Create stubs for system certificate validation.

net/base/cert_verify_proc.h

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_CERT_VERIFY_PROC_H_
+#define NET_BASE_CERT_VERIFY_PROC_H_
+#pragma once
+
+#include <string>
+
+#include "base/memory/ref_counted.h"
+#include "net/base/net_export.h"
+
+namespace net {
+
+class CertVerifyResult;
+class CRLSet;
+class X509Certificate;
+
+// Class to perform certificate path building and verification for various
+// certificate uses. All methods of this class must be thread-safe, as they
+// may be called from various non-joinable worker threads.
+class NET_EXPORT CertVerifyProc
+    : public base::RefCountedThreadSafe<CertVerifyProc> {
+ public:
+  // Creates and returns the default CertVerifyProc.
+  static CertVerifyProc* CreateDefault();
+
+  // Verifies the certificate against the given hostname.  Returns OK if

[wtc, 2012/03/13 22:37:57]

Should we say "Verifies ... as an SSL server certificate"?

+  // successful or an error code upon failure.
+  //
+  // The |*verify_result| structure, including the |verify_result->cert_status|
+  // bitmask, is always filled out regardless of the return value.  If the
+  // certificate has multiple errors, the corresponding status flags are set in
+  // |verify_result->cert_status|, and the error code for the most serious
+  // error is returned.
+  //
+  // |flags| is bitwise OR'd of VerifyFlags:
+  //
+  // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate
+  // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet
+  // based revocation checking is always enabled, regardless of this flag, if
+  // |crl_set| is given.
+  //
+  // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
+  // performed.
+  //
+  // |crl_set| points to an optional CRLSet structure which can be used to
+  // avoid revocation checks over the network.
+  int Verify(X509Certificate* cert,
+             const std::string& hostname,
+             int flags,
+             CRLSet* crl_set,
+             CertVerifyResult* verify_result);
+

[Ryan Sleevi, 2012/03/12 23:07:51]

At some point, we'll want to verify CA/Root certificates for import
(application/x-x509-ca-cert / application/x-x509-root-cert), which will be
additional Verify() calls.

+ protected:
+  friend class base::RefCountedThreadSafe<CertVerifyProc>;
+
+  CertVerifyProc();
+  virtual ~CertVerifyProc();
+
+ private:
+  // Performs the actual verification using the desired underlying
+  // cryptographic library.
+  virtual int VerifyInternal(X509Certificate* cert,

[Ryan Sleevi, 2012/03/12 23:07:51]

I debated about making CertVerifyProc a pure virtual and then having
CertVerifyProcBase, which implemented the Verify/VerifyInternal split, but that
seemed needlessly complex for what is ultimately a temporary solution.

The mapping is X509Certificate::Verify() -> CertVerifyProc::Verify() and
X509Certificate::VerifyInternal() -> CertVerifyProc::VerifyInternal().

Speaking longer term CertVerifyProc::Verify() (aka X509Certificate::Verify())
could/should be implemented as its own CertVerifier, since that conceptually
matches what it does (high level checks and blacklisting). However, to avoid
performance concerns (and I can talk more about them if needed), I wanted to
match the existing X509Certificate:: functionality first before implementing new
functionality.

+                             const std::string& hostname,
+                             int flags,
+                             CRLSet* crl_set,
+                             CertVerifyResult* verify_result) = 0;
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_CERT_VERIFY_PROC_H_