Refactor EnsureOpenSSLInit and openssl_util into base

net/base/x509_certificate.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 #pragma once
 
 #include <string.h>
 
 #include <string>
 #include <vector>
 
 #include "base/gtest_prod_util.h"
 #include "base/ref_counted.h"
 #include "base/string_piece.h"
 #include "base/time.h"
 #include "net/base/x509_cert_types.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <wincrypt.h>
 #elif defined(OS_MACOSX)
 #include <CoreFoundation/CFArray.h>
 #include <Security/SecBase.h>
 #elif defined(USE_OPENSSL)
 // Forward declaration; real one in <x509.h>
 struct x509_st;
+typedef struct x509_store_st X509_STORE;
 #elif defined(USE_NSS)
 // Forward declaration; real one in <cert.h>
 struct CERTCertificateStr;
 #endif
 
 class Pickle;
 
 namespace net {
 
 class CertVerifyResult;
@@ skipping 188 matching lines @@
   // Returns a handle to a global, in-memory certificate store. We use it for
   // two purposes:
   // 1. Import server certificates into this store so that we can verify and
   //    display the certificates using CryptoAPI.
   // 2. Copy client certificates from the "MY" system certificate store into
   //    this store so that we can close the system store when we finish
   //    searching for client certificates.
   static HCERTSTORE cert_store();
 #endif
 
+#if defined(USE_OPENSSL)
+  // Returns a handle to a global, in-memory trusted root certificate store. We

[wtc, 2010/11/16 15:35:07]

Nit: is this certificate store for trusted roots only, or
does it also hold test server's certificate?

[joth, 2010/11/16 16:07:19]

The latter, but only after the test code has used this method to access the
store and inject its certs (as per the "e.g.")
Is it incorrect to term this a "root" cert?

[wtc, 2010/11/16 20:20:19]

A test server's cert is not a "root" cert.  "Root" is short
for "root CA", which is the highest CA in the certificate
chain.  A test server's cert is the lowest cert in the
certificate chain.

You should change
    trusted root certificate store
to simply
    certificate store

[joth, 2010/11/17 09:57:13]

Done.

+  // use it for test code, e.g. importing the test server's certificate.
+  static X509_STORE* cert_store();
+#endif
+
   // Verifies the certificate against the given hostname.  Returns OK if
   // successful or an error code upon failure.
   //
   // The |*verify_result| structure, including the |verify_result->cert_status|
   // bitmask, is always filled out regardless of the return value.  If the
   // certificate has multiple errors, the corresponding status flags are set in
   // |verify_result->cert_status|, and the error code for the most serious
   // error is returned.
   //
   // |flags| is bitwise OR'd of VerifyFlags.
@@ skipping 82 matching lines @@
 
   // Where the certificate comes from.
   Source source_;
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_