Enable device-wide EAP-TLS networks

chromeos/cert_loader.h

Index: chromeos/cert_loader.h
diff --git a/chromeos/cert_loader.h b/chromeos/cert_loader.h
index 7faedbf7b609b3c8479851be850371866ec53ead..b12153f35b6c1477ba922ffa7141173ba197c378 100644
--- a/chromeos/cert_loader.h
+++ b/chromeos/cert_loader.h
@@ -31,13 +31,14 @@ namespace chromeos {
 // When certificates have been loaded (after login completes and tpm token is
 // initialized), or the cert database changes, observers are called with
 // OnCertificatesLoaded().
-class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
+class CHROMEOS_EXPORT CertLoader {
  public:
   class Observer {
    public:
     // Called when the certificates, passed for convenience as |all_certs|,
     // have completed loading. |initial_load| is true the first time this
-    // is called.
+    // is called. It will be false if this is called because another slot has
+    // been added to CertLoader's data sources.
     virtual void OnCertificatesLoaded(const net::CertificateList& all_certs,
                                       bool initial_load) = 0;
 
@@ -64,12 +65,17 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
   static std::string GetPkcs11IdAndSlotForCert(const net::X509Certificate& cert,
                                                int* slot_id);
 
-  // Starts the CertLoader with the NSS cert database.
+  // Starts the CertLoader with the passed user NSS cert database.
   // The CertLoader will _not_ take the ownership of the database, but it
   // expects it to stay alive at least until the shutdown starts on the main
-  // thread. This assumes that |StartWithNSSDB| and other methods directly
+  // thread. This assumes that |StartWithUserNSSDB| and other methods directly
   // using |database_| are not called during shutdown.
-  void StartWithNSSDB(net::NSSCertDatabase* database);
+  void StartWithUserNSSDB(net::NSSCertDatabase* user_database);
+
+  // Starts the CertLoader with the passed system NSS cert database.
+  // The CertLoader will _not_ take ownership of the database - see comment on
+  // StartWithUserNSSDB.
+  void StartWithSystemNSSDB(net::NSSCertDatabase* system_slot_database);
 
   void AddObserver(CertLoader::Observer* observer);
   void RemoveObserver(CertLoader::Observer* observer);
@@ -81,7 +87,7 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
   // Returns true when the certificate list has been requested but not loaded.
   bool CertificatesLoading() const;
 
-  bool certificates_loaded() const { return certificates_loaded_; }
+  bool certificates_loaded() const;
 
   // Returns all certificates. This will be empty until certificates_loaded() is
   // true.
@@ -102,15 +108,14 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
   static void ForceHardwareBackedForTesting();
 
  private:
-  CertLoader();
-  ~CertLoader() override;
+  class CertCache;
 
-  // Trigger a certificate load. If a certificate loading task is already in
-  // progress, will start a reload once the current task is finished.
-  void LoadCertificates();
+  CertLoader();
+  ~CertLoader();
 
-  // Called when the underlying NSS database finished loading certificates.
-  void CertificatesLoaded(std::unique_ptr<net::CertificateList> all_certs);
+  // Called by |system_cert_cache_| or |user_cert_cache| when these had an
+  // update.
+  void CacheUpdated();
 
   // Called if a certificate load task is finished.
   void UpdateCertificates(std::unique_ptr<net::CertificateList> all_certs,
@@ -118,25 +123,18 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer {
 
   void NotifyCertificatesLoaded(bool initial_load);
 
-  // net::CertDatabase::Observer
-  void OnCertDBChanged() override;
+  // True if the initial load of CertLoader is still pending.
+  bool pending_initial_load_;
 
   base::ObserverList<Observer> observers_;
 
-  // Flags describing current CertLoader state.
-  bool certificates_loaded_;
-  bool certificates_update_required_;
-  bool certificates_update_running_;
-
-  // The user-specific NSS certificate database from which the certificates
-  // should be loaded.
-  net::NSSCertDatabase* database_;
+  std::unique_ptr<CertCache> system_cert_cache_;
+  std::unique_ptr<CertCache> user_cert_cache_;
 
-  // Cached certificates loaded from the database.
+  // Cached certificates loaded from the database(s).
   std::unique_ptr<net::CertificateList> all_certs_;
 
-  // Cached certificates from system token. Currently this is a sublist of
-  // |all_certs_|.
+  // Cached certificates from system token.
   std::unique_ptr<net::CertificateList> system_certs_;
 
   base::ThreadChecker thread_checker_;