Adding User Certificate (.crt) Import to Certificate Manager

net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp

Index: net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
diff --git a/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp b/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
index bfbeae6a2997c0cc1d098f2d5e9503d5cc11d40b..947fb53dcf3eddcd03ea3698b237b6303e02bcd1 100644
--- a/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
+++ b/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
@@ -206,6 +206,37 @@ bool ImportServerCert(
   return true;
 }
 
+// Based on nsNSSCertificateDB::ImportUserCertificate.
+int ImportUserCert(const net::CertificateList& certificates) {

[mattm, 2015/11/06 23:13:00]

Change the NSS version of CertDatabase::AddUserCert to call this also.

[svaldez, 2015/11/10 15:07:50]

Done.

+  if (certificates.empty())
+    return net::ERR_CERT_INVALID;
+
+  const scoped_refptr<net::X509Certificate>& cert = certificates[0];

[mattm, 2015/11/06 23:13:00]

If this only uses the first cert, just pass that in instead of a list.

[svaldez, 2015/11/10 15:07:50]

We may want to eventually verify the user cert cert chain, and it seems cleaner
to have this method choose the specific cert, instead of having to make all the
callers select the first cert to pass in.

+  CK_OBJECT_HANDLE key;
+  PK11SlotInfo* slot =

[mattm, 2015/11/06 23:13:00]

crypto::ScopedPK11Slot

[svaldez, 2015/11/10 15:07:50]

Done.

+      PK11_KeyForCertExists(cert->os_cert_handle(), &key, NULL);
+
+  if (!slot)
+    return net::ERR_NO_PRIVATE_KEY_FOR_CERT;
+
+  // Mozilla uses CERT_ImportCerts, which doesn't take a slot arg.  We use
+  // PK11_ImportCert instead.
+  SECStatus srv =
+      PK11_ImportCert(slot, cert->os_cert_handle(), key,
+                      net::x509_util::GetUniqueNicknameForSlot(
+                          cert->GetDefaultNickname(net::SERVER_CERT),

[mattm, 2015/11/06 23:13:00]

USER_CERT?

[svaldez, 2015/11/10 15:07:50]

Done.

+                          &cert->os_cert_handle()->derSubject, slot)
+                          .c_str(),
+                      PR_FALSE /* includeTrust (unused) */);
+
+  if (srv != SECSuccess) {
+    LOG(ERROR) << "PK11_ImportCert failed with error " << PORT_GetError();
+    return net::ERR_ADD_USER_CERT_FAILED;
+  }
+
+  return net::OK;
+}
+
 // Based on nsNSSCertificateDB::SetCertTrust.
 bool
 SetCertTrust(const net::X509Certificate* cert,