net: enable CRL sets behind a command line flag.

net/base/cert_verifier.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verifier.h"
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/stl_util.h"
 #include "base/synchronization/lock.h"
 #include "base/time.h"
 #include "base/threading/worker_pool.h"
+#include "net/base/crl_set.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/base/x509_certificate.h"
 
 #if defined(USE_NSS)
 #include <private/pprthred.h>  // PR_DetachThread
 #endif
 
 namespace net {
 
@@ skipping 109 matching lines @@
 
 
 // CertVerifierWorker runs on a worker thread and takes care of the blocking
 // process of performing the certificate verification.  Deletes itself
 // eventually if Start() succeeds.
 class CertVerifierWorker {
  public:
   CertVerifierWorker(X509Certificate* cert,
                      const std::string& hostname,
                      int flags,
+                     CRLSet* crl_set,
                      CertVerifier* cert_verifier)
       : cert_(cert),
         hostname_(hostname),
         flags_(flags),
+        crl_set_(crl_set),
         origin_loop_(MessageLoop::current()),
         cert_verifier_(cert_verifier),
         canceled_(false),
         error_(ERR_FAILED) {
   }
 
   bool Start() {
     DCHECK_EQ(MessageLoop::current(), origin_loop_);
 
     return base::WorkerPool::PostTask(
         FROM_HERE, NewRunnableMethod(this, &CertVerifierWorker::Run),
         true /* task is slow */);
   }
 
   // Cancel is called from the origin loop when the CertVerifier is getting
   // deleted.
   void Cancel() {
     DCHECK_EQ(MessageLoop::current(), origin_loop_);
     base::AutoLock locked(lock_);
     canceled_ = true;
   }
 
  private:
   void Run() {
     // Runs on a worker thread.
-    error_ = cert_->Verify(hostname_, flags_, &verify_result_);
+    error_ = cert_->Verify(hostname_, flags_, &verify_result_,
+                           crl_set_.get());

[wtc, 2011/10/21 23:17:31]

Nit: omit .get().

[agl, 2011/10/24 20:44:27]

Done.

 #if defined(USE_NSS)
     // Detach the thread from NSPR.
     // Calling NSS functions attaches the thread to NSPR, which stores
     // the NSPR thread ID in thread-specific data.
     // The threads in our thread pool terminate after we have called
     // PR_Cleanup.  Unless we detach them from NSPR, net_unittests gets
     // segfaults on shutdown when the threads' thread-specific data
     // destructors run.
     PR_DetachThread();
 #endif
@@ skipping 38 matching lines @@
       }
     }
 
     if (canceled)
       delete this;
   }
 
   scoped_refptr<X509Certificate> cert_;
   const std::string hostname_;
   const int flags_;
+  scoped_refptr<CRLSet> crl_set_;
   MessageLoop* const origin_loop_;
   CertVerifier* const cert_verifier_;
 
   // lock_ protects canceled_.
   base::Lock lock_;
 
   // If canceled_ is true,
   // * origin_loop_ cannot be accessed by the worker thread,
   // * cert_verifier_ cannot be accessed by any thread.
   bool canceled_;
@@ skipping 95 matching lines @@
 
 CertVerifier::~CertVerifier() {
   STLDeleteValues(&inflight_);
 
   CertDatabase::RemoveObserver(this);
 }
 
 int CertVerifier::Verify(X509Certificate* cert,
                          const std::string& hostname,
                          int flags,
+                         CRLSet* crl_set,
                          CertVerifyResult* verify_result,
                          const CompletionCallback& callback,
                          RequestHandle* out_req,
                          const BoundNetLog& net_log) {
   DCHECK(CalledOnValidThread());
 
   if (callback.is_null() || !verify_result || hostname.empty()) {
     *out_req = NULL;
     return ERR_INVALID_ARGUMENT;
   }
@@ skipping 20 matching lines @@
   std::map<RequestParams, CertVerifierJob*>::const_iterator j;
   j = inflight_.find(key);
   if (j != inflight_.end()) {
     // An identical request is in flight already. We'll just attach our
     // callback.
     inflight_joins_++;
     job = j->second;
   } else {
     // Need to make a new request.
     CertVerifierWorker* worker = new CertVerifierWorker(cert, hostname, flags,
-                                                        this);
+                                                        crl_set, this);
     job = new CertVerifierJob(
         worker,
         BoundNetLog::Make(net_log.net_log(), NetLog::SOURCE_CERT_VERIFIER_JOB));
     if (!worker->Start()) {
       delete job;
       delete worker;
       *out_req = NULL;
       // TODO(wtc): log to the NetLog.
       LOG(ERROR) << "CertVerifierWorker couldn't be started.";
       return ERR_INSUFFICIENT_RESOURCES;  // Just a guess.
@@ skipping 96 matching lines @@
 SingleRequestCertVerifier::~SingleRequestCertVerifier() {
   if (cur_request_) {
     cert_verifier_->CancelRequest(cur_request_);
     cur_request_ = NULL;
   }
 }
 
 int SingleRequestCertVerifier::Verify(X509Certificate* cert,
                                       const std::string& hostname,
                                       int flags,
+                                      CRLSet* crl_set,
                                       CertVerifyResult* verify_result,
                                       const CompletionCallback& callback,
                                       const BoundNetLog& net_log) {
   // Should not be already in use.
   DCHECK(!cur_request_ && cur_request_callback_.is_null());
 
   // Do a synchronous verification.
   if (callback.is_null())
-    return cert->Verify(hostname, flags, verify_result);
+    return cert->Verify(hostname, flags, verify_result, crl_set);
 
   CertVerifier::RequestHandle request = NULL;
 
   // We need to be notified of completion before |callback| is called, so that
   // we can clear out |cur_request_*|.
   int rv = cert_verifier_->Verify(
-      cert, hostname, flags, verify_result,
+      cert, hostname, flags, crl_set, verify_result,
       base::Bind(&SingleRequestCertVerifier::OnVerifyCompletion,
                  base::Unretained(this)),
       &request, net_log);
 
   if (rv == ERR_IO_PENDING) {
     // Cleared in OnVerifyCompletion().
     cur_request_ = request;
     cur_request_callback_ = callback;
   }
 
   return rv;
 }
 
 void SingleRequestCertVerifier::OnVerifyCompletion(int result) {
   DCHECK(cur_request_ && !cur_request_callback_.is_null());
 
   CompletionCallback callback = cur_request_callback_;
 
   // Clear the outstanding request information.
   cur_request_ = NULL;
   cur_request_callback_.Reset();
 
   // Call the user's original callback.
   callback.Run(result);
 }
 
 }  // namespace net
 
 DISABLE_RUNNABLE_METHOD_REFCOUNT(net::CertVerifierWorker);