ClientCertStoreChromeOS: support additional non-platform certs.

net/ssl/client_cert_store_chromeos.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/client_cert_store_chromeos.h"
 
 #include <cert.h>
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 
 namespace net {
 
 namespace {
 
 class CertNotAllowedPredicate {
  public:
   explicit CertNotAllowedPredicate(
+      const CertificateList& additional_certs,
       const ClientCertStoreChromeOS::CertFilter& filter)
-      : filter_(filter) {}
+      : additional_certs_(additional_certs), filter_(filter) {}
+
   bool operator()(const scoped_refptr<X509Certificate>& cert) const {
+    for (const auto& additional_cert : additional_certs_) {
+      if (additional_cert->Equals(cert.get()))
+        return false;
+    }
     return !filter_.IsCertAllowed(cert);
   }
 
  private:
+  const CertificateList& additional_certs_;
   const ClientCertStoreChromeOS::CertFilter& filter_;
 };
 
 }  // namespace
 
 ClientCertStoreChromeOS::ClientCertStoreChromeOS(
+    const CertificateList& additional_certs,
     scoped_ptr<CertFilter> cert_filter,
     const PasswordDelegateFactory& password_delegate_factory)
     : ClientCertStoreNSS(password_delegate_factory),
-      cert_filter_(cert_filter.Pass()) {
-}
+      additional_certs_(additional_certs),
+      cert_filter_(cert_filter.Pass()) {}
 
 ClientCertStoreChromeOS::~ClientCertStoreChromeOS() {}
 
 void ClientCertStoreChromeOS::GetClientCerts(
     const SSLCertRequestInfo& cert_request_info,
     CertificateList* selected_certs,
     const base::Closure& callback) {
   base::Closure bound_callback =
       base::Bind(&ClientCertStoreChromeOS::CertFilterInitialized,
                  // Caller is responsible for keeping the ClientCertStore alive
                  // until the callback is run.
                  base::Unretained(this),
                  &cert_request_info,
                  selected_certs,
                  callback);
 
   if (cert_filter_->Init(bound_callback))
     bound_callback.Run();
 }
 
 void ClientCertStoreChromeOS::GetClientCertsImpl(
     CERTCertList* cert_list,
     const SSLCertRequestInfo& request,
     bool query_nssdb,
     CertificateList* selected_certs) {
+  for (const auto& cert : additional_certs_) {
+    CERT_AddCertToListTail(cert_list,
+                           CERT_DupCertificate(cert->os_cert_handle()));
+  }
+
   ClientCertStoreNSS::GetClientCertsImpl(
       cert_list, request, query_nssdb, selected_certs);
 
   size_t pre_size = selected_certs->size();
-  selected_certs->erase(std::remove_if(selected_certs->begin(),
-                                       selected_certs->end(),
-                                       CertNotAllowedPredicate(*cert_filter_)),
-                        selected_certs->end());
+
+  // Remove certificates that are not allowed by |cert_filter_| but always keep
+  // certificates from |additional_certs_|.
+  selected_certs->erase(
+      std::remove_if(selected_certs->begin(), selected_certs->end(),
+                     CertNotAllowedPredicate(additional_certs_, *cert_filter_)),
+      selected_certs->end());

[Ryan Sleevi, 2015/08/07 23:51:09]

This seems highly inefficient - the operator() operation goes from O(N) [linear
scan] to O(N*M), where M is the number of certs, since you iterate through the
entirity of |additional_certs| every single pass.

It seems you really should do two passes - create a temp CERT_CertList, call
ClientCertStoreNSS::GetClientCertsImpl() on it, get filtered_additional_certs.
Then call GetClientCertsImpl on cert_list, get selected_certs. Run
selected_certs through the predicate. Then

selected_certs->insert(selected_certs.end(), filtered_additional_certs.begin(),
filtered_additional_certs.end());

This gives you O(N) + O(M) performance.

[pneubeck (no reviews), 2015/08/10 12:09:56]

Done.

   DVLOG(1) << "filtered " << pre_size - selected_certs->size() << " of "
            << pre_size << " certs";
 }
 
 void ClientCertStoreChromeOS::CertFilterInitialized(
     const SSLCertRequestInfo* request,
     CertificateList* selected_certs,
     const base::Closure& callback) {
   ClientCertStoreNSS::GetClientCerts(*request, selected_certs, callback);
 }
 
 }  // namespace net