Enable device-wide EAP-TLS networks

chrome/browser/browser_process_platform_part_chromeos.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/browser_process_platform_part_chromeos.h"
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/time/default_tick_clock.h"
 #include "base/time/tick_clock.h"
@@ skipping 10 matching lines @@
 #include "chrome/browser/chromeos/system/system_clock.h"
 #include "chrome/browser/chromeos/system/timezone_resolver_manager.h"
 #include "chrome/browser/chromeos/system/timezone_util.h"
 #include "chrome/browser/lifetime/keep_alive_types.h"
 #include "chrome/browser/lifetime/scoped_keep_alive.h"
 #include "chrome/common/chrome_switches.h"
 #include "chromeos/geolocation/simple_geolocation_provider.h"
 #include "chromeos/timezone/timezone_resolver.h"
 #include "components/session_manager/core/session_manager.h"
 #include "components/user_manager/user_manager.h"
+#include "net/cert/nss_cert_database_chromeos.h"
 
 BrowserProcessPlatformPart::BrowserProcessPlatformPart()
     : created_profile_helper_(false) {}
 
 BrowserProcessPlatformPart::~BrowserProcessPlatformPart() {}
 
 void BrowserProcessPlatformPart::InitializeAutomaticRebootManager() {
   DCHECK(!automatic_reboot_manager_);
 
   automatic_reboot_manager_.reset(new chromeos::system::AutomaticRebootManager(
@@ skipping 35 matching lines @@
 
 void BrowserProcessPlatformPart::InitializeSessionManager() {
   DCHECK(!session_manager_);
   session_manager_ = base::MakeUnique<chromeos::ChromeSessionManager>();
 }
 
 void BrowserProcessPlatformPart::ShutdownSessionManager() {
   session_manager_.reset();
 }
 
+void BrowserProcessPlatformPart::InitializeSystemSlotCertDatabase(
+    crypto::ScopedPK11Slot system_slot) {
+  crypto::ScopedPK11Slot system_slot_copy =
+      crypto::ScopedPK11Slot(PK11_ReferenceSlot(system_slot.get()));
+  auto database = base::MakeUnique<net::NSSCertDatabaseChromeOS>(
+      std::move(system_slot), crypto::ScopedPK11Slot());
+  database->SetSystemSlot(std::move(system_slot_copy));
+  system_token_cert_database_ = std::move(database);
+
+  // Notify clients waiting for the system token cert database to be available.
+  std::vector<base::Callback<void(net::NSSCertDatabase*)>> callbacks;
+  callbacks.swap(system_token_ready_callbacks_);
+  for (auto& callback : callbacks)
+    callback.Run(system_token_cert_database_.get());
+}
+
+void BrowserProcessPlatformPart::ShutdownSystemSlotCertDatabase() {
+  system_token_cert_database_.reset();
+}
+
+void BrowserProcessPlatformPart::GetSystemSlotCertDatabase(
+    base::Callback<void(net::NSSCertDatabase*)> callback) {
+  if (system_token_cert_database_)
+    callback.Run(system_token_cert_database_.get());
+  else
+    system_token_ready_callbacks_.push_back(callback);
+}

[stevenjb, 2017/05/09 17:04:02]

Looking through the code, I don't see access to any of these methods outside of
chrome_browser_main_chromeos.cc.

Is there any reason not to make this part of CertLoader or
ChromeBrowserMainPartsChromeos (encapsulated as a helper class)?

The reason I ask is that for mus+ash I expect we will need to access
certificates from both the Chrome and Ash processes, and I don't think we will
want this code to be part of the Browser at that point. Putting the code here
will make that extraction a bit more complicated.

[pmarko, 2017/05/10 11:48:01]

Good point. I expected other clients to use this global system token database in
the future (e.g. extensions on the sign-in screen, as currently implemented by
Yves), but now I think the nice solution would be to inject that into the
sign-in profile from ChromeBrowserMainPArtsChromeos. So: Done.

+
 void BrowserProcessPlatformPart::RegisterKeepAlive() {
   DCHECK(!keep_alive_);
   keep_alive_.reset(
       new ScopedKeepAlive(KeepAliveOrigin::BROWSER_PROCESS_CHROMEOS,
                           KeepAliveRestartOption::DISABLED));
 }
 
 void BrowserProcessPlatformPart::UnregisterKeepAlive() {
   keep_alive_.reset();
 }
@@ skipping 56 matching lines @@
 
 void BrowserProcessPlatformPart::DestroySystemClock() {
   system_clock_.reset();
 }
 
 void BrowserProcessPlatformPart::CreateProfileHelper() {
   DCHECK(!created_profile_helper_ && !profile_helper_);
   created_profile_helper_ = true;
   profile_helper_.reset(new chromeos::ProfileHelper());
 }