Implement SSL certificate error handling on the Mac. If the user gives...

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code GetDefaultCertNickname(), derived from
 // nsNSSCertificate::defaultServerNickName()
 // in mozilla/security/manager/ssl/src/nsNSSCertificate.cpp
 // and SSLClientSocketNSS::DoVerifyCertComplete() derived from
 // AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
@@ skipping 314 matching lines @@
   rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_connect_callback_ = callback;
 
   LeaveFunction("");
   return rv > OK ? OK : rv;
 }
 
 void SSLClientSocketNSS::InvalidateSessionIfBadCertificate() {
   if (UpdateServerCert() != NULL &&
-      ssl_config_.allowed_bad_certs_.count(server_cert_)) {
+      ssl_config_.IsAllowedBadCert(server_cert_)) {
     SSL_InvalidateSession(nss_fd_);
   }
 }
 
 void SSLClientSocketNSS::Disconnect() {
   EnterFunction("");
 
   // TODO(wtc): Send SSL close_notify alert.
   if (nss_fd_ != NULL) {
     InvalidateSessionIfBadCertificate();
@@ skipping 429 matching lines @@
         }
       }
       CERT_DestroyCertList(cert_list);
     }
   }
 
   // If we have been explicitly told to accept this certificate, override the
   // result of verifier_.Verify.
   // Eventually, we should cache the cert verification results so that we don't
   // need to call verifier_.Verify repeatedly.  But for now we need to do this.
-  // Alternatively, we might be able to store the cert's status along with
-  // the cert in the allowed_bad_certs_ set.
+  // Alternatively, we could use the cert's status that we stored along with
+  // the cert in the allowed_bad_certs vector.
   if (IsCertificateError(result) &&
-      ssl_config_.allowed_bad_certs_.count(server_cert_)) {
+      ssl_config_.IsAllowedBadCert(server_cert_)) {
     LOG(INFO) << "accepting bad SSL certificate, as user told us to";
     result = OK;
   }
 
   completed_handshake_ = true;
   // TODO(ukai): we may not need this call because it is now harmless to have an
   // session with a bad cert.
   InvalidateSessionIfBadCertificate();
   // Exit DoLoop and return the result to the caller to Connect.
   DCHECK(next_state_ == STATE_NONE);
@@ skipping 33 matching lines @@
   if (prerr == PR_WOULD_BLOCK_ERROR) {
     GotoState(STATE_PAYLOAD_WRITE);
     return ERR_IO_PENDING;
   }
   user_buf_ = NULL;
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net