Move the NSS functions out of CertDatabase into a new NSSCertDatabase class.

chrome/browser/chromeos/cros/onc_network_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/onc_network_parser.h"
 
 #include <keyhi.h>
 #include <pk11pub.h>
 
 #include "base/base64.h"
@@ skipping 10 matching lines @@
 #include "chrome/browser/chromeos/cros/onc_constants.h"
 #include "chrome/browser/chromeos/proxy_config_service_impl.h"
 #include "chrome/browser/prefs/proxy_config_dictionary.h"
 #include "chrome/common/net/x509_certificate_model.h"
 #include "content/public/browser/browser_thread.h"
 #include "crypto/encryptor.h"
 #include "crypto/hmac.h"
 #include "crypto/scoped_nss_types.h"
 #include "crypto/symmetric_key.h"
 #include "grit/generated_resources.h"
-#include "net/base/cert_database.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
+#include "net/base/nss_cert_database.h"
 #include "net/base/pem_tokenizer.h"
 #include "net/base/x509_certificate.h"
 #include "net/proxy/proxy_bypass_rules.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 #include "ui/base/l10n/l10n_util.h"
 
 namespace chromeos {
 
 // Local constants.
 namespace {
@@ skipping 475 matching lines @@
     LOG(WARNING) << "ONC File: certificate missing identifier at index"
                  << cert_index;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_GUID_MISSING);
     return NULL;
   }
 
   if (!certificate->GetBoolean("Remove", &remove))
     remove = false;
 
-  net::CertDatabase cert_database;
   if (remove) {
     if (!DeleteCertAndKeyByNickname(guid)) {
       parse_error_ = l10n_util::GetStringUTF8(
           IDS_NETWORK_CONFIG_ERROR_CERT_DELETE);
     }
     return NULL;
   }
 
   // Not removing, so let's get the data we need to add this certificate.
   std::string cert_type;
@@ skipping 383 matching lines @@
   //    identical certificate known to NSS, so we can safely import the
   //    certificate. The GUID being imported may still be on a different
   //    certificate, and we could jump through hoops to reimport the existing
   //    certificate with a different nickname. However, that would mean lots of
   //    effort for a case that's pretty much illegal (reusing GUIDs contradicts
   //    the intention of GUIDs), so we just report an error.
   //
   // TODO(mnissler, gspencer): We should probably switch to a mode where we
   // keep our own database for mapping GUIDs to certs in order to enable several
   // GUIDs to map to the same cert. See http://crosbug.com/26073.
-  net::CertDatabase cert_database;
+  net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance();
   if (x509_cert->os_cert_handle()->isperm) {
-    if (!cert_database.DeleteCertAndKey(x509_cert.get())) {
+    if (!cert_database->DeleteCertAndKey(x509_cert.get())) {
       parse_error_ = l10n_util::GetStringUTF8(
           IDS_NETWORK_CONFIG_ERROR_CERT_DELETE);
       return NULL;
     }
 
     // Reload the cert here to get an actual temporary cert instance.
     x509_cert =
         net::X509Certificate::CreateFromBytesWithNickname(
             decoded_x509.data(),
             decoded_x509.size(),
@@ skipping 14 matching lines @@
   ListCertsWithNickname(guid, &certs);
   if (!certs.empty()) {
     LOG(WARNING) << "Cert GUID is already in use: " << guid;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_GUID_COLLISION);
     return NULL;
   }
 
   net::CertificateList cert_list;
   cert_list.push_back(x509_cert);
-  net::CertDatabase::ImportCertFailureList failures;
+  net::NSSCertDatabase::ImportCertFailureList failures;
   bool success = false;
-  net::CertDatabase::TrustBits trust = web_trust ?
-                                       net::CertDatabase::TRUSTED_SSL :
-                                       net::CertDatabase::TRUST_DEFAULT;
+  net::NSSCertDatabase::TrustBits trust = web_trust ?
+                                          net::NSSCertDatabase::TRUSTED_SSL :
+                                          net::NSSCertDatabase::TRUST_DEFAULT;
   if (cert_type == "Server") {
-    success = cert_database.ImportServerCert(cert_list, trust, &failures);
+    success = cert_database->ImportServerCert(cert_list, trust, &failures);
   } else {  // Authority cert
-    success = cert_database.ImportCACerts(cert_list, trust, &failures);
+    success = cert_database->ImportCACerts(cert_list, trust, &failures);
   }
   if (!failures.empty()) {
     LOG(WARNING) << "ONC File: Error ("
                  << net::ErrorToString(failures[0].net_error)
                  << ") importing " << cert_type << " certificate at index "
                  << cert_index;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_IMPORT);
     return NULL;
   }
   if (!success) {
     LOG(WARNING) << "ONC File: Unknown error importing " << cert_type
                  << " certificate at index " << cert_index;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_UNKNOWN);
     return NULL;
   }
   VLOG(2) << "Successfully imported server/ca certificate at index "
           << cert_index;
 
