Add NetworkConnectionHandler class

chromeos/network/cert_loader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/cert_loader.h"
 
 #include <algorithm>
 
 #include "base/chromeos/chromeos_version.h"
 #include "base/observer_list.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/task_runner_util.h"
 #include "base/threading/worker_pool.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "crypto/encryptor.h"
 #include "crypto/nss_util.h"
 #include "crypto/sha2.h"
 #include "crypto/symmetric_key.h"
 #include "net/cert/nss_cert_database.h"
 
@@ skipping 91 matching lines @@
   certificates_requested_ = true;
 
   VLOG(1) << "Requesting Certificates.";
   DBusThreadManager::Get()->GetCryptohomeClient()->TpmIsEnabled(
       base::Bind(&CertLoader::OnTpmIsEnabled,
                  weak_ptr_factory_.GetWeakPtr()));
 
   return;
 }
 
+// For background see this discussion on dev-tech-crypto.lists.mozilla.org:
+// http://web.archiveorange.com/archive/v/6JJW7E40sypfZGtbkzxX
+//
+// NOTE: This function relies on the convention that the same PKCS#11 ID
+// is shared between a certificate and its associated private and public
+// keys.  I tried to implement this with PK11_GetLowLevelKeyIDForCert(),
+// but that always returns NULL on Chrome OS for me.
+std::string CertLoader::GetPkcs11IdForCert(
+    const net::X509Certificate& cert) const {
+  if (!IsHardwareBacked())
+    return std::string();
+
+  CERTCertificateStr* cert_handle = cert.os_cert_handle();
+  SECKEYPrivateKey *priv_key =
+      PK11_FindKeyByAnyCert(cert_handle, NULL /* wincx */);
+  if (!priv_key)
+    return std::string();
+
+  // Get the CKA_ID attribute for a key.
+  SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(priv_key);
+  std::string pkcs11_id;
+  if (sec_item) {
+    pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
+    SECITEM_FreeItem(sec_item, PR_TRUE);
+  }
+  SECKEY_DestroyPrivateKey(priv_key);
+
+  return pkcs11_id;
+}
+
 void CertLoader::OnTpmIsEnabled(DBusMethodCallStatus call_status,
                                 bool tpm_is_enabled) {
   VLOG(1) << "OnTpmIsEnabled: " << tpm_is_enabled;
   if (call_status != DBUS_METHOD_CALL_SUCCESS || !tpm_is_enabled) {
     // TPM is not enabled, so proceed with empty tpm token name.
     VLOG(1) << "TPM not available.";
     StartLoadCertificates();
   } else if (tpm_token_ready_) {
     // Once the TPM token is ready, initialize it.
     InitializeTPMToken();
@@ skipping 119 matching lines @@
   StartLoadCertificates();
 }
 
 void CertLoader::LoggedInStateChanged(LoginState::LoggedInState state) {
   VLOG(1) << "LoggedInStateChanged: " << state;
   if (LoginState::Get()->IsUserLoggedIn() && !certificates_requested_)
     RequestCertificates();
 }
 
 }  // namespace chromeos