*wip* NSS: handle chromeos system slot.

net/ssl/client_cert_store_chromeos.cc

Index: net/ssl/client_cert_store_chromeos.cc
diff --git a/net/ssl/client_cert_store_chromeos.cc b/net/ssl/client_cert_store_chromeos.cc
index f357797e34b5d18b87766d81eaf1a42452635950..64b470c0ccf866f0314f50b7604c57ca4264e3c2 100644
--- a/net/ssl/client_cert_store_chromeos.cc
+++ b/net/ssl/client_cert_store_chromeos.cc
@@ -63,14 +63,18 @@ void ClientCertStoreChromeOS::DidGetPrivateSlot(
     const base::Closure& callback,
     crypto::ScopedPK11Slot private_slot) {
   profile_filter_.Init(crypto::GetPublicSlotForChromeOSUser(username_hash_),

[pneubeck (no reviews), 2014/06/13 12:40:43]

Why does this need the public slot?
Aren't client certs only stored in the private slot? Or does this depend on
whether their keys are hardware-backed or not?
(again a clarifying comment somewhere about the purpose of 'private' and
'public' slots would be useful)

[mattm, 2014/06/24 03:16:46]

Client certs can be stored in the software slot also (certificate manager allows
you to import or import hardware backed).

-                       private_slot.Pass());
+                       private_slot.Pass(),
+                       crypto::ScopedPK11Slot(crypto::GetPrivateNSSKeySlot()));

[pneubeck (no reviews), 2014/06/13 12:40:43]

If GetPrivateNSSKeySlot is referring to the system wide token, then it should be
commented (or maybe even named) that way.
For readers without a lot of background about the naming scheme and the crypto/
or net/ internals I think it's hard to follow.

[mattm, 2014/06/24 03:16:46]

Done.

   ClientCertStoreNSS::GetClientCerts(*request, selected_certs, callback);
 }
 
 void ClientCertStoreChromeOS::InitForTesting(
     crypto::ScopedPK11Slot public_slot,
     crypto::ScopedPK11Slot private_slot) {
-  profile_filter_.Init(public_slot.Pass(), private_slot.Pass());
+  profile_filter_.Init(public_slot.Pass(),
+                       private_slot.Pass(),
+                       // XXX pass system slot? add unittests with system slot?
+                       crypto::ScopedPK11Slot());
 }
 
 bool ClientCertStoreChromeOS::SelectClientCertsForTesting(