Plumbing SSLPrivateKey

net/ssl/ssl_platform_key_nss.cc

Index: net/ssl/ssl_platform_key_nss.cc
diff --git a/net/ssl/ssl_platform_key_nss.cc b/net/ssl/ssl_platform_key_nss.cc
index 22a6eec487dd0ca293fb54039581cdf758ff0b25..3c4bc7d77b583b172a0e903063b9efaeb5b4fbc3 100644
--- a/net/ssl/ssl_platform_key_nss.cc
+++ b/net/ssl/ssl_platform_key_nss.cc
@@ -27,6 +27,9 @@ namespace net {
 
 namespace {
 
+base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
+    LAZY_INSTANCE_INITIALIZER;
+
 void LogPRError() {
   PRErrorCode err = PR_GetError();
   const char* err_name = PR_ErrorToName(err);
@@ -154,9 +157,14 @@ class SSLPlatformKeyNSS : public ThreadedSSLPrivateKey::Delegate {
 
 }  // namespace
 
-scoped_ptr<SSLPrivateKey> FetchClientCertPrivateKey(
-    X509Certificate* certificate,
-    scoped_refptr<base::SequencedTaskRunner> task_runner) {
+scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
+    X509Certificate* certificate) {
+  if (!certificate || !certificate->os_cert_handle()) {

[davidben, 2015/09/25 20:10:12]

Ditto about handling in caller.

(I don't think os_cert_handle being missing is possible, is it?)

[svaldez, 2015/09/28 16:54:53]

The handle could theoretically be closed or destructed? Same reasoning for
handling null here.

[davidben, 2015/10/13 20:32:15]

But the handle is owned by the X509Certificate. We shouldn't be destroying those
I think.

[svaldez, 2015/10/14 15:06:18]

Its only owned insofar as we have a pointer to the data, but modulo caching, I
think that the OS could still access this data, and I think when I was testing
this came up as a problem.

+    return nullptr;
+  }
+  LOG(ERROR) << "Cert: " << certificate << "\n";
+  LOG(ERROR) << "Cert Handle: " << certificate->os_cert_handle() << "\n";

[davidben, 2015/09/25 20:10:12]

Probably want to drop these two.

[svaldez, 2015/09/28 16:54:53]

Done.

+
   crypto::ScopedSECKEYPrivateKey key(
       PK11_FindKeyByAnyCert(certificate->os_cert_handle(), nullptr));
   if (!key) {
@@ -177,9 +185,9 @@ scoped_ptr<SSLPrivateKey> FetchClientCertPrivateKey(
       LOG(ERROR) << "Unknown key type: " << nss_type;
       return nullptr;
   }
-  return make_scoped_ptr(new ThreadedSSLPrivateKey(
+  return make_scoped_refptr(new ThreadedSSLPrivateKey(
       make_scoped_ptr(new SSLPlatformKeyNSS(type, key.Pass())),
-      task_runner.Pass()));
+      g_platform_key_task_runner.Get().task_runner().Pass()));
 }
 
 }  // namespace net