Use user specific NSSDatabase in CertLoader.

chromeos/network/client_cert_resolver.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/client_cert_resolver.h"
 
 #include <cert.h>
 #include <certt.h>  // for (SECCertUsageEnum) certUsageAnyCA
 #include <pk11pub.h>
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/task_runner.h"
 #include "base/threading/worker_pool.h"
 #include "base/time/time.h"
 #include "chromeos/cert_loader.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/shill_service_client.h"
 #include "chromeos/network/certificate_pattern.h"
 #include "chromeos/network/client_cert_util.h"
 #include "chromeos/network/favorite_state.h"
 #include "chromeos/network/managed_network_configuration_handler.h"
 #include "chromeos/network/network_state_handler.h"
 #include "chromeos/network/network_ui_data.h"
+#include "chromeos/tpm_token_loader.h"
 #include "components/onc/onc_constants.h"
 #include "dbus/object_path.h"
 #include "net/cert/x509_certificate.h"
 
 namespace chromeos {
 
 // Describes a network |network_path| for which a matching certificate |cert_id|
 // was found.
 struct ClientCertResolver::NetworkAndMatchingCert {
   NetworkAndMatchingCert(const std::string& network_path,
@@ skipping 207 matching lines @@
       network_handler::ErrorCallback(),
       dbus_error_name,
       dbus_error_message);
 }
 
 bool ClientCertificatesLoaded() {
   if (!CertLoader::Get()->certificates_loaded()) {
     VLOG(1) << "Certificates not loaded yet.";
     return false;
   }
-  if (!CertLoader::Get()->IsHardwareBacked()) {
+  if (!CertLoader::Get()->is_hardware_backed()) {
     VLOG(1) << "TPM is not available.";
     return false;
   }
   return true;
 }
 
 }  // namespace
 
 ClientCertResolver::ClientCertResolver()
     : network_state_handler_(NULL),
@@ skipping 158 matching lines @@
       base::Bind(&ClientCertResolver::ConfigureCertificates,
                  weak_ptr_factory_.GetWeakPtr(),
                  base::Owned(matches)));
 }
 
 void ClientCertResolver::ConfigureCertificates(NetworkCertMatches* matches) {
   for (NetworkCertMatches::const_iterator it = matches->begin();
        it != matches->end(); ++it) {
     VLOG(1) << "Configuring certificate of network " << it->service_path;
     CertLoader* cert_loader = CertLoader::Get();
+    std::string tpm_user_pin;
+    if (TPMTokenLoader::IsInitialized())

[stevenjb, 2014/01/23 18:17:42]

This should always be true, shouldn't it?
CertLoader::Get()->is_hardware_backed() would be false otherwise, right? So
ClientCertificatesLoaded() should always be false and we shouldn't get here?

[tbarzic, 2014/01/23 19:18:37]

It could have happened in tests (but started using dummy version)

+      tpm_user_pin = TPMTokenLoader::Get()->tpm_user_pin();
+
     base::DictionaryValue shill_properties;
     client_cert::SetShillProperties(
         it->cert_config_type,
         base::IntToString(cert_loader->tpm_token_slot_id()),
-        cert_loader->tpm_user_pin(),
+        tpm_user_pin,
         &it->pkcs11_id,
         &shill_properties);
     DBusThreadManager::Get()->GetShillServiceClient()->
         SetProperties(dbus::ObjectPath(it->service_path),
                         shill_properties,
                         base::Bind(&base::DoNothing),
                         base::Bind(&LogError, it->service_path));
     network_state_handler_->RequestUpdateForNetwork(it->service_path);
   }
 }
 
 }  // namespace chromeos