Reland "Don't use RSAPrivateKey in NSS integration code."

This is a reland of https://codereview.chromium.org/1106103003/ with fixes to
ensure callers never pass in a null slot.

Currently some NSS platform integration logic transits private keys through
RSAPrivateKey on CrOS. This prevents incrementally switching RSAPrivateKey to
BoringSSL while keeping platform integrations on NSS.

The intent of this change is to clarify RSAPrivateKey as a BoringSSL vs NSS
internal crypto library (use_openssl=0 vs use_openssl=1) abstraction. It's
primarily to be used with SignatureCreator. Code which uses NSS based on
use_nss_certs rather than use_openssl because the underlying platform is NSS
should call NSS routines directly, or introduce different abstractions.

Remove the problematic RSAPrivateKey methods and instead add
crypto/nss_key_util.h which contains some helper functions for manipulating NSS
keys. This is sufficient to allow consumers of the removed methods to use NSS
directly with about as much code. (This should not set back migrating that
logic to NSS as that code was already very NSS-specific; those APIs assumed
PK11SlotInfo.)

nss_key_util.h, like nss_util.h, is built whenever NSS is used either
internally or for platform integrations. This is so rsa_private_key_nss.cc can
continue to use the helper functions to implement the NSS-agnostic interface.

With this, the chimera CrOS configuration should build. The RSAPrivateKey logic
is functional with the exception of some logic in components/ownership. That
will be resolved in a future CL.

BUG=478777,483606

Review URL: https://codereview.chromium.org/1128153003

Cr-Commit-Position: refs/heads/master@{#329227}

2 files changed, 25 insertions, 1 deletions

diff --git a/components/ownership/BUILD.gn b/components/ownership/BUILD.gn
index 1bca927..cdaf227 100644
--- a/components/ownership/BUILD.gn
+++ b/components/ownership/BUILD.gn
@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 
 component("ownership") {
@@ -29,6 +30,10 @@ component("ownership") {
   if (enable_configuration_policy) {
     deps += [ "//components/policy" ]
   }
+
+  if (use_nss_certs) {
+    deps += [ "//crypto:platform" ]
+  }
 }
 
 source_set("unit_tests") {
diff --git a/components/ownership/owner_key_util_impl.cc b/components/ownership/owner_key_util_impl.cc
index bc7208e..5a400d5 100644
--- a/components/ownership/owner_key_util_impl.cc
+++ b/components/ownership/owner_key_util_impl.cc
@@ -8,7 +8,12 @@
 
 #include "base/files/file_util.h"
 #include "base/logging.h"
+
+#if defined(USE_NSS_CERTS)
+#include <keythi.h>
+#include "crypto/nss_key_util.h"
 #include "crypto/rsa_private_key.h"
+#endif
 
 namespace ownership {
 
@@ -54,7 +59,21 @@ bool OwnerKeyUtilImpl::ImportPublicKey(std::vector<uint8>* output) {
 crypto::RSAPrivateKey* OwnerKeyUtilImpl::FindPrivateKeyInSlot(
     const std::vector<uint8>& key,
     PK11SlotInfo* slot) {
-  return crypto::RSAPrivateKey::FindFromPublicKeyInfoInSlot(key, slot);
+  if (!slot)
+    return nullptr;
+
+  crypto::ScopedSECKEYPrivateKey private_key(
+      crypto::FindNSSKeyFromPublicKeyInfoInSlot(key, slot));
+  if (!private_key || SECKEY_GetPrivateKeyType(private_key.get()) != rsaKey)
+    return nullptr;
+#if defined(USE_OPENSSL)
+  // TODO(davidben): This assumes that crypto::RSAPrivateKey also uses NSS.
+  // https://crbug.com/478777
+  NOTIMPLEMENTED();
+  return nullptr;
+#else
+  return crypto::RSAPrivateKey::CreateFromKey(private_key.get());
+#endif
 }
 #endif  // defined(USE_NSS_CERTS)