Support EC certs in OriginBoundCertService and OriginBoundCertStore.

net/socket/ssl_client_socket_nss.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_
 #pragma once
 
 #include <certt.h>
 #include <keyt.h>
@@ skipping 148 matching lines @@
   int HandleNSSError(PRErrorCode error, bool handshake_error);
 
   // NSS calls this when checking certificates. We pass 'this' as the first
   // argument.
   static SECStatus OwnAuthCertHandler(void* arg, PRFileDesc* socket,
                                       PRBool checksig, PRBool is_server);
   // Returns true if connection negotiated the origin bound cert extension.
   static bool OriginBoundCertNegotiated(PRFileDesc* socket);
   // Origin bound cert client auth handler.
   // Returns the value the ClientAuthHandler function should return.
-  SECStatus OriginBoundClientAuthHandler(CERTCertificate** result_certificate,
-                                         SECKEYPrivateKey** result_private_key);
+  SECStatus OriginBoundClientAuthHandler(
+      const std::vector<OriginBoundCertType>& requested_types,

[wtc, 2011/11/30 23:23:40]

Nit: name this parameter cert_types or requested_cert_types.

[mattm, 2011/12/02 01:55:59]

Done.

+      CERTCertificate** result_certificate,
+      SECKEYPrivateKey** result_private_key);
 #if defined(NSS_PLATFORM_CLIENT_AUTH)
   // On platforms where we use the native certificate store, NSS calls this
   // instead when client authentication is requested.  At most one of
   // (result_certs, result_private_key) or
   // (result_nss_certificate, result_nss_private_key) should be set.
   static SECStatus PlatformClientAuthHandler(
       void* arg,
       PRFileDesc* socket,
       CERTDistNames* ca_names,
       CERTCertList** result_certs,
@@ skipping 70 matching lines @@
   // GetSSLCertRequestInfo calls.
   std::vector<scoped_refptr<X509Certificate> > client_certs_;
   bool client_auth_cert_needed_;
 
   CertVerifier* const cert_verifier_;
   scoped_ptr<SingleRequestCertVerifier> verifier_;
 
   // For origin bound certificates in client auth.
   bool ob_cert_xtn_negotiated_;
   OriginBoundCertService* origin_bound_cert_service_;
+  OriginBoundCertType ob_cert_type_;
   std::string ob_private_key_;
   std::string ob_cert_;
   OriginBoundCertService::RequestHandle ob_cert_request_handle_;
 
   // True if NSS has called HandshakeCallback.
   bool handshake_callback_called_;
 
   // True if the SSL handshake has been completed.
   bool completed_handshake_;
 
@@ skipping 35 matching lines @@
   // Added the following code Debugging in release mode.
   mutable base::Lock lock_;
   // This is mutable so that CalledOnValidThread can set it.
   // It's guarded by |lock_|.
   mutable base::PlatformThreadId valid_thread_id_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_NSS_H_