*WIP* Store NSS slots per profile. Move keygen to chrome.

net/cert/nss_cert_database.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_NSS_CERT_DATABASE_H_
 #define NET_CERT_NSS_CERT_DATABASE_H_
 
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/strings/string16.h"
+#include "crypto/scoped_nss_types.h"
 #include "net/base/net_export.h"
 #include "net/cert/cert_type.h"
 #include "net/cert/x509_certificate.h"
 
 template <typename T> struct DefaultSingletonTraits;
 template <class ObserverType> class ObserverListThreadSafe;
 
 namespace net {
 
 class CryptoModule;
 typedef std::vector<scoped_refptr<CryptoModule> > CryptoModuleList;
 
+//XXX what to do with this?
+//make callers do filtering themselves?
+// - but this also does importing and stuff, with only the primary slot.
+// - should there be a separate NSSCertDatabase per profile? How does that work
+//   since this lives in net/  ?
+//
 // Provides functions to manipulate the NSS certificate stores.
 class NET_EXPORT NSSCertDatabase {
  public:
-
-  class NET_EXPORT Observer {
-   public:
-    virtual ~Observer() {}
-
-    // Will be called when a new certificate is added.
-    // Called with |cert| == NULL after importing a list of certificates
-    // in ImportFromPKCS12().
-    virtual void OnCertAdded(const X509Certificate* cert) {}
-
-    // Will be called when a certificate is removed.
-    virtual void OnCertRemoved(const X509Certificate* cert) {}
-
-    // Will be called when a certificate's trust is changed.
-    // Called with |cert| == NULL after importing a list of certificates
-    // in ImportCACerts().
-    virtual void OnCertTrustChanged(const X509Certificate* cert) {}
-
-   protected:
-    Observer() {}
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(Observer);
-  };
-
   // Stores per-certificate error codes for import failures.
   struct NET_EXPORT ImportCertFailure {
    public:
     ImportCertFailure(const scoped_refptr<X509Certificate>& cert, int err);
     ~ImportCertFailure();
 
     scoped_refptr<X509Certificate> certificate;
     int net_error;
   };
   typedef std::vector<ImportCertFailure> ImportCertFailureList;
@@ skipping 21 matching lines @@
     TRUSTED_OBJ_SIGN      = 1 << 2,
     DISTRUSTED_SSL        = 1 << 3,
     DISTRUSTED_EMAIL      = 1 << 4,
     DISTRUSTED_OBJ_SIGN   = 1 << 5,
   };
 
   static NSSCertDatabase* GetInstance();
 
   // Get a list of unique certificates in the certificate database (one
   // instance of all certificates).
-  void ListCerts(CertificateList* certs);
+  virtual void ListCerts(CertificateList* certs);
 
   // Get the default module for public key data.
   // The returned pointer must be stored in a scoped_refptr<CryptoModule>.
   CryptoModule* GetPublicModule() const;
 
   // Get the default module for private key or mixed private/public key data.
   // The returned pointer must be stored in a scoped_refptr<CryptoModule>.
   CryptoModule* GetPrivateModule() const;
 
   // Get all modules.
   // If |need_rw| is true, only writable modules will be returned.
-  void ListModules(CryptoModuleList* modules, bool need_rw) const;
+  virtual void ListModules(CryptoModuleList* modules, bool need_rw) const;
 
   // Import certificates and private keys from PKCS #12 blob into the module.
   // If |is_extractable| is false, mark the private key as being unextractable
   // from the module.
   // Returns OK or a network error code such as ERR_PKCS12_IMPORT_BAD_PASSWORD
   // or ERR_PKCS12_IMPORT_ERROR. |imported_certs|, if non-NULL, returns a list
   // of certs that were imported.
   int ImportFromPKCS12(CryptoModule* module,
                        const std::string& data,
                        const base::string16& password,
@@ skipping 53 matching lines @@
                     TrustBits trust_bits);
 
   // Delete certificate and associated private key (if one exists).
   // |cert| is still valid when this function returns. Returns true on
   // success.
   bool DeleteCertAndKey(const X509Certificate* cert);
 
   // Check whether cert is stored in a readonly slot.
   bool IsReadOnly(const X509Certificate* cert) const;
 
-  // Registers |observer| to receive notifications of certificate changes.  The
-  // thread on which this is called is the thread on which |observer| will be
-  // called back with notifications.
-  void AddObserver(Observer* observer);
+ protected:
+  NSSCertDatabase();
+  virtual ~NSSCertDatabase();
 
-  // Unregisters |observer| from receiving notifications.  This must be called
-  // on the same thread on which AddObserver() was called.
-  void RemoveObserver(Observer* observer);
+  // Get private and public slots.
+  virtual crypto::ScopedPK11Slot GetPublicSlot() const;
+  virtual crypto::ScopedPK11Slot GetPrivateSlot() const;
 
  private:
   friend struct DefaultSingletonTraits<NSSCertDatabase>;
 
-  NSSCertDatabase();
-  ~NSSCertDatabase();
-
   // Broadcasts notifications to all registered observers.
   void NotifyObserversOfCertAdded(const X509Certificate* cert);
   void NotifyObserversOfCertRemoved(const X509Certificate* cert);
   void NotifyObserversOfCertTrustChanged(const X509Certificate* cert);
 
-  const scoped_refptr<ObserverListThreadSafe<Observer> > observer_list_;
-
   DISALLOW_COPY_AND_ASSIGN(NSSCertDatabase);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_NSS_CERT_DATABASE_H_