dart:io | Fix SecureSocket client certificate problem with database password.

runtime/bin/secure_socket.cc

Index: runtime/bin/secure_socket.cc
diff --git a/runtime/bin/secure_socket.cc b/runtime/bin/secure_socket.cc
index f4871cfe4a22dd1e0b449e6c648724f5422dc324..d308b3bf83ef781f24c03fb6758877a645c25edd 100644
--- a/runtime/bin/secure_socket.cc
+++ b/runtime/bin/secure_socket.cc
@@ -525,6 +525,15 @@ void SSLFilter::RegisterBadCertificateCallback(Dart_Handle callback) {
   ASSERT(bad_certificate_callback_ != NULL);
 }
 
+
+char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
+  if (!retry) {
+    return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.

[Anders Johnsen, 2013/07/11 08:17:43]

Why PL_strdup here but strdup below?

+  }
+  return NULL;
+}
+
+
 static const char* builtin_roots_module =
 #if defined(TARGET_OS_LINUX) || defined(TARGET_OS_ANDROID)
     "name=\"Root Certs\" library=\"libnssckbi.so\"";
@@ -545,7 +554,6 @@ void SSLFilter::InitializeLibrary(const char* certificate_database,
   MutexLocker locker(mutex_);
   SECStatus status;
   if (!library_initialized_) {
-    password_ = strdup(password);  // This one copy persists until Dart exits.
     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
     // TODO(whesse): Verify there are no UTF-8 issues here.
     if (certificate_database == NULL || certificate_database[0] == '\0') {
@@ -579,6 +587,8 @@ void SSLFilter::InitializeLibrary(const char* certificate_database,
         ThrowPRException("TlsException",
                          "Failed NSS_Init call.");
       }
+      password_ = strdup(password);  // This one copy persists until Dart exits.

[Anders Johnsen, 2013/07/11 08:17:43]

Dart exits or leaving the current Dart Scope?

[Bill Hesse, 2013/07/11 09:24:46]

Until Dart exits (the process terminates).  This initialization occurs once per
process.

We use strdup because this is our copy, that is never freed.  PR_strdup
allocates within the heap managed by NSS.

 We use PR_strdup in the password callback because there is a corresponding
PR_free inside the code that calls this callback.

+      PK11_SetPasswordFunc(PasswordCallback);
     }
     library_initialized_ = true;
 
@@ -612,14 +622,6 @@ void SSLFilter::InitializeLibrary(const char* certificate_database,
 }
 
 
-char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
-  if (!retry) {
-    return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.
-  }
-  return NULL;
-}
-
-
 SECStatus BadCertificateCallback(void* filter, PRFileDesc* fd) {
   SSLFilter* ssl_filter = static_cast<SSLFilter*>(filter);
   Dart_Handle callback = ssl_filter->bad_certificate_callback();
@@ -673,8 +675,6 @@ void SSLFilter::Connect(const char* host_name,
 
   SECStatus status;
   if (is_server) {
-    PK11_SetPasswordFunc(PasswordCallback);
-
     CERTCertificate* certificate = NULL;
     if (strstr(certificate_name, "CN=") != NULL) {
       // Look up certificate using the distinguished name (DN) certificate_name.
@@ -755,6 +755,7 @@ void SSLFilter::Connect(const char* host_name,
     }
 
     if (send_client_certificate) {
+      SSL_SetPKCS11PinArg(filter_, const_cast<char*>(password_));

[Anders Johnsen, 2013/07/11 08:17:43]

delete password_ in destructor?

[Bill Hesse, 2013/07/11 09:24:46]

No, password_ is a static.

       status = SSL_GetClientAuthDataHook(
           filter_,
           NSS_GetClientAuthData,