Generate unique certificate nicknames on Linux/CrOS.

net/cert/cert_database_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_database.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
 #include "base/logging.h"
 #include "base/observer_list_threadsafe.h"
 #include "crypto/nss_util.h"
+#include "crypto/scoped_nss_types.h"
 #include "net/base/net_errors.h"
 #include "net/cert/nss_cert_database.h"
 #include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util_nss.h"
 
 namespace net {
 
 // Helper that observes events from the NSSCertDatabase and forwards them to
 // the given CertDatabase.
 class CertDatabase::Notifier : public NSSCertDatabase::Observer {
  public:
   explicit Notifier(CertDatabase* cert_db) : cert_db_(cert_db) {
     NSSCertDatabase::GetInstance()->AddObserver(this);
   }
@@ skipping 48 matching lines @@
   if (!slot)
     return ERR_NO_PRIVATE_KEY_FOR_CERT;
 
   PK11_FreeSlot(slot);
 
   return OK;
 }
 
 int CertDatabase::AddUserCert(X509Certificate* cert_obj) {
   CERTCertificate* cert = cert_obj->os_cert_handle();
-  PK11SlotInfo* slot = NULL;
+  CK_OBJECT_HANDLE key;
+  crypto::ScopedPK11Slot slot(PK11_KeyForCertExists(cert, &key, NULL));
+  if (!slot.get())
+    return ERR_NO_PRIVATE_KEY_FOR_CERT;
 
+  std::string nickname = x509_util::GetUniqueNicknameForSlot(
+      cert_obj->GetDefaultNickname(USER_CERT),
+      &cert->derSubject,
+      slot.get());
+
+  SECStatus rv;
   {
     crypto::AutoNSSWriteLock lock;
-    slot = PK11_ImportCertForKey(
-        cert,
-        cert_obj->GetDefaultNickname(net::USER_CERT).c_str(),
-        NULL);
+    rv = PK11_ImportCert(slot.get(), cert, key, nickname.c_str(), PR_FALSE);
   }
 
-  if (!slot) {
-    LOG(ERROR) << "Couldn't import user certificate.";
+  if (rv != SECSuccess) {
+    LOG(ERROR) << "Couldn't import user certificate. " << PORT_GetError();

[wtc, 2013/05/22 20:58:45]

Should we also log an error message on line 90?

[Ryan Sleevi, 2013/05/22 23:20:19]

I'm actually not a big fan of the current error message. It's superflous in the
current implementation because it provides no additional context than the
ERR_ADD_USER_CERT_FAILED (which we end up surfacing to the user). I added the
Error code logging just to make it somewhat useful, since PK11_ImportCert has
much more logic/points of failure for it.

     return ERR_ADD_USER_CERT_FAILED;
   }
-  PK11_FreeSlot(slot);
+
   NotifyObserversOfCertAdded(cert_obj);
   return OK;
 }
 
 }  // namespace net