*WIP* Store NSS slots per profile. Move keygen to chrome.

net/cert/nss_cert_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 24 matching lines @@
 
 namespace net {
 
 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
     const scoped_refptr<X509Certificate>& cert,
     int err)
     : certificate(cert), net_error(err) {}
 
 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
 
+// On ChromeOS we want to return the default instance of
+// NSSCertDatabaseChromeOS, not NSSCertDatabase.
+#if !defined(OS_CHROMEOS)
 // static
 NSSCertDatabase* NSSCertDatabase::GetInstance() {
   return Singleton<NSSCertDatabase,
                    LeakySingletonTraits<NSSCertDatabase> >::get();
 }
+#endif
 
 NSSCertDatabase::NSSCertDatabase()
     : observer_list_(new ObserverListThreadSafe<Observer>) {
-  crypto::EnsureNSSInit();
+  // This also makes sure that NSS has been initialized.
+  CertDatabase::GetInstance()->AddSource(this);
+
   psm::EnsurePKCS12Init();
 }
 
 NSSCertDatabase::~NSSCertDatabase() {}
 
 void NSSCertDatabase::ListCerts(CertificateList* certs) {
   certs->clear();
 
   CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
   CERTCertListNode* node;
   for (node = CERT_LIST_HEAD(cert_list);
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node)) {
     certs->push_back(X509Certificate::CreateFromHandle(
         node->cert, X509Certificate::OSCertHandles()));
   }
   CERT_DestroyCertList(cert_list);
 }
 
 CryptoModule* NSSCertDatabase::GetPublicModule() const {
-  CryptoModule* module =
-      CryptoModule::CreateFromHandle(crypto::GetPublicNSSKeySlot());
-  // The module is already referenced when returned from
-  // GetPublicNSSKeySlot, so we need to deref it once.
-  PK11_FreeSlot(module->os_module_handle());
+  crypto::ScopedPK11Slot slot(GetPublicSlot());
+  CryptoModule* module = CryptoModule::CreateFromHandle(slot.get());
 
   return module;
 }
 
 CryptoModule* NSSCertDatabase::GetPrivateModule() const {
-  CryptoModule* module =
-      CryptoModule::CreateFromHandle(crypto::GetPrivateNSSKeySlot());
-  // The module is already referenced when returned from
-  // GetPrivateNSSKeySlot, so we need to deref it once.
-  PK11_FreeSlot(module->os_module_handle());
+  crypto::ScopedPK11Slot slot(GetPrivateSlot());
+  CryptoModule* module = CryptoModule::CreateFromHandle(slot.get());
 
   return module;
 }
 
+crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
+  return crypto::ScopedPK11Slot(crypto::GetPublicNSSKeySlot());
+}
+
+crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
+  return crypto::ScopedPK11Slot(crypto::GetPrivateNSSKeySlot());
+}
+
 void NSSCertDatabase::ListModules(CryptoModuleList* modules,
                                   bool need_rw) const {
   modules->clear();
 
   // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
   crypto::ScopedPK11SlotList slot_list(
       PK11_GetAllTokens(CKM_INVALID_MECHANISM,
                         need_rw ? PR_TRUE : PR_FALSE,  // needRW
                         PR_TRUE,                       // loadCerts (unused)
                         NULL));                        // wincx
   if (!slot_list) {
     LOG(ERROR) << "PK11_GetAllTokens failed: " << PORT_GetError();
     return;
   }
 
   PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list.get());
   while (slot_element) {
     modules->push_back(CryptoModule::CreateFromHandle(slot_element->slot));
     slot_element = PK11_GetNextSafe(slot_list.get(), slot_element,
                                     PR_FALSE);  // restart
   }
 }
 
 int NSSCertDatabase::ImportFromPKCS12(
     CryptoModule* module,
     const std::string& data,
     const base::string16& password,
     bool is_extractable,
     net::CertificateList* imported_certs) {
+  VLOG(1) << __func__ << " "
+          << PK11_GetModuleID(module->os_module_handle()) << ":"
+          << PK11_GetSlotID(module->os_module_handle());
   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
                                         data.data(), data.size(),
                                         password,
                                         is_extractable,
                                         imported_certs);
   if (result == net::OK)
     NotifyObserversOfCertAdded(NULL);
 
   return result;
 }
@@ skipping 25 matching lines @@
     return certn_1;
 
   VLOG(1) << "certificate list is not a hierarchy";
   return cert0;
 }
 
 bool NSSCertDatabase::ImportCACerts(const CertificateList& certificates,
                                     TrustBits trust_bits,
                                     ImportCertFailureList* not_imported) {
   X509Certificate* root = FindRootInList(certificates);
-  bool success = psm::ImportCACerts(certificates, root, trust_bits,
-                                    not_imported);
+  bool success = psm::ImportCACerts(
+      GetPublicSlot(),
+      certificates,
+      root,
+      trust_bits,
+      not_imported);
   if (success)
     NotifyObserversOfCertTrustChanged(NULL);
 
   return success;
 }
 
 bool NSSCertDatabase::ImportServerCert(const CertificateList& certificates,
                                        TrustBits trust_bits,
                                        ImportCertFailureList* not_imported) {
-  return psm::ImportServerCert(certificates, trust_bits, not_imported);
+  return psm::ImportServerCert(
+      GetPublicSlot(),
+      certificates,
+      trust_bits,
+      not_imported);
 }
 
 NSSCertDatabase::TrustBits NSSCertDatabase::GetCertTrust(
     const X509Certificate* cert,
     CertType type) const {
   CERTCertTrust trust;
   SECStatus srv = CERT_GetCertTrust(cert->os_cert_handle(), &trust);
   if (srv != SECSuccess) {
     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
     return TRUST_DEFAULT;
@@ skipping 146 matching lines @@
   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 }
 
 void NSSCertDatabase::NotifyObserversOfCertTrustChanged(
     const X509Certificate* cert) {
   observer_list_->Notify(
       &Observer::OnCertTrustChanged, make_scoped_refptr(cert));
 }
 
 }  // namespace net