Refactor client cert private key handling.

net/ssl/ssl_platform_key_nss.cc

Index: net/ssl/ssl_platform_key_nss.cc
diff --git a/net/ssl/ssl_platform_key_nss.cc b/net/ssl/ssl_platform_key_nss.cc
index e63fb18fb5dad40a6bac116f0d74dd73b19fbd4b..93256ea2af9067b48e7197cd9ea072b755745ade 100644
--- a/net/ssl/ssl_platform_key_nss.cc
+++ b/net/ssl/ssl_platform_key_nss.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "net/ssl/ssl_platform_key_nss.h"
+
 #include <cert.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ -12,10 +14,9 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
+#include "crypto/nss_crypto_module_delegate.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
-#include "net/ssl/client_key_store.h"
-#include "net/ssl/ssl_platform_key.h"
 #include "net/ssl/ssl_platform_key_util.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/ssl/threaded_ssl_private_key.h"
@@ -153,13 +154,13 @@ class SSLPlatformKeyNSS : public ThreadedSSLPrivateKey::Delegate {
 }  // namespace
 
 scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
-    const X509Certificate* certificate) {
+    const X509Certificate* certificate,
+    crypto::CryptoModuleBlockingPasswordDelegate* password_delegate) {
+  void* wincx = password_delegate ? password_delegate->wincx() : nullptr;
   crypto::ScopedSECKEYPrivateKey key(
-      PK11_FindKeyByAnyCert(certificate->os_cert_handle(), nullptr));
-  if (!key) {
-    return ClientKeyStore::GetInstance()->FetchClientCertPrivateKey(
-        *certificate);
-  }
+      PK11_FindKeyByAnyCert(certificate->os_cert_handle(), wincx));

[davidben, 2017/06/01 23:41:25]

Huh. We didn't manage to pass this in before, did we? Do you know in what cases
this might matter? I guess now that we're finally running this step on a
background thread, we can afford to do this.

[mattm, 2017/06/02 04:04:20]

Previously we had that ugly UnlockSlot thing where the client cert selector
dialog would try to unlock the slot before calling the result callback and hope
that was good enough. I manually tested that this still works if you have a
password on your NSSDB, should also apply if you have a password protected smart
card though I didn't test that.

+  if (!key)
+    return nullptr;
 
   int type;
   size_t max_length;