Add TLS-SRP (RFC 5054) support

chrome/browser/ssl/ssl_policy.cc

Index: chrome/browser/ssl/ssl_policy.cc
diff --git a/chrome/browser/ssl/ssl_policy.cc b/chrome/browser/ssl/ssl_policy.cc
index afe861bc688780e60963a64466d774218a52f92b..20e7d520883104e8920653c4d7ada977fb98babc 100644
--- a/chrome/browser/ssl/ssl_policy.cc
+++ b/chrome/browser/ssl/ssl_policy.cc
@@ -116,8 +116,8 @@ void SSLPolicy::OnRequestStarted(SSLRequestInfo* info) {
   // However, right now we don't have the proper context to understand where
   // these resources will be used.  Consequently, we're conservative and treat
   // them all like DidRunInsecureContent().
-
-  if (net::IsCertStatusError(info->ssl_cert_status())) {
+  if (net::IsCertStatusError(info->ssl_cert_status()) ||
+      (!info->ssl_cert_id() && info->tls_username().empty())) {
     backend_->HostRanInsecureContent(info->url().host(), info->child_id());
 
     // TODO(abarth): We should eventually remove the main_frame_origin and
@@ -148,10 +148,11 @@ void SSLPolicy::UpdateEntry(NavigationEntry* entry, TabContents* tab_contents) {
   if (!entry->url().SchemeIsSecure())
     return;
 
-  // An HTTPS response may not have a certificate for some reason.  When that
-  // happens, use the unauthenticated (HTTP) rather than the authentication
-  // broken security style so that we can detect this error condition.
-  if (!entry->ssl().cert_id()) {
+  // An HTTPS response may not have a certificate or TLS auth username for some
+  // reason.  When that happens, use the unauthenticated (HTTP) rather than the
+  // authentication broken security style so that we can detect this error
+  // condition.
+  if (!entry->ssl().cert_id() && entry->ssl().tls_username().empty()) {
     entry->ssl().set_security_style(SECURITY_STYLE_UNAUTHENTICATED);
     return;
   }
@@ -168,7 +169,7 @@ void SSLPolicy::UpdateEntry(NavigationEntry* entry, TabContents* tab_contents) {
   // If CERT_STATUS_UNABLE_TO_CHECK_REVOCATION is the only certificate error,
   // don't lower the security style to SECURITY_STYLE_AUTHENTICATION_BROKEN.
   int cert_errors = entry->ssl().cert_status() & net::CERT_STATUS_ALL_ERRORS;
-  if (cert_errors) {
+  if (cert_errors && entry->ssl().tls_username().empty()) {
     if (cert_errors != net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION)
       entry->ssl().set_security_style(SECURITY_STYLE_AUTHENTICATION_BROKEN);
     return;