   return x509_cert;
 }
 
 scoped_refptr<net::X509Certificate> OncNetworkParser::ParseClientCertificate(
     int cert_index,
     const std::string& guid,
     base::DictionaryValue* certificate) {
-  net::CertDatabase cert_database;
   std::string pkcs12_data;
   if (!certificate->GetString("PKCS12", &pkcs12_data) ||
       pkcs12_data.empty()) {
     LOG(WARNING) << "ONC File: PKCS12 data is missing for Client "
                  << "certificate at index " << cert_index;
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_DATA_MISSING);
     return NULL;
   }
 
   std::string decoded_pkcs12;
   if (!base::Base64Decode(pkcs12_data, &decoded_pkcs12)) {
     LOG(WARNING) << "Unable to base64 decode PKCS#12 data: \""
                  << pkcs12_data << "\".";
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_DATA_MALFORMED);
     return NULL;
   }
 
   // Since this has a private key, always use the private module.
-  scoped_refptr<net::CryptoModule> module(cert_database.GetPrivateModule());
+  net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance();
+  scoped_refptr<net::CryptoModule> module(cert_database->GetPrivateModule());
   net::CertificateList imported_certs;
 
-  int result = cert_database.ImportFromPKCS12(
+  int result = cert_database->ImportFromPKCS12(
       module.get(), decoded_pkcs12, string16(), false, &imported_certs);
   if (result != net::OK) {
     LOG(WARNING) << "ONC File: Unable to import Client certificate at index "
                  << cert_index
                  << " (error " << net::ErrorToString(result) << ").";
     parse_error_ = l10n_util::GetStringUTF8(
         IDS_NETWORK_CONFIG_ERROR_CERT_IMPORT);
     return NULL;
   }
 
@@ skipping 40 matching lines @@
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ClientCertType>, parser,
       (table, arraysize(table), CLIENT_CERT_TYPE_NONE));
   return parser.Get(type);
 }
 
 // static
 void OncNetworkParser::ListCertsWithNickname(const std::string& label,
                                              net::CertificateList* result) {
   net::CertificateList all_certs;
-  net::CertDatabase cert_db;
-  cert_db.ListCerts(&all_certs);
+  net::NSSCertDatabase::GetInstance()->ListCerts(&all_certs);
   result->clear();
   for (net::CertificateList::iterator iter = all_certs.begin();
        iter != all_certs.end(); ++iter) {
     if (iter->get()->os_cert_handle()->nickname) {
       // Separate the nickname stored in the certificate at the colon, since
       // NSS likes to store it as token:nickname.
       const char* delimiter =
           ::strchr(iter->get()->os_cert_handle()->nickname, ':');
       if (delimiter) {
         delimiter++;  // move past the colon.
@@ skipping 17 matching lines @@
       PORT_Free(private_key_nickname);
       SECKEY_DestroyPrivateKey(private_key);
     }
   }
 }
 
 // static
 bool OncNetworkParser::DeleteCertAndKeyByNickname(const std::string& label) {
   net::CertificateList cert_list;
   ListCertsWithNickname(label, &cert_list);
-  net::CertDatabase cert_db;
   bool result = true;
   for (net::CertificateList::iterator iter = cert_list.begin();
        iter != cert_list.end(); ++iter) {
     // If we fail, we try and delete the rest still.
     // TODO(gspencer): this isn't very "transactional".  If we fail on some, but
     // not all, then it's possible to leave things in a weird state.
     // Luckily there should only be one cert with a particular
     // label, and the cert not being found is one of the few reasons the
     // delete could fail, but still...  The other choice is to return
     // failure immediately, but that doesn't seem to do what is intended.
-    if (!cert_db.DeleteCertAndKey(iter->get()))
+    if (!net::NSSCertDatabase::GetInstance()->DeleteCertAndKey(iter->get()))
       result = false;
   }
   return result;
 }
 
 // static
 std::string OncNetworkParser::GetPkcs11IdFromCertGuid(const std::string& guid) {
   // We have to look up the GUID to find the PKCS#11 ID that is needed.
   net::CertificateList cert_list;
   ListCertsWithNickname(guid, &cert_list);
@@ skipping 875 matching lines @@
     // on the value of AuthenticationType.
     { "L2TP-IPsec", PROVIDER_TYPE_L2TP_IPSEC_PSK },
     { "OpenVPN", PROVIDER_TYPE_OPEN_VPN },
   };
   CR_DEFINE_STATIC_LOCAL(EnumMapper<ProviderType>, parser,
       (table, arraysize(table), PROVIDER_TYPE_MAX));
   return parser.Get(type);
 }
 
 }  // namespace chromeos