NSSCertDatabaseChromeOS

net/cert/cert_database.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CERT_DATABASE_H_
 #define NET_CERT_CERT_DATABASE_H_
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_certificate.h"
 
 template <typename T> struct DefaultSingletonTraits;
 template <class ObserverType> class ObserverListThreadSafe;
 
 namespace net {
 
+class NSSCertDatabase;
+
 // This class provides cross-platform functions to verify and add user
 // certificates, and to observe changes to the underlying certificate stores.
 
 // TODO(gauravsh): This class could be augmented with methods
 // for all operations that manipulate the underlying system
 // certificate store.
 
 class NET_EXPORT CertDatabase {
  public:
   // A CertDatabase::Observer will be notified on certificate database changes.
@@ skipping 49 matching lines @@
   // which means that this must be called from a MessageLoop of TYPE_UI.
   void SetMessageLoopForKeychainEvents();
 #endif
 
 #if defined(OS_ANDROID)
   // On android, the system database is used. When the system notifies the
   // application that the certificates changed, the observers must be notified.
   void OnAndroidKeyChainChanged();
 #endif
 
+#if defined(USE_NSS)
+  // Observe events from the |source| and forward them to observers of this
+  // CertDatabase.
+  void ObserveNSSCertDatabase(NSSCertDatabase* source);

[Ryan Sleevi, 2013/12/18 21:28:32]

Per our discussion, this is temporary, right?

If so, please open a tracking bug (to fix the CertDatabase::GetInstance()
callers) and let's fix this.

Also, should it be public, or should it be private + friend class to
NSSCertDatabase? Since this feels like a "Temporary while refactoring", I'd
prefer the latter.

[mattm, 2013/12/19 22:35:00]

Hm, even after making CertDatabase a per-profile object, CertDatabase and
NSSCertDatabase would still be separate, I still think we need something like
this to combine the events from both. I might be forgetting something we
discussed.
If we friend the NSSCertDatabase, this could actually all be much simpler.
NSSCertDatabase could just directly call the CertDatabase->NotifyObservers
methods and we could drop the Notifier helper and the observer lists on
NSSCertDatabase, etc.

[Ryan Sleevi, 2013/12/20 01:35:19]

Both CertDatabase and NSSCertDatabase are objects that should be
threaded-through per-profile.

When the IOThread initializes its CertDatabase, for the NSS case, it can
construct a CertDatabaseNSS and pass the NSSCertDatabase in (or we can fold
NSSCertDatabase back into CertDatabaseNSS if-and-only-if the only accesses to
the "NSS-specific" stuff is done at chrome/ or higher).

IIRC, the NSS-specific bits are used by chromeos/ as well, but beyond that, it's
all at chrome/?

Anyways, we can address this in a follow-up, but I think we've got a good
transition away from this dependency graph, and the "friend" is just to keep the
dependencies from growing.

+#endif
+
  private:
   friend struct DefaultSingletonTraits<CertDatabase>;
 
   CertDatabase();
   ~CertDatabase();
 
   // Broadcasts notifications to all registered observers.
   void NotifyObserversOfCertAdded(const X509Certificate* cert);
   void NotifyObserversOfCertRemoved(const X509Certificate* cert);
   void NotifyObserversOfCACertChanged(const X509Certificate* cert);
 
   const scoped_refptr<ObserverListThreadSafe<Observer> > observer_list_;
 
 #if defined(USE_NSS) || (defined(OS_MACOSX) && !defined(OS_IOS))
   class Notifier;
   friend class Notifier;
   scoped_ptr<Notifier> notifier_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(CertDatabase);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CERT_DATABASE_H_