NSSCertDatabaseChromeOS

net/cert/nss_cert_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
+#include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/memory/singleton.h"
 #include "base/observer_list_threadsafe.h"
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
 
 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
 // the new name of the macro.
 #if !defined(CERTDB_TERMINAL_RECORD)
 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER
 #endif
 
 // PSM = Mozilla's Personal Security Manager.
 namespace psm = mozilla_security_manager;
 
 namespace net {
 
+namespace {
+
+base::LazyInstance<NSSCertDatabase>::Leaky
+    g_nss_cert_database = LAZY_INSTANCE_INITIALIZER;
+
+}  // namespace
+
+
 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
     const scoped_refptr<X509Certificate>& cert,
     int err)
     : certificate(cert), net_error(err) {}
 
 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
 
 // static
 NSSCertDatabase* NSSCertDatabase::GetInstance() {
-  return Singleton<NSSCertDatabase,
-                   LeakySingletonTraits<NSSCertDatabase> >::get();
+#if defined(OS_CHROMEOS)
+  DVLOG(1) << "Using global NSSCertDatabase. Consider using "
+           << "NSSCertDatabaseChromeOS instead.";

[Ryan Sleevi, 2013/12/18 21:28:32]

comment nit: Make this a stronger warning.

"NSSCertDatabase::GetInstance() is deprecated. See http://crbug.com/foo"

I would suggest this at LOG(INFO) or LOG(ERROR) (similar to NOTIMPLEMENTED()) to
provide clear guidance to the code paths being hit that shouldn't be using this.

[mattm, 2013/12/19 22:35:00]

Done.

+#endif
+  return &g_nss_cert_database.Get();
 }
 
 NSSCertDatabase::NSSCertDatabase()
     : observer_list_(new ObserverListThreadSafe<Observer>) {
-  crypto::EnsureNSSInit();
+  // This also makes sure that NSS has been initialized.
+  CertDatabase::GetInstance()->ObserveNSSCertDatabase(this);
+
   psm::EnsurePKCS12Init();
 }
 
 NSSCertDatabase::~NSSCertDatabase() {}
 
 void NSSCertDatabase::ListCerts(CertificateList* certs) {
   certs->clear();
 
   CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
   CERTCertListNode* node;
@@ skipping 46 matching lines @@
                                     PR_FALSE);  // restart
   }
 }
 
 int NSSCertDatabase::ImportFromPKCS12(
     CryptoModule* module,
     const std::string& data,
     const base::string16& password,
     bool is_extractable,
     net::CertificateList* imported_certs) {
+  DVLOG(1) << __func__ << " "
+           << PK11_GetModuleID(module->os_module_handle()) << ":"
+           << PK11_GetSlotID(module->os_module_handle());
   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
                                         data.data(), data.size(),
                                         password,
                                         is_extractable,
                                         imported_certs);
   if (result == net::OK)
     NotifyObserversOfCertAdded(NULL);
 
   return result;
 }
@@ skipping 17 matching lines @@
   X509Certificate* certn_2 = certificates[certificates.size() - 2].get();
   X509Certificate* certn_1 = certificates[certificates.size() - 1].get();
 
   if (CERT_CompareName(&cert1->os_cert_handle()->issuer,
                        &cert0->os_cert_handle()->subject) == SECEqual)
     return cert0;
   if (CERT_CompareName(&certn_2->os_cert_handle()->issuer,
                        &certn_1->os_cert_handle()->subject) == SECEqual)
     return certn_1;
 
-  VLOG(1) << "certificate list is not a hierarchy";
+  LOG(WARNING) << "certificate list is not a hierarchy";
   return cert0;
 }
 
 bool NSSCertDatabase::ImportCACerts(const CertificateList& certificates,
                                     TrustBits trust_bits,
                                     ImportCertFailureList* not_imported) {
   crypto::ScopedPK11Slot slot(GetPublicSlot());
   X509Certificate* root = FindRootInList(certificates);
   bool success = psm::ImportCACerts(
       slot.get(), certificates, root, trust_bits, not_imported);
@@ skipping 173 matching lines @@
   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 }
 
 void NSSCertDatabase::NotifyObserversOfCACertChanged(
     const X509Certificate* cert) {
   observer_list_->Notify(
       &Observer::OnCACertChanged, make_scoped_refptr(cert));
 }
 
 }  // namespace net