*wip* NSS: handle chromeos system slot.

net/cert/nss_profile_filter_chromeos_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_profile_filter_chromeos.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
@@ skipping 37 matching lines @@
 
   // Sort the result so that test comparisons can be deterministic.
   std::sort(result.begin(), result.end(), X509Certificate::LessThan());
   return result;
 }
 
 }
 
 class NSSProfileFilterChromeOSTest : public testing::Test {
  public:
-  NSSProfileFilterChromeOSTest() : user_1_("user1"), user_2_("user2") {}
+  NSSProfileFilterChromeOSTest()
+      : system_slot_user_("sys"), user_1_("user1"), user_2_("user2") {}
 
   virtual void SetUp() OVERRIDE {
     // Initialize nss_util slots.
+    ASSERT_TRUE(system_slot_user_.constructed_successfully());
     ASSERT_TRUE(user_1_.constructed_successfully());
     ASSERT_TRUE(user_2_.constructed_successfully());
+    system_slot_user_.FinishInit();
     user_1_.FinishInit();
     user_2_.FinishInit();
 
     // TODO(mattm): more accurately test public/private slot filtering somehow.
     // (The slots used to initialize a profile filter should be separate slots
     // in separate modules, while ScopedTestNSSChromeOSUser uses the same slot
     // for both.)
     crypto::ScopedPK11Slot private_slot_1(crypto::GetPrivateSlotForChromeOSUser(
         user_1_.username_hash(),
         base::Callback<void(crypto::ScopedPK11Slot)>()));
     ASSERT_TRUE(private_slot_1.get());
     profile_filter_1_.Init(
         crypto::GetPublicSlotForChromeOSUser(user_1_.username_hash()),
-        private_slot_1.Pass());
+        private_slot_1.Pass(),
+        get_system_slot());
 
     profile_filter_1_copy_ = profile_filter_1_;
 
     crypto::ScopedPK11Slot private_slot_2(crypto::GetPrivateSlotForChromeOSUser(
         user_2_.username_hash(),
         base::Callback<void(crypto::ScopedPK11Slot)>()));
     ASSERT_TRUE(private_slot_2.get());
     profile_filter_2_.Init(
         crypto::GetPublicSlotForChromeOSUser(user_2_.username_hash()),
-        private_slot_2.Pass());
+        private_slot_2.Pass(),
+        get_system_slot());
 
     certs_ = CreateCertificateListFromFile(GetTestCertsDirectory(),
                                            "root_ca_cert.pem",
                                            X509Certificate::FORMAT_AUTO);
     ASSERT_EQ(1U, certs_.size());
   }
 
+  crypto::ScopedPK11Slot get_system_slot() {
+    return crypto::GetPublicSlotForChromeOSUser(
+        system_slot_user_.username_hash());
+  }
+
  protected:
   CertificateList certs_;
+  // Using ScopedTestNSSChromeOSUser for the system slot is a bit of a hack.
+  // Can't use ScopedTestNSSDB because it changes the result of
+  // GetPublicSlotForChromeOSUser for the other slots too.
+  crypto::ScopedTestNSSChromeOSUser system_slot_user_;
   crypto::ScopedTestNSSChromeOSUser user_1_;
   crypto::ScopedTestNSSChromeOSUser user_2_;
   NSSProfileFilterChromeOS no_slots_profile_filter_;
   NSSProfileFilterChromeOS profile_filter_1_;
   NSSProfileFilterChromeOS profile_filter_2_;
   NSSProfileFilterChromeOS profile_filter_1_copy_;
 };
 
