net: plumb OCSP stapled responses.

net: plumb OCSP stapled responses.

We added support for OCSP stapling to libssl3 in (r**TBD**). This plumbs
that information from the SSL socket into the OCSP caching in libnss3.

BUG=none
TEST=none

[wtc, 2010-11-23 00:44:44]

LGTM.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:115: #if defined(OS_LINUX)
We should ideally test USE_NSS instead of OS_LINUX here.
Do all the USE_NSS platforms support __attribute__((weak))?

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:124: SECItem *encodedResponse, void *pwArg)
__attribute__((weak));
Does "weak" need to be double-parenthesized?

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:130: // On other platforms we ship this
function ourselves so we know that we have
This comment is misleading because on other platforms (Mac
and Windows), we don't use libnss3 for certificate
verification.

We'll need to write platform-specific code to inject the
stapled OCSP response into the system certificate library.

Nit: line 133 should be indented with 2 spaces.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:2193:
HaveCacheOCSPResponseFromSideChannelFunction()) {
Could you add a TODO comment to note that we need to write
Mac and Windows code to inject the stapled OCSP response into
the system certificate library?

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:2203: memset(&ocsp_response_item, 0,
sizeof(ocsp_response_item));
Nit: you can replace this memset call with
    ocsp_response_item.type = siBuffer;

[agl, 2010-11-30 15:59:46]

This got lost before Thanksgiving, so I'm only just getting around to landing
it. Just waiting for a last tryserver run.

Cheers

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:115: #if defined(OS_LINUX)
On 2010/11/23 00:44:45, wtc wrote:
> We should ideally test USE_NSS instead of OS_LINUX here.
> Do all the USE_NSS platforms support __attribute__((weak))?

I think this is specifically a Linux (and maybe FreeBSD, although I'll let them
fix that if they hit it) issue. It's not related to NSS itself, just to the
specific case of linking against a system libnss3.so.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:124: SECItem *encodedResponse, void *pwArg)
__attribute__((weak));
On 2010/11/23 00:44:45, wtc wrote:
> Does "weak" need to be double-parenthesized?

It's the GCC syntax.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:130: // On other platforms we ship this
function ourselves so we know that we have
On 2010/11/23 00:44:45, wtc wrote:
> We'll need to write platform-specific code to inject the
> stapled OCSP response into the system certificate library.

Have changed the comment to include that point, have changed the function to
return false and have made the SSL_ENABLE_OCSP_STAPLING conditional on this
function.

Thus stapling is disabled on non-Linux until we can plumb the OCSP response into
the system libraries.

> Nit: line 133 should be indented with 2 spaces.

done.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:2193:
HaveCacheOCSPResponseFromSideChannelFunction()) {
On 2010/11/23 00:44:45, wtc wrote:
> Could you add a TODO comment to note that we need to write
> Mac and Windows code to inject the stapled OCSP response into
> the system certificate library?

Done.

http://codereview.chromium.org/5231006/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:2203: memset(&ocsp_response_item, 0,
sizeof(ocsp_response_item));
On 2010/11/23 00:44:45, wtc wrote:
> Nit: you can replace this memset call with
>     ocsp_response_item.type = siBuffer;

Done.

[wtc, 2010-11-30 19:19:16]

Still LGTM.

http://codereview.chromium.org/5231006/diff/10001/net/socket/ssl_client_socke...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/5231006/diff/10001/net/socket/ssl_client_socke...
net/socket/ssl_client_socket_nss.cc:2194: // TODO: we need to be able to plumb
an OCSP response into the system
Nit: cpplint.py requires that a TODO comment include the
author's user id.  You can put wtc or rsleevi in this TODO().