTED_SSL | CertDatabase::TRUSTED_EMAIL));
 
   verify_result.Reset();
   error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0, verify_result.cert_status);
 }
 
 }  // namespace net