*WIP* Store NSS slots per profile. Move keygen to chrome.

chrome/browser/certificate_manager_model.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/certificate_manager_model.h"
 
 #include "base/bind.h"
 #include "base/i18n/time_formatting.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ui/crypto_module_password_dialog.h"
 #include "chrome/common/net/x509_certificate_model.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/nss_context.h"
+#include "content/public/browser/resource_context.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
 
 #if defined(OS_CHROMEOS)
 #include <cert.h>
 
 #include "crypto/nss_util.h"
 #include "grit/generated_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 #endif
 
-CertificateManagerModel::CertificateManagerModel(Observer* observer)
-    : cert_db_(net::NSSCertDatabase::GetInstance()),
-      observer_(observer) {
+using content::BrowserThread;
+
+namespace {
+
+void GotCertDBOnIOThread(
+    const base::Callback<void(net::NSSCertDatabase*)>& callback,
+    net::NSSCertDatabase* cert_db) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+
+  BrowserThread::PostTask(
+      BrowserThread::UI, FROM_HERE, base::Bind(callback, cert_db));
+}
+
+}  // namespace
+
+CertificateManagerModel::CertificateManagerModel(
+    content::BrowserContext* browser_context,
+    Observer* observer)
+    : observer_(observer),
+      weak_ptr_factory_(this) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  VLOG(1) << "Getting cert_db for profile...";
+  BrowserThread::PostTask(
+      BrowserThread::IO,
+      FROM_HERE,
+      base::Bind(&content::GetNSSCertDatabaseForResourceContext,
+                 browser_context->GetResourceContext(),
+                 base::Bind(GotCertDBOnIOThread,
+                            base::Bind(&CertificateManagerModel::GotCertDB,
+                                       weak_ptr_factory_.GetWeakPtr()))));
 }
 
 CertificateManagerModel::~CertificateManagerModel() {
 }
 
 void CertificateManagerModel::Refresh() {
+  // XXX should the rest of the NSS stuff also be on IO thread? or a worker
+  // thread?
   VLOG(1) << "refresh started";
   net::CryptoModuleList modules;
   cert_db_->ListModules(&modules, false);
   VLOG(1) << "refresh waiting for unlocking...";
   chrome::UnlockSlotsIfNecessary(
       modules,
       chrome::kCryptoModulePasswordListCerts,
       std::string(),  // unused.
       base::Bind(&CertificateManagerModel::RefreshSlotsUnlocked,
                  base::Unretained(this)));
 }
 
+void CertificateManagerModel::GotCertDB(net::NSSCertDatabase* cert_db) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  DCHECK(cert_db);
+  VLOG(1) << "Got cert_db";
+  cert_db_ = cert_db;
+  observer_->CertificateManagerModelReady();
+}
+
 void CertificateManagerModel::RefreshSlotsUnlocked() {
   VLOG(1) << "refresh listing certs...";
   cert_db_->ListCerts(&cert_list_);
   observer_->CertificatesRefreshed();
   VLOG(1) << "refresh finished";
 }
 
 void CertificateManagerModel::FilterAndBuildOrgGroupingMap(
     net::CertType filter_type,
     CertificateManagerModel::OrgGroupingMap* map) const {
@@ skipping 94 matching lines @@
 bool CertificateManagerModel::Delete(net::X509Certificate* cert) {
   bool result = cert_db_->DeleteCertAndKey(cert);
   if (result)
     Refresh();
   return result;
 }
 
 bool CertificateManagerModel::IsHardwareBacked(
     const net::X509Certificate* cert) const {
 #if defined(OS_CHROMEOS)
-  return crypto::IsTPMTokenReady() &&
-         cert->os_cert_handle()->slot ==
-             cert_db_->GetPrivateModule()->os_module_handle();
+  // XXX should we actually do the opposite check and make sure the cert doesn't
+  // exist in any non-tpm slots?
+  return crypto::IsTPMTokenEnabledForNSS() &&
+         PK11_FindCertInSlot(cert_db_->GetPrivateModule()->os_module_handle(),
+                             cert->os_cert_handle(),
+                             NULL) != CK_INVALID_HANDLE;
 #else
   return false;
 #endif
 }