Refactor client cert private key handling.

net/ssl/ssl_platform_key_nss.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "net/ssl/ssl_platform_key_nss.h"
+
 #include <cert.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <prerror.h>
 
 #include <utility>
 
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
+#include "crypto/nss_crypto_module_delegate.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
-#include "net/ssl/client_key_store.h"
-#include "net/ssl/ssl_platform_key.h"
 #include "net/ssl/ssl_platform_key_util.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/ssl/threaded_ssl_private_key.h"
 #include "third_party/boringssl/src/include/openssl/bn.h"
 #include "third_party/boringssl/src/include/openssl/bytestring.h"
 #include "third_party/boringssl/src/include/openssl/ec.h"
 #include "third_party/boringssl/src/include/openssl/ec_key.h"
 #include "third_party/boringssl/src/include/openssl/ecdsa.h"
 #include "third_party/boringssl/src/include/openssl/evp.h"
 #include "third_party/boringssl/src/include/openssl/mem.h"
@@ skipping 117 matching lines @@
  private:
   int type_;
   crypto::ScopedSECKEYPrivateKey key_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyNSS);
 };
 
 }  // namespace
 
 scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
-    const X509Certificate* certificate) {
+    const X509Certificate* certificate,
+    crypto::CryptoModuleBlockingPasswordDelegate* password_delegate) {
+  void* wincx = password_delegate ? password_delegate->wincx() : nullptr;
   crypto::ScopedSECKEYPrivateKey key(
-      PK11_FindKeyByAnyCert(certificate->os_cert_handle(), nullptr));
-  if (!key) {
-    return ClientKeyStore::GetInstance()->FetchClientCertPrivateKey(
-        *certificate);
-  }
+      PK11_FindKeyByAnyCert(certificate->os_cert_handle(), wincx));

[davidben, 2017/06/01 23:41:25]

Huh. We didn't manage to pass this in before, did we? Do you know in what cases
this might matter? I guess now that we're finally running this step on a
background thread, we can afford to do this.

[mattm, 2017/06/02 04:04:20]

Previously we had that ugly UnlockSlot thing where the client cert selector
dialog would try to unlock the slot before calling the result callback and hope
that was good enough. I manually tested that this still works if you have a
password on your NSSDB, should also apply if you have a password protected smart
card though I didn't test that.

+  if (!key)
+    return nullptr;
 
   int type;
   size_t max_length;
   if (!GetClientCertInfo(certificate, &type, &max_length))
     return nullptr;
 
   return make_scoped_refptr(new ThreadedSSLPrivateKey(
       base::MakeUnique<SSLPlatformKeyNSS>(type, std::move(key)),
       GetSSLPlatformKeyTaskRunner()));
 }
 
 }  // namespace net