Implement chrome.platformKeys.getKeyPair().

chrome/browser/chromeos/platform_keys/platform_keys_service.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/platform_keys/platform_keys_service.h"
 
 #include "base/base64.h"
 #include "base/callback.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/platform_keys/platform_keys.h"
@@ skipping 24 matching lines @@
     const std::string& public_key_spki_der) {
   callback.Run(public_key_spki_der, std::string() /* no error */);
 }
 
 // Callback used by |PlatformKeysService::Sign|.
 // Is called with the old validity of |public_key_spki_der| (or false if an
 // error occurred during reading the StateStore). If allowed, starts the actual
 // signing operation which will call back |callback|. If not allowed, calls
 // |callback| with an error.
 void CheckValidityAndSign(const std::string& token_id,
-                          const std::string& public_key_spki_der,
-                          platform_keys::HashAlgorithm hash_algorithm,
-                          const std::string& data,
+                          scoped_ptr<platform_keys::SignRSAParams> params,
                           const PlatformKeysService::SignCallback& callback,
                           content::BrowserContext* browser_context,
                           bool key_is_valid) {
   if (!key_is_valid) {
     callback.Run(std::string() /* no signature */,
                  kErrorKeyNotAllowedForSigning);
     return;
   }
-  platform_keys::subtle::Sign(token_id,
-                              public_key_spki_der,
-                              hash_algorithm,
-                              data,
-                              callback,
-                              browser_context);
+  platform_keys::subtle::SignRSA(token_id, params.Pass(), callback,
+                                 browser_context);
 }
 
 }  // namespace
 
 PlatformKeysService::PlatformKeysService(
     content::BrowserContext* browser_context,
     extensions::StateStore* state_store)
     : browser_context_(browser_context),
       state_store_(state_store),
       weak_factory_(this) {
@@ skipping 16 matching lines @@
   platform_keys::subtle::GenerateRSAKey(
       token_id,
       modulus_length,
       base::Bind(&PlatformKeysService::GenerateRSAKeyCallback,
                  weak_factory_.GetWeakPtr(),
                  extension_id,
                  callback),
       browser_context_);
 }
 
-void PlatformKeysService::Sign(const std::string& token_id,
-                               const std::string& public_key_spki_der,
-                               platform_keys::HashAlgorithm hash_algorithm,
-                               const std::string& data,
-                               const std::string& extension_id,
-                               const SignCallback& callback) {
+void PlatformKeysService::SignRSA(
+    const std::string& token_id,
+    scoped_ptr<platform_keys::SignRSAParams> params,
+    const std::string& extension_id,
+    const SignCallback& callback) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  ReadValidityAndInvalidateKey(extension_id,
-                               public_key_spki_der,
-                               base::Bind(&CheckValidityAndSign,
-                                          token_id,
-                                          public_key_spki_der,
-                                          hash_algorithm,
-                                          data,
-                                          callback,
-                                          browser_context_));
+  ReadValidityAndInvalidateKey(
+      extension_id, params->public_key(),
+      base::Bind(&CheckValidityAndSign, token_id, base::Passed(&params),
+                 callback, browser_context_));
 }
 
 void PlatformKeysService::SelectClientCertificates(
     const platform_keys::ClientCertificateRequest& request,
     const std::string& extension_id,
     const SelectCertificatesCallback& callback) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   platform_keys::subtle::SelectClientCertificates(
       request,
@@ skipping 87 matching lines @@
 
 void PlatformKeysService::InvalidateKey(
     const std::string& extension_id,
     const std::string& public_key_spki_der,
     const base::Callback<void(bool)>& callback,
     scoped_ptr<base::ListValue> platform_keys) {
   scoped_ptr<base::StringValue> key_value(
       GetPublicKeyValue(public_key_spki_der));
 
   size_t index = 0;
-  if (!platform_keys->Remove(*key_value, &index)) {
-    // The key is not found, so it's not valid to use it for signing.
-    callback.Run(false);
-    return;
+  // If the key is found in |platform_keys|, it's valid for the extension to use
+  // it for signing.
+  bool key_was_valid = platform_keys->Remove(*key_value, &index);
+
+  if (key_was_valid) {
+    // Persist that the key is now invalid.
+    SetPlatformKeysOfExtension(extension_id, platform_keys.Pass());
   }
 
-  SetPlatformKeysOfExtension(extension_id, platform_keys.Pass());
-  callback.Run(true);
+  if (permission_check_enabled_) {
+    // If permission checks are enabled, pass back the key permission (before
+    // it was removed above).

[Ryan Sleevi, 2015/02/10 00:59:33]

To make sure I'm understanding: You only allow one signing operation with the
key, right?

That's what line 209-215 cover? You allow it to be used once?

[pneubeck (no reviews), 2015/02/10 10:40:52]

Outside the new platform_keys_apitest_nss.cc the permission check is not
changed, because |permission_check_enabled_| is true (in other tests and in
production).

The existing permission check ensures that an extension, that generates a key,
can use the key _at most once_ for signing.
That's ensured by line 211 (remove the key from the permission list) and line
215 (persist the reduced list).

+    callback.Run(key_was_valid);
+  } else {
+    // Otherwise just allow signing with the key (which is enabled for testing
+    // only).
+    callback.Run(true);
+  }
 }
 
 void PlatformKeysService::GotPlatformKeysOfExtension(
     const std::string& extension_id,
     const GetPlatformKeysCallback& callback,
     scoped_ptr<base::Value> value) {
   if (!value)
     value.reset(new base::ListValue);
 
   base::ListValue* keys = NULL;
   if (!value->GetAsList(&keys)) {
     LOG(ERROR) << "Found a value of wrong type.";
 
     keys = new base::ListValue;
     value.reset(keys);
   }
 
   ignore_result(value.release());
   callback.Run(make_scoped_ptr(keys));
 }
 
 }  // namespace chromeos