Instantiate OriginBoundCertService in relevant places and do plumbing to pass it down to HttpNetw...

chrome/browser/io_thread.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/debug/leak_tracker.h"
@@ skipping 18 matching lines @@
 #include "chrome/browser/net/proxy_service_factory.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "content/browser/browser_thread.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/browser/in_process_webkit/indexed_db_key_utility_client.h"
 #include "content/common/url_fetcher.h"
 #include "net/base/cert_verifier.h"
 #include "net/base/cookie_monster.h"
+#include "net/base/default_origin_bound_cert_store.h"
 #include "net/base/dnsrr_resolver.h"
 #include "net/base/host_cache.h"
 #include "net/base/host_resolver.h"
 #include "net/base/host_resolver_impl.h"
 #include "net/base/mapped_host_resolver.h"
 #include "net/base/net_util.h"
+#include "net/base/origin_bound_cert_service.h"
 #include "net/dns/async_host_resolver.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_auth_filter.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_network_session.h"
 #include "net/proxy/proxy_config_service.h"
 #include "net/proxy/proxy_script_fetcher_impl.h"
 #include "net/proxy/proxy_service.h"
 #include "net/socket/dns_cert_provenance_checker.h"
@@ skipping 192 matching lines @@
   context->set_cert_verifier(globals->cert_verifier.get());
   context->set_dnsrr_resolver(globals->dnsrr_resolver.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->proxy_script_fetcher_proxy_service.get());
   context->set_http_transaction_factory(
       globals->proxy_script_fetcher_http_transaction_factory.get());
   context->set_ftp_transaction_factory(
       globals->proxy_script_fetcher_ftp_transaction_factory.get());
   // In-memory cookie store.
   context->set_cookie_store(new net::CookieMonster(NULL, NULL));

[wtc, 2011/08/08 22:49:20]

Similarly, I think the proxy script fetcher context and system
context can share the same in-memory cookie store.

+  // In-memory origin-bound cert store.
+  context->set_origin_bound_cert_service(
+      globals->proxy_origin_bound_cert_service.get());
   context->set_network_delegate(globals->system_network_delegate.get());
   return context;
 }
 
 scoped_refptr<net::URLRequestContext>
 ConstructSystemRequestContext(IOThread::Globals* globals,
                               net::NetLog* net_log) {
   scoped_refptr<net::URLRequestContext> context(
       new SystemURLRequestContext);
   context->set_net_log(net_log);
   context->set_host_resolver(globals->host_resolver.get());
   context->set_cert_verifier(globals->cert_verifier.get());
   context->set_dnsrr_resolver(globals->dnsrr_resolver.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->system_proxy_service.get());
   context->set_http_transaction_factory(
       globals->system_http_transaction_factory.get());
   context->set_ftp_transaction_factory(
       globals->system_ftp_transaction_factory.get());
   // In-memory cookie store.
   context->set_cookie_store(new net::CookieMonster(NULL, NULL));
+  // In-memory origin bound cert-store.
+  context->set_origin_bound_cert_service(
+      globals->system_origin_bound_cert_service.get());
   return context;
 }
 
 }  // namespace
 
 class SystemURLRequestContextGetter : public net::URLRequestContextGetter {
  public:
   explicit SystemURLRequestContextGetter(IOThread* io_thread);
   virtual ~SystemURLRequestContextGetter();
 
@@ skipping 188 matching lines @@
   globals_->extension_event_router_forwarder =
       extension_event_router_forwarder_;
   globals_->system_network_delegate.reset(new ChromeNetworkDelegate(
       extension_event_router_forwarder_,
       NULL,
       NULL,
       &system_enable_referrers_));
   globals_->host_resolver.reset(
       CreateGlobalHostResolver(net_log_));
   globals_->cert_verifier.reset(new net::CertVerifier);
+  globals_->proxy_origin_bound_cert_service.reset(
+      new net::OriginBoundCertService(
+          new net::DefaultOriginBoundCertStore(NULL)));
+  globals_->system_origin_bound_cert_service.reset(
+      new net::OriginBoundCertService(
+          new net::DefaultOriginBoundCertStore(NULL)));

[wtc, 2011/08/08 22:49:20]

We should use globals_->system_origin_bound_cert_service in
system_params in IOThread::InitSystemRequestContextOnIOThread().

I suspect proxy_script_fetcher and system can share the
same origin-bound cert service.  Please find out exactly
what the proxy script fetcher context is used for.  I
seem to recall proxy script fetcher only needs its own
proxy service to avoid a recursion.

   globals_->dnsrr_resolver.reset(new net::DnsRRResolver);
   globals_->ssl_config_service = GetSSLConfigService();
   globals_->http_auth_handler_factory.reset(CreateDefaultAuthHandlerFactory(
       globals_->host_resolver.get()));
   // For the ProxyScriptFetcher, we use a direct ProxyService.
   globals_->proxy_script_fetcher_proxy_service.reset(
       net::ProxyService::CreateDirectWithNetLog(net_log_));
   net::HttpNetworkSession::Params session_params;
   session_params.host_resolver = globals_->host_resolver.get();
   session_params.cert_verifier = globals_->cert_verifier.get();
+  session_params.origin_bound_cert_service =
+      globals_->proxy_origin_bound_cert_service.get();
   session_params.proxy_service =
       globals_->proxy_script_fetcher_proxy_service.get();
   session_params.http_auth_handler_factory =
       globals_->http_auth_handler_factory.get();
   session_params.network_delegate = globals_->system_network_delegate.get();
   session_params.net_log = net_log_;
   session_params.ssl_config_service = globals_->ssl_config_service;
   scoped_refptr<net::HttpNetworkSession> network_session(
       new net::HttpNetworkSession(session_params));
   globals_->proxy_script_fetcher_http_transaction_factory.reset(
       new net::HttpNetworkLayer(network_session));
   globals_->proxy_script_fetcher_ftp_transaction_factory.reset(
       new net::FtpNetworkLayer(globals_->host_resolver.get()));

[wtc, 2011/08/08 22:49:20]

I think the proxy script fetcher and system contexts can share
the same ftp transaction factory, too.

 
   scoped_refptr<net::URLRequestContext> proxy_script_fetcher_context =
       ConstructProxyScriptFetcherContext(globals_, net_log_);

[wtc, 2011/08/08 22:49:20]

Remove this proxy_script_fetcher_context local variable.  It
is not useful.  See lines 751-752 at the end of this file,
where a similar piece of code does without the scoped_refptr.

   globals_->proxy_script_fetcher_context = proxy_script_fetcher_context;
 }
 
 void IOThread::CleanUp() {
   // Step 1: Kill all things that might be holding onto
   // net::URLRequest/net::URLRequestContexts.
 
 #if defined(USE_NSS)
   net::ShutdownOCSP();
 #endif  // defined(USE_NSS)
@@ skipping 204 matching lines @@
   system_params.network_delegate = globals_->system_network_delegate.get();
   system_params.net_log = net_log_;
   globals_->system_http_transaction_factory.reset(
       new net::HttpNetworkLayer(
           new net::HttpNetworkSession(system_params)));
   globals_->system_ftp_transaction_factory.reset(
       new net::FtpNetworkLayer(globals_->host_resolver.get()));
   globals_->system_request_context =
       ConstructSystemRequestContext(globals_, net_log_);
 }