Add ClientCertStoreChromeOS which only returns the certs for a given user.

crypto/nss_util.h

Index: crypto/nss_util.h
diff --git a/crypto/nss_util.h b/crypto/nss_util.h
index 4d3d3e29322ede21821d59f27281d7a2ffb1562a..cf93cb59479723ccaf31d52d283e169399e7cf6e 100644
--- a/crypto/nss_util.h
+++ b/crypto/nss_util.h
@@ -9,6 +9,7 @@
 #include "base/basictypes.h"
 #include "base/callback_forward.h"
 #include "base/compiler_specific.h"
+#include "base/files/scoped_temp_dir.h"
 #include "crypto/crypto_export.h"
 
 namespace base {
@@ -119,6 +120,26 @@ CRYPTO_EXPORT bool IsTPMTokenReady(const base::Closure& callback)
 
 // Initialize the TPM token.  Does nothing if it is already initialized.
 CRYPTO_EXPORT bool InitializeTPMToken(int token_slot_id);
+
+// Exposed for unittests only.
+class CRYPTO_EXPORT_PRIVATE ScopedTestNSSChromeOSUser {
+ public:
+  explicit ScopedTestNSSChromeOSUser(const std::string& username_hash);
+  ~ScopedTestNSSChromeOSUser();
+
+  std::string username_hash() const { return username_hash_; }
+  bool constructed_successfully() const { return constructed_successfully_; }
+
+  // Completes initialization of user. Causes any waiting private slot callbacks
+  // to run.
+  void FinishInit();
+
+ private:
+  const std::string username_hash_;
+  base::ScopedTempDir temp_dir_;
+  bool constructed_successfully_;
+  DISALLOW_COPY_AND_ASSIGN(ScopedTestNSSChromeOSUser);
+};
 #endif
 
 // Convert a NSS PRTime value into a base::Time object.