Wire up SSL client authentication for OpenSSL/Android through the net/ stack

net/base/cert_database_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <openssl/x509.h>
 
 #include "base/logging.h"
 #include "base/observer_list_threadsafe.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/base/openssl_private_key_store.h"
 #include "net/base/x509_certificate.h"
 
 namespace net {
 
 CertDatabase::CertDatabase()
     : observer_list_(new ObserverListThreadSafe<Observer>) {
 }
 
 CertDatabase::~CertDatabase() {}
 
 int CertDatabase::CheckUserCert(X509Certificate* cert) {
   if (!cert)
     return ERR_CERT_INVALID;
   if (cert->HasExpired())
     return ERR_CERT_DATE_INVALID;
 
-  if (!OpenSSLPrivateKeyStore::GetInstance()->FetchPrivateKey(
-      X509_PUBKEY_get(X509_get_X509_PUBKEY(cert->os_cert_handle()))))
-    return ERR_NO_PRIVATE_KEY_FOR_CERT;

[Ryan Sleevi, 2013/02/28 00:58:35]

Can you remind me where you plan to stick this check?

Can you add a comment here explaining where the 'real' meat lives, and why?

[digit1, 2013/02/28 15:46:56]

Yes, in short form:

- This method is never called on Android, because its only
  user, except on ChromeOS, is SSLAddCertHandler. For more
  details see chrome/browser/ssl/ssl_add_certificate.cc and
  ssl_add_certificate_android.cc

- For the Linux build, the store will always be empty.
  More precisely, OpenSSLPrivateKeyStore::StoreKeyPair(),
  which can populate it, is only used by
  KeygenHandler::GenKeyAndSignChallenge(), so the function
  would always return ERR_NO_PRIVATE_KEY_FOR_CERT, during
  unit testing, except if said test checks for full
  keygen handling (i.e. key pair generation + installation,
  then download of a server-generated client certificate
  which will trigger a SSLAddCertHandler).

  Another possibility is a unit test that directly calls
  StoreKeyPair() to "install" a test key pair in the
  private store, then triggers a fake certificate download
  through a SSLCertAddHandler. However, such a test would
  be Linux/OpenSSL-specific, and I'm unsure there is any
  real value in implementing it.

Anyway, I've restored the old implementation, changing FetchPrivateKey() to
HasPrivateKey() to make things a bit clearer.

-
   return OK;
 }
 
 int CertDatabase::AddUserCert(X509Certificate* cert) {
   NOTIMPLEMENTED();
   return ERR_NOT_IMPLEMENTED;
 }
 
 }  // namespace net