Add a ClientKeyStore to allow injection of non-platform keys for TLS client auth.

net/ssl/client_key_store.h

Index: net/ssl/client_key_store.h
diff --git a/net/ssl/client_key_store.h b/net/ssl/client_key_store.h
new file mode 100644
index 0000000000000000000000000000000000000000..69e4e875dd3cae3d4f9f6e8e83caa0d6827a659c
--- /dev/null
+++ b/net/ssl/client_key_store.h
@@ -0,0 +1,87 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_SSL_CLIENT_KEY_STORE_H_
+#define NET_SSL_CLIENT_KEY_STORE_H_
+
+#include <map>
+#include <vector>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/synchronization/lock.h"
+#include "net/base/net_export.h"
+
+template <typename T>
+struct DefaultSingletonTraits;
+
+namespace net {
+
+class SSLPrivateKey;
+class X509Certificate;
+
+// A certificate and key store that allows several external certificate
+// providers to push certificates and keys into this store. All currently
+// provided certificates will be exposed through |FetchClientCertPrivateKey|.
+// Methods of this singleton can be called on any thread.
+class NET_EXPORT ClientKeyStore {
+ public:
+  struct ProviderHandle {
+    ProviderHandle() : id(-1) {}
+    ProviderHandle(int provider_id) : id(provider_id) {}
+    int id;
+  };

[Ryan Sleevi, 2015/08/08 00:14:22]

Why is this necessary? Why do you return it as ProviderHandle rather than int /
with a typedef?

[pneubeck (no reviews), 2015/08/13 08:20:19]

refactored.

+
+  using KeyGetter = base::Callback<scoped_ptr<SSLPrivateKey>(void)>;

[Ryan Sleevi, 2015/08/08 00:14:22]

This seems unnecessarily opaque. It does not seem to add value as a typedef.

[pneubeck (no reviews), 2015/08/13 08:20:19]

refactored.

+
+  struct CertAndKey {

[Ryan Sleevi, 2015/08/08 00:14:22]

Why is this a struct instead of just a std::pair or std::tuple?

[pneubeck (no reviews), 2015/08/13 08:20:19]

refactored.

+    CertAndKey();
+    ~CertAndKey();
+
+    scoped_refptr<X509Certificate> certificate;
+
+    // Can be called on every thread. Each call returns an SSLPrivateKey that
+    // can be used on the calling thread. The SSLPrivateKey must represent the
+    // private key certified by |certificate|.
+    KeyGetter key_getter;
+  };
+  using CertsAndKeys = std::vector<CertAndKey>;

[Ryan Sleevi, 2015/08/08 00:14:22]

This seems unnecessarily opaque. It does not seem to add value as a typedef.

[pneubeck (no reviews), 2015/08/13 08:20:19]

refactored.

+
+  static ClientKeyStore* GetInstance();
+
+  // Creates a new provider and returns a handle to that provider.
+  ProviderHandle CreateNewProvider();
+
+  // Removes the given provider. All provided certificates of that provider will
+  // be dropped.
+  void RemoveProvider(ProviderHandle provider);
+
+  // Sets the certificates provided by |provider| to |certs|. Any previously set
+  // certificates will be ignored.
+  // |certs| will be empty after this call.
+  void SetCertificates(ProviderHandle provider, CertsAndKeys* certs);
+
+  // Given a certificate's |public_key|, return the corresponding private
+  // key if any of the registered providers has a matching key.
+  // Returns its matching private key on success, NULL otherwise.
+  scoped_ptr<SSLPrivateKey> FetchClientCertPrivateKey(
+      const X509Certificate* certificate);
+
+ private:
+  ClientKeyStore();
+  ~ClientKeyStore();
+
+  friend struct DefaultSingletonTraits<ClientKeyStore>;
+  int next_free_provider_id_ = 0;
+  std::map<int, CertsAndKeys> certs_per_provider_;
+  base::Lock lock_;

[Ryan Sleevi, 2015/08/08 00:14:22]

Presumably this lock protects all these members; historically, we put it first,
not last.

[pneubeck (no reviews), 2015/08/13 08:20:19]

Done.

+
+  DISALLOW_COPY_AND_ASSIGN(ClientKeyStore);
+};
+
+}  // namespace net
+
+#endif  // NET_SSL_CLIENT_KEY_STORE_H_