Use correct slot id for client certs in network config.

chromeos/cert_loader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/cert_loader.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ skipping 66 matching lines @@
 }
 
 void CertLoader::AddObserver(CertLoader::Observer* observer) {
   observers_.AddObserver(observer);
 }
 
 void CertLoader::RemoveObserver(CertLoader::Observer* observer) {
   observers_.RemoveObserver(observer);
 }
 
-int CertLoader::TPMTokenSlotID() const {
-  if (!database_)
-    return -1;
-  crypto::ScopedPK11Slot slot(database_->GetPrivateSlot());
-  DCHECK(slot);
-  return static_cast<int>(PK11_GetSlotID(slot.get()));
-}
-
 bool CertLoader::IsHardwareBacked() const {
   if (force_hardware_backed_for_test_)
     return true;
   if (!database_)
     return false;
   crypto::ScopedPK11Slot slot(database_->GetPrivateSlot());
   DCHECK(slot);
   return PK11_IsHW(slot.get());
 }
 
@@ skipping 10 matching lines @@
 
 // static
 //
 // For background see this discussion on dev-tech-crypto.lists.mozilla.org:
 // http://web.archiveorange.com/archive/v/6JJW7E40sypfZGtbkzxX
 //
 // NOTE: This function relies on the convention that the same PKCS#11 ID
 // is shared between a certificate and its associated private and public
 // keys.  I tried to implement this with PK11_GetLowLevelKeyIDForCert(),
 // but that always returns NULL on Chrome OS for me.
-std::string CertLoader::GetPkcs11IdForCert(const net::X509Certificate& cert) {
+std::string CertLoader::GetPkcs11IdAndSlotForCert(
+    const net::X509Certificate& cert,
+    int* slot_id) {
+  DCHECK(slot_id);
+
   CERTCertificateStr* cert_handle = cert.os_cert_handle();
   SECKEYPrivateKey *priv_key =
       PK11_FindKeyByAnyCert(cert_handle, NULL /* wincx */);
   if (!priv_key)
     return std::string();
 
+  *slot_id = static_cast<int>(PK11_GetSlotID(priv_key->pkcs11Slot));
+
   // Get the CKA_ID attribute for a key.
   SECItem* sec_item = PK11_GetLowLevelKeyIDForPrivateKey(priv_key);
   std::string pkcs11_id;
   if (sec_item) {
     pkcs11_id = base::HexEncode(sec_item->data, sec_item->len);
     SECITEM_FreeItem(sec_item, PR_TRUE);
   }
   SECKEY_DestroyPrivateKey(priv_key);
 
   return pkcs11_id;
@@ skipping 49 matching lines @@
   VLOG(1) << "OnCertAdded";
   LoadCertificates();
 }
 
 void CertLoader::OnCertRemoved(const net::X509Certificate* cert) {
   VLOG(1) << "OnCertRemoved";
   LoadCertificates();
 }
 
 }  // namespace chromeos