Bring X.509 cert handling (at least preliminarily) to the Mac.

net/base/x509_certificate.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 
 #include <set>
 #include <string>
 #include <vector>
 
 #include "base/ref_counted.h"
 #include "base/time.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <wincrypt.h>
+#elif defined(OS_MACOSX)
+#include <Security/Security.h>
 #endif
 
 class Pickle;
 
 namespace net {
 
 // X509Certificate represents an X.509 certificate used by SSL.
 class X509Certificate : public base::RefCountedThreadSafe<X509Certificate> {
  public:
   // SHA-1 fingerprint (160 bits) of a certificate.
   struct Fingerprint {
     unsigned char data[20];
   };
 
   class FingerprintLessThan
       : public std::binary_function<Fingerprint, Fingerprint, bool> {
    public:
     bool operator() (const Fingerprint& lhs, const Fingerprint& rhs) const;
   };
 
   // Predicate functor used in maps when X509Certificate is used as the key.
   class LessThan
       : public std::binary_function<X509Certificate*, X509Certificate*, bool> {
    public:
     bool operator() (X509Certificate* lhs,  X509Certificate* rhs) const;
   };
 
 #if defined(OS_WIN)
   typedef PCCERT_CONTEXT OSCertHandle;
+#elif defined(OS_MACOSX)
+  typedef SecCertificateRef OSCertHandle;
 #else
   // TODO(ericroman): not implemented
   typedef void* OSCertHandle;
 #endif
         
   // Principal represent an X.509 principal.
   struct Principal {
     Principal() { }
     explicit Principal(std::string name) : common_name(name) { }
 
@@ skipping 38 matching lines @@
 
    private:
     // The set of fingerprints of allowed certificates.
     std::set<Fingerprint, FingerprintLessThan> allowed_;
 
     // The set of fingerprints of denied certificates.
     std::set<Fingerprint, FingerprintLessThan> denied_;
   };
 
   // Create an X509Certificate from a handle to the certificate object
-  // in the underlying crypto library.
+  // in the underlying crypto library. This is a transfer of ownership;
+  // X509Certificate will properly dispose of |cert_handle| for you.
   static X509Certificate* CreateFromHandle(OSCertHandle cert_handle);
 
   // Create an X509Certificate from the representation stored in the given
   // pickle.  The data for this object is found relative to the given
   // pickle_iter, which should be passed to the pickle's various Read* methods.
+  // Returns NULL on failure.
   static X509Certificate* CreateFromPickle(const Pickle& pickle,
                                            void** pickle_iter);
 
   // Creates a X509Certificate from the ground up.  Used by tests that simulate
   // SSL connections.
   X509Certificate(std::string subject, std::string issuer,
                   Time start_date, Time expiration_date);
 
   // Appends a representation of this object to the given pickle.
   void Persist(Pickle* pickle);
 
   // The subject of the certificate.  For HTTPS server certificates, this
   // represents the web server.  The common name of the subject should match
   // the host name of the web server.
   const Principal& subject() const { return subject_; }
 
   // The issuer of the certificate.
   const Principal& issuer() const { return issuer_; }
 
+#if defined(OS_WIN)

[Amanda Walker, 2008/09/18 16:14:43]

Since you wrote code to extract individual fields from the cert, we could
implement these methods directly.  If they'd be unused, add a comment here
explaining why they're only necessary on Windows

[wtc, 2008/09/18 20:37:55]

I believe the valid_start() and valid_expiry() methods
are being used.

[Avi (use Gerrit), 2008/09/18 20:48:17]

No, they are not. valid_start() isn't used anywhere, and valid_expiry() is only
used in HasExpired(), which is only used to display an error message.

   // Time period during which the certificate is valid.  More precisely, this
   // certificate is invalid before the |valid_start| date and invalid after
   // the |valid_expiry| date.
   // If we were unable to parse either date from the certificate (or if the cert
   // lacks either date), the date will be null (i.e., is_null() will be true).
   const Time& valid_start() const { return valid_start_; }
   const Time& valid_expiry() const { return valid_expiry_; }
+#endif
 
   // The fingerprint of this certificate.
   const Fingerprint& fingerprint() const { return fingerprint_; }
 
   // Gets the DNS names in the certificate.  Pursuant to RFC 2818, Section 3.1
   // Server Identity, if the certificate has a subjectAltName extension of
   // type dNSName, this method gets the DNS names in that extension.
   // Otherwise, it gets the common name in the subject field.
   void GetDNSNames(std::vector<std::string>* dns_names) const;
 
+#if defined(OS_WIN)

[Amanda Walker, 2008/09/18 16:14:43]

Same comment as above: we should either implement or explain why it's
windows-only here.

   // Convenience method that returns whether this certificate has expired as of
   // now.
   bool HasExpired() const;
+#endif
 
   // Returns true if the certificate is an extended-validation (EV)
   // certificate.
   bool IsEV(int cert_status) const;
 
   OSCertHandle os_cert_handle() const { return cert_handle_; }
 
  private:
   // A cache of X509Certificate objects.
   class Cache;
 
   // Construct an X509Certificate from a handle to the certificate object
   // in the underlying crypto library.
   explicit X509Certificate(OSCertHandle cert_handle);
 
   friend class base::RefCountedThreadSafe<X509Certificate>;
   ~X509Certificate();
 
   // Common object initialization code.  Called by the constructors only.
   void Initialize();
 
+#if defined(OS_WIN)
   // Helper function to parse a principal from a WinInet description of that
   // principal.
   static void ParsePrincipal(const std::string& description,
                              Principal* principal);
+#endif

[Amanda Walker, 2008/09/18 16:14:43]

Add a declaration for the Mac version, mostly to keep it scoped to this class

 
   // The subject of the certificate.
   Principal subject_;
 
   // The issuer of the certificate.
   Principal issuer_;
 
+#if defined(OS_WIN)
   // This certificate is not valid before |valid_start_|
   Time valid_start_;
 
   // This certificate is not valid after |valid_expiry_|
   Time valid_expiry_;
+#endif
 
   // The fingerprint of this certificate.
   Fingerprint fingerprint_;
 
   // A handle to the certificate object in the underlying crypto library.
   OSCertHandle cert_handle_;
 
-  DISALLOW_EVIL_CONSTRUCTORS(X509Certificate);
+  DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_