Get ClientCertStore through ResourceContext.

net/ssl/client_cert_store_impl_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/client_cert_store_impl.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreFoundation/CFArray.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/SecBase.h>
 #include <Security/Security.h>
 
 #include <algorithm>
 #include <string>
 
+#include "base/callback.h"
 #include "base/logging.h"
 #include "base/mac/mac_logging.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "crypto/mac_security_services_lock.h"
 #include "net/base/host_port_pair.h"
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_mac.h"
 
@@ skipping 139 matching lines @@
   if (preferred_cert.get() && sort_begin != sort_end &&
       sort_begin->get() == preferred_cert.get()) {
     ++sort_begin;
   }
   sort(sort_begin, sort_end, x509_util::ClientCertSorter());
   return true;
 }
 
 }  // namespace
 
-bool ClientCertStoreImpl::GetClientCerts(const SSLCertRequestInfo& request,
-                                         CertificateList* selected_certs) {
+void ClientCertStoreImpl::GetClientCerts(const SSLCertRequestInfo& request,
+                                         CertificateList* selected_certs,
+                                         const base::Closure& callback) {
   std::string server_domain =
       HostPortPair::FromString(request.host_and_port).host();
 
   ScopedCFTypeRef<SecIdentityRef> preferred_identity;
   if (!server_domain.empty()) {
     // See if there's an identity preference for this domain:
     ScopedCFTypeRef<CFStringRef> domain_str(
         base::SysUTF8ToCFStringRef("https://" + server_domain));
     SecIdentityRef identity = NULL;
     // While SecIdentityCopyPreferences appears to take a list of CA issuers
@@ skipping 11 matching lines @@
   // Now enumerate the identities in the available keychains.
   scoped_refptr<X509Certificate> preferred_cert = NULL;
   CertificateList regular_certs;
 
   SecIdentitySearchRef search = NULL;
   OSStatus err;
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     err = SecIdentitySearchCreate(NULL, CSSM_KEYUSE_SIGN, &search);
   }
-  if (err)
-    return false;
+  if (err) {
+    callback.Run();
+    return;

[wtc, 2013/10/28 19:41:12]

Does this change means we can no longer report an error. Is this OK because
reporting an error would not be useful, so to the user an error is
indistinguishable from an empty selected_certs?

Note: This comment also applies to the _win.cc file. (The version of this method
in the _nss.cc file doesn't return false in the original code.)

[mattm, 2013/10/28 23:56:16]

Yeah, the UI wasn't actually using the error return code, so I just removed it
to keep things simple.

+  }
   ScopedCFTypeRef<SecIdentitySearchRef> scoped_search(search);
   while (!err) {
     SecIdentityRef identity = NULL;
     {
       base::AutoLock lock(crypto::GetMacSecurityServicesLock());
       err = SecIdentitySearchCopyNext(search, &identity);
     }
     if (err)
       break;
     ScopedCFTypeRef<SecIdentityRef> scoped_identity(identity);
@@ skipping 12 matching lines @@
       // Only one certificate should match.
       DCHECK(!preferred_cert.get());
       preferred_cert = cert;
     } else {
       regular_certs.push_back(cert);
     }
   }
 
   if (err != errSecItemNotFound) {
     OSSTATUS_LOG(ERROR, err) << "SecIdentitySearch error";
-    return false;
+    callback.Run();
+    return;
   }
 
-  return GetClientCertsImpl(preferred_cert, regular_certs, request, true,
-                            selected_certs);
+  GetClientCertsImpl(preferred_cert, regular_certs, request, true,
+                     selected_certs);
+  callback.Run();
 }
 
 bool ClientCertStoreImpl::SelectClientCertsForTesting(
     const CertificateList& input_certs,
     const SSLCertRequestInfo& request,
     CertificateList* selected_certs) {
   return GetClientCertsImpl(NULL, input_certs, request, false,
                             selected_certs);
 }
 
 #if !defined(OS_IOS)
 bool ClientCertStoreImpl::SelectClientCertsGivenPreferredForTesting(
     const scoped_refptr<X509Certificate>& preferred_cert,
     const CertificateList& regular_certs,
     const SSLCertRequestInfo& request,
     CertificateList* selected_certs) {
   return GetClientCertsImpl(preferred_cert, regular_certs, request, false,
                             selected_certs);
 }
 #endif
 
 }  // namespace net