Add a ClientKeyStore to allow injection of non-platform keys for TLS client auth.

net/ssl/client_key_store.cc

Index: net/ssl/client_key_store.cc
diff --git a/net/ssl/client_key_store.cc b/net/ssl/client_key_store.cc
new file mode 100644
index 0000000000000000000000000000000000000000..3cc4acc5df6e5ab16308fdf8e3995f800f610792
--- /dev/null
+++ b/net/ssl/client_key_store.cc
@@ -0,0 +1,49 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/ssl/client_key_store.h"
+
+#include <algorithm>
+
+#include "base/memory/singleton.h"
+#include "net/cert/x509_certificate.h"
+#include "net/ssl/ssl_private_key.h"
+
+namespace net {
+
+ClientKeyStore::ClientKeyStore() {}
+
+ClientKeyStore::~ClientKeyStore() {}
+
+// static
+ClientKeyStore* ClientKeyStore::GetInstance() {
+  return Singleton<ClientKeyStore, LeakySingletonTraits<ClientKeyStore>>::get();
+}
+
+void ClientKeyStore::AddProvider(scoped_ptr<CertKeyProvider> provider) {
+  base::AutoLock auto_lock(lock_);
+  providers_.push_back(provider.Pass());
+}
+
+void ClientKeyStore::RemoveProvider(const CertKeyProvider* provider) {
+  base::AutoLock auto_lock(lock_);
+
+  const auto& it = std::find(providers_.begin(), providers_.end(), provider);
+  if (it != providers_.end())
+    providers_.erase(it);
+}
+
+scoped_ptr<SSLPrivateKey> ClientKeyStore::FetchClientCertPrivateKey(
+    const X509Certificate& certificate) {
+  base::AutoLock auto_lock(lock_);
+
+  for (const auto& provider : providers_) {
+    scoped_ptr<SSLPrivateKey> key;
+    if (provider->GetCertificateKey(certificate, &key))

[davidben, 2015/08/14 22:16:48]

Calling a virtual function inside a lock makes me somewhat nervous. I don't have
a concrete alternate suggestion though, so I'm largely expressing my
nervousness. If ClientKeyStore maintained the map from cert hashes, you wouldn't
have that problem, but I dunno if that would cause other problems.

[pneubeck (no reviews), 2015/08/17 14:34:19]

I'm not sure what you're nervous about. Is it because of the performance of
virtual calls? Or because we don't know all side-effects of the call?

+      return key.Pass();
+  }
+  return nullptr;
+}
+
+}  // namespace net