Use user specific NSSDatabase in CertLoader.

chrome/browser/chromeos/options/cert_library.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/options/cert_library.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
 #include "base/i18n/string_compare.h"
@@ skipping 18 matching lines @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/l10n/l10n_util_collator.h"
 
 namespace chromeos {
 
 namespace {
 
 // Root CA certificates that are built into Chrome use this token name.
 const char kRootCertificateTokenName[] = "Builtin Object Token";
 
-base::string16 GetDisplayString(net::X509Certificate* cert, bool hardware_backed) {
+base::string16 GetDisplayString(net::X509Certificate* cert,
+                                bool hardware_backed) {
   std::string org;
   if (!cert->subject().organization_names.empty())
     org = cert->subject().organization_names[0];
   if (org.empty())
     org = cert->subject().GetDisplayName();
   base::string16 issued_by = base::UTF8ToUTF16(
       x509_certificate_model::GetIssuerCommonName(cert->os_cert_handle(),
                                                   org));  // alternative text
   base::string16 issued_to = base::UTF8ToUTF16(
       x509_certificate_model::GetCertNameOrNickname(cert->os_cert_handle()));
@@ skipping 88 matching lines @@
 
 bool CertLibrary::CertificatesLoading() const {
   return CertLoader::Get()->CertificatesLoading();
 }
 
 bool CertLibrary::CertificatesLoaded() const {
   return CertLoader::Get()->certificates_loaded();
 }
 
 bool CertLibrary::IsHardwareBacked() const {
-  return CertLoader::Get()->IsHardwareBacked();
+  return CertLoader::Get()->is_hardware_backed();
 }
 
 int CertLibrary::NumCertificates(CertType type) const {
   const net::CertificateList& cert_list = GetCertificateListForType(type);
   return static_cast<int>(cert_list.size());
 }
 
 base::string16 CertLibrary::GetCertDisplayStringAt(CertType type,
                                                    int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
   bool hardware_backed = IsCertHardwareBackedAt(type, index);
   return GetDisplayString(cert, hardware_backed);
 }
 
 std::string CertLibrary::GetCertPEMAt(CertType type, int index) const {
   return CertToPEM(*GetCertificateAt(type, index));
 }
 
 std::string CertLibrary::GetCertPkcs11IdAt(CertType type, int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
   return x509_certificate_model::GetPkcs11Id(cert->os_cert_handle());
 }
 
 bool CertLibrary::IsCertHardwareBackedAt(CertType type, int index) const {
-  if (!CertLoader::Get()->IsHardwareBacked())
+  if (!CertLoader::Get()->is_hardware_backed())
     return false;
   net::X509Certificate* cert = GetCertificateAt(type, index);
-  std::string cert_token_name =
-      x509_certificate_model::GetTokenName(cert->os_cert_handle());
-  return cert_token_name ==
-      CertLoader::Get()->tpm_token_name();
+  return CertLoader::Get()->IsCertificateInPrivateSlot(*cert);

[mattm, 2014/01/23 01:45:55]

You could replace both is_hardware_backed and IsCertificateInPrivateSlot here
with the NSSCertDatabase::IsHardwareBacked function, unless you need explicitly
to tell that it is in that particular slot. (Which may actually be wrong with
the TPM system slot being added.)

[tbarzic, 2014/01/23 04:45:28]

Done.

 }
 
 int CertLibrary::GetCertIndexByPEM(CertType type,
                                    const std::string& pem_encoded) const {
   int num_certs = NumCertificates(type);
   for (int index = 0; index < num_certs; ++index) {
     net::X509Certificate* cert = GetCertificateAt(type, index);
     if (CertToPEM(*cert) != pem_encoded)
       continue;
     return index;
@@ skipping 86 matching lines @@
     return user_certs_;
   if (type == CERT_TYPE_SERVER)
     return server_certs_;
   if (type == CERT_TYPE_SERVER_CA)
     return server_ca_certs_;
   DCHECK(type == CERT_TYPE_DEFAULT);
   return certs_;
 }
 
 }  // namespace chromeos