Extension API enterprise.platformKeys.

net/cert/nss_cert_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 114 matching lines @@
   }
 
   PK11SlotListElement* slot_element = PK11_GetFirstSafe(slot_list.get());
   while (slot_element) {
     modules->push_back(CryptoModule::CreateFromHandle(slot_element->slot));
     slot_element = PK11_GetNextSafe(slot_list.get(), slot_element,
                                     PR_FALSE);  // restart
   }
 }
 
+bool NSSCertDatabase::ImportPKCS8KeyAndCertificate(
+    const std::string& pkcs8_data,
+    X509Certificate* cert,
+    CryptoModule* module) {
+  DVLOG(1) << __func__ << " " << PK11_GetModuleID(module->os_module_handle())
+           << ":" << PK11_GetSlotID(module->os_module_handle());
+
+  crypto::ScopedSECKEYPrivateKey private_key;
+  CertDatabase* db = CertDatabase::GetInstance();
+  int cert_status = db->CheckUserCert(cert);
+  if (cert_status == ERR_NO_PRIVATE_KEY_FOR_CERT) {
+    LOG(ERROR) << "Importing private key.";
+    SECItem pki_der = {
+        siBuffer,
+        // NSS requires non-const data even though it is just for input.
+        const_cast<unsigned char*>((const unsigned char*)pkcs8_data.data()),
+        pkcs8_data.size()};
+
+    SECKEYPrivateKey* seckey_private_key = NULL;
+    if (PK11_ImportDERPrivateKeyInfoAndReturnKey(module->os_module_handle(),
+                                                 &pki_der,
+                                                 NULL,    // nickname
+                                                 NULL,    // publicValue
+                                                 true,   // isPerm
+                                                 true,   // isPrivate
+                                                 KU_ALL,  // usage
+                                                 &seckey_private_key,
+                                                 NULL) != SECSuccess) {
+      LOG(ERROR) << "Could not import private key " << PORT_GetError();
+      return false;
+    }
+    DCHECK(seckey_private_key);
+    private_key.reset(seckey_private_key);
+
+    cert_status = db->CheckUserCert(cert);
+  }
+  if (cert_status != net::OK) {
+    LOG(ERROR) << "Cert invalid, cannot import: " << cert_status;
+    return false;
+  }
+
+  if (db->AddUserCert(cert) != net::OK) {
+    // Delete the imported private key because the certificate didn't import.
+    if (private_key) {
+      // Always destroys the private key.
+      if (PK11_DeleteTokenPrivateKey(private_key.release(), PR_FALSE)) {
+        LOG(ERROR) << "PK11_DeleteTokenCertAndKey failed: " << PORT_GetError();
+      }
+    }
+    return false;
+  }
+  return true;
+}
+
 int NSSCertDatabase::ImportFromPKCS12(
     CryptoModule* module,
     const std::string& data,
     const base::string16& password,
     bool is_extractable,
     net::CertificateList* imported_certs) {
   DVLOG(1) << __func__ << " "
            << PK11_GetModuleID(module->os_module_handle()) << ":"
            << PK11_GetSlotID(module->os_module_handle());
   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
@@ skipping 246 matching lines @@
   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 }
 
 void NSSCertDatabase::NotifyObserversOfCACertChanged(
     const X509Certificate* cert) {
   observer_list_->Notify(
       &Observer::OnCACertChanged, make_scoped_refptr(cert));
 }
 
 }  // namespace net