Resolve certificate references in ONC by PEM.

chrome/browser/chromeos/cros/cert_library.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/cert_library.h"
 
 #include <algorithm>
 
 #include "base/chromeos/chromeos_version.h"
 #include "base/command_line.h"
 #include "base/i18n/string_compare.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list_threadsafe.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/browser_process.h"  // g_browser_process
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/net/x509_certificate_model.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/login/login_state.h"
+#include "chromeos/network/onc/onc_utils.h"
 #include "content/public/browser/browser_thread.h"
 #include "crypto/nss_util.h"
 #include "grit/generated_resources.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/nss_cert_database.h"
 #include "third_party/icu/public/i18n/unicode/coll.h"  // icu::Collator
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/l10n/l10n_util_collator.h"
 
 namespace chromeos {
@@ skipping 109 matching lines @@
   const net::CertificateList& cert_list = GetCertificateListForType(type);
   return static_cast<int>(cert_list.size());
 }
 
 string16 CertLibrary::GetCertDisplayStringAt(CertType type, int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
   bool hardware_backed = IsCertHardwareBackedAt(type, index);
   return GetDisplayString(cert, hardware_backed);
 }
 
-std::string CertLibrary::GetCertNicknameAt(CertType type, int index) const {
+std::string CertLibrary::GetCertFingerprintAt(CertType type, int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
-  return x509_certificate_model::GetNickname(cert->os_cert_handle());
+  return onc::GetHexFingerprintOfCert(*cert);
 }
 
 std::string CertLibrary::GetCertPkcs11IdAt(CertType type, int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
   return x509_certificate_model::GetPkcs11Id(cert->os_cert_handle());
 }
 
 bool CertLibrary::IsCertHardwareBackedAt(CertType type, int index) const {
   if (!NetworkHandler::Get()->cert_loader()->IsHardwareBacked())
     return false;
   net::X509Certificate* cert = GetCertificateAt(type, index);
   std::string cert_token_name =
       x509_certificate_model::GetTokenName(cert->os_cert_handle());
   return cert_token_name ==
       NetworkHandler::Get()->cert_loader()->tpm_token_name();
 }
 
-int CertLibrary::GetCertIndexByNickname(CertType type,
-                                        const std::string& nickname) const {
+int CertLibrary::GetCertIndexByFingerprint(
+    CertType type, const std::string& fingerprint) const {

[Mattias Nissler (ping if slow), 2013/06/14 12:56:44]

nit: one parameter per line

[pneubeck (no reviews), 2013/06/21 12:53:56]

Done.

   int num_certs = NumCertificates(type);
+  int found_index = -1;
   for (int index = 0; index < num_certs; ++index) {
     net::X509Certificate* cert = GetCertificateAt(type, index);
-    net::X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle();
-    std::string nick = x509_certificate_model::GetNickname(cert_handle);
-    if (nick == nickname)
-      return index;
+    if (onc::GetHexFingerprintOfCert(*cert) != fingerprint)
+      continue;
+    if (found_index != -1) {
+      LOG(ERROR) << "Certificate fingerprints collided.";

[Mattias Nissler (ping if slow), 2013/06/14 12:56:44]

I guess it's more likely that the cert is present twice in the list in this case
:)

[pneubeck (no reviews), 2013/06/21 12:53:56]

Done.

+      return -1;
+    }
+    found_index = index;
   }
-  return -1;  // Not found.
+  return found_index;
 }
 
 int CertLibrary::GetCertIndexByPkcs11Id(CertType type,
                                         const std::string& pkcs11_id) const {
   int num_certs = NumCertificates(type);
   for (int index = 0; index < num_certs; ++index) {
     net::X509Certificate* cert = GetCertificateAt(type, index);
     net::X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle();
     std::string id = x509_certificate_model::GetPkcs11Id(cert_handle);
     if (id == pkcs11_id)
@@ skipping 73 matching lines @@
   if (type == CERT_TYPE_USER)
     return user_certs_;
   if (type == CERT_TYPE_SERVER)
     return server_certs_;
   if (type == CERT_TYPE_SERVER_CA)
     return server_ca_certs_;
   DCHECK(type == CERT_TYPE_DEFAULT);
   return certs_;
 }
 
-}  // chromeos
+}  // namespace chromeos