platformKeys: Add per-extension sign permissions.

chrome/browser/chromeos/platform_keys/platform_keys_nss.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/platform_keys/platform_keys.h"
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <secder.h>
@@ skipping 758 matching lines @@
   scoped_ptr<SelectCertificatesState> state(new SelectCertificatesState(
       user->username_hash(), use_system_key_slot, cert_request_info, callback));
 
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&SelectCertificatesOnIOThread, base::Passed(&state)));
 }
 
 }  // namespace subtle
 
+std::string GetSubjectPublicKeyInfo(
+    const scoped_refptr<net::X509Certificate>& certificate) {
+  const SECItem& spki_der = certificate->os_cert_handle()->derPublicKey;
+  return std::string(spki_der.data, spki_der.data + spki_der.len);
+}
+
 bool GetPublicKey(const scoped_refptr<net::X509Certificate>& certificate,
-                  std::string* public_key_spki_der,
                   net::X509Certificate::PublicKeyType* key_type,
                   size_t* key_size_bits) {
-  const SECItem& spki_der = certificate->os_cert_handle()->derPublicKey;
-
   net::X509Certificate::PublicKeyType key_type_tmp =
       net::X509Certificate::kPublicKeyTypeUnknown;
   size_t key_size_bits_tmp = 0;
   net::X509Certificate::GetPublicKeyInfo(certificate->os_cert_handle(),
                                          &key_size_bits_tmp, &key_type_tmp);
 
   if (key_type_tmp == net::X509Certificate::kPublicKeyTypeUnknown) {
     LOG(WARNING) << "Could not extract public key of certificate.";
     return false;
   }
   if (key_type_tmp != net::X509Certificate::kPublicKeyTypeRSA) {
     LOG(WARNING) << "Keys of other type than RSA are not supported.";
     return false;
   }
 
   crypto::ScopedSECKEYPublicKey public_key(
       CERT_ExtractPublicKey(certificate->os_cert_handle()));
   if (!public_key) {
     LOG(WARNING) << "Could not extract public key of certificate.";
     return false;
   }
   long public_exponent = DER_GetInteger(&public_key->u.rsa.publicExponent);
   if (public_exponent != 65537L) {
     LOG(ERROR) << "Rejecting RSA public exponent that is unequal 65537.";
     return false;
   }
 
-  public_key_spki_der->assign(spki_der.data, spki_der.data + spki_der.len);
   *key_type = key_type_tmp;
   *key_size_bits = key_size_bits_tmp;
-
   return true;
 }
 
 void GetCertificates(const std::string& token_id,
                      const GetCertificatesCallback& callback,
                      BrowserContext* browser_context) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   scoped_ptr<GetCertificatesState> state(new GetCertificatesState(callback));
   // Get the pointer to |state| before base::Passed releases |state|.
   NSSOperationState* state_ptr = state.get();
@@ skipping 48 matching lines @@
   NSSOperationState* state_ptr = state.get();
   GetCertDatabase(std::string() /* don't get any specific slot */,
                   base::Bind(&GetTokensWithDB, base::Passed(&state)),
                   browser_context,
                   state_ptr);
 }
 
 }  // namespace platform_keys
 
 }  // namespace chromeos