 TEST_F(NSSProfileFilterChromeOSTest, TempCertNotAllowed) {
   EXPECT_EQ(NULL, certs_[0]->os_cert_handle()->slot);
@@ skipping 34 matching lines @@
   ASSERT_FALSE(root_certs.empty());
   EXPECT_TRUE(
       no_slots_profile_filter_.IsCertAllowed(root_certs[0]->os_cert_handle()));
   EXPECT_TRUE(profile_filter_1_.IsCertAllowed(root_certs[0]->os_cert_handle()));
   EXPECT_TRUE(
       profile_filter_1_copy_.IsCertAllowed(root_certs[0]->os_cert_handle()));
   EXPECT_TRUE(profile_filter_2_.IsCertAllowed(root_certs[0]->os_cert_handle()));
 }
 
 TEST_F(NSSProfileFilterChromeOSTest, SoftwareSlots) {
+  crypto::ScopedPK11Slot system_slot(get_system_slot());
   crypto::ScopedPK11Slot slot_1(
       crypto::GetPublicSlotForChromeOSUser(user_1_.username_hash()));
   ASSERT_TRUE(slot_1);
   crypto::ScopedPK11Slot slot_2(
       crypto::GetPublicSlotForChromeOSUser(user_2_.username_hash()));
   ASSERT_TRUE(slot_2);
 
   scoped_refptr<X509Certificate> cert_1 = certs_[0];
   CertificateList certs_2 = CreateCertificateListFromFile(
       GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, certs_2.size());
   scoped_refptr<X509Certificate> cert_2 = certs_2[0];
+  CertificateList system_certs =
+      CreateCertificateListFromFile(GetTestCertsDirectory(),
+                                    "mit.davidben.der",
+                                    X509Certificate::FORMAT_AUTO);
+  ASSERT_EQ(1U, system_certs.size());
+  scoped_refptr<X509Certificate> system_cert = system_certs[0];
 
   ASSERT_EQ(SECSuccess,
             PK11_ImportCert(slot_1.get(),
                             cert_1->os_cert_handle(),
                             CK_INVALID_HANDLE,
                             "cert1",
                             PR_FALSE /* includeTrust (unused) */));
 
   ASSERT_EQ(SECSuccess,
             PK11_ImportCert(slot_2.get(),
                             cert_2->os_cert_handle(),
                             CK_INVALID_HANDLE,
                             "cert2",
                             PR_FALSE /* includeTrust (unused) */));
+  ASSERT_EQ(SECSuccess,
+            PK11_ImportCert(system_slot.get(),
+                            system_cert->os_cert_handle(),
+                            CK_INVALID_HANDLE,
+                            "systemcert",
+                            PR_FALSE /* includeTrust (unused) */));
 
   EXPECT_FALSE(
       no_slots_profile_filter_.IsCertAllowed(cert_1->os_cert_handle()));
   EXPECT_FALSE(
       no_slots_profile_filter_.IsCertAllowed(cert_2->os_cert_handle()));
+  EXPECT_FALSE(
+      no_slots_profile_filter_.IsCertAllowed(system_cert->os_cert_handle()));
 
   EXPECT_TRUE(profile_filter_1_.IsCertAllowed(cert_1->os_cert_handle()));
   EXPECT_TRUE(profile_filter_1_copy_.IsCertAllowed(cert_1->os_cert_handle()));
   EXPECT_FALSE(profile_filter_1_.IsCertAllowed(cert_2->os_cert_handle()));
   EXPECT_FALSE(profile_filter_1_copy_.IsCertAllowed(cert_2->os_cert_handle()));
+  EXPECT_TRUE(profile_filter_1_.IsCertAllowed(system_cert->os_cert_handle()));
+  EXPECT_TRUE(
+      profile_filter_1_copy_.IsCertAllowed(system_cert->os_cert_handle()));
 
   EXPECT_FALSE(profile_filter_2_.IsCertAllowed(cert_1->os_cert_handle()));
   EXPECT_TRUE(profile_filter_2_.IsCertAllowed(cert_2->os_cert_handle()));
+  EXPECT_TRUE(profile_filter_2_.IsCertAllowed(system_cert->os_cert_handle()));
 }
 
 }  // namespace net