Add a callback to SecureSocket for certificates that fail to be authenticated.

sdk/lib/io/secure_socket.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * SecureSocket provides a secure (SSL or TLS) client connection to a server.
  * The certificate provided by the server is checked
  * using the certificate database provided in setCertificateDatabase.
  */
 abstract class SecureSocket implements Socket {
   /**
    * Constructs a new secure client socket and connect it to the given
    * host on the given port. The returned socket is not yet connected
    * but ready for registration of callbacks.
    */
   factory SecureSocket(String host, int port) => new _SecureSocket(host, port);
-
+  /**

[Mads Ager (google), 2012/12/05 07:30:53]

Please add a blank line between members.

[Bill Hesse, 2012/12/05 12:35:38]

Done.

+   * Install a handler for unverifiable certificates.  The handler can inspect
+   * the certificate, and decide (or let the user decide) whether to accept
+   * the connection or not.  The callback should return true
+   * to continue the SecureSocket connection.
+   */
+  void set onBadCertificate(bool callback(X509Certificate certificate));
    /**

[Mads Ager (google), 2012/12/05 07:30:53]

Ditto.

    * Initializes the NSS library with the path to a certificate database
    * containing root certificates for verifying certificate paths on
    * client connections, and server certificates to provide on server
    * connections.  The password argument should be used when creating
    * secure server sockets, to allow the private key of the server
    * certificate to be fetched.  If useBuiltinRoots is true (the default),
    * then a built-in set of root certificates for trusted certificate
    * authorities is merged with the certificates in the database.
    *
    * Examples:
@@ skipping 13 matching lines @@
    * containing a cert9.db file, not a cert8.db file.  This version of
    * the database can be created using the NSS certutil tool with "sql:" in
    * front of the absolute path of the database directory, or setting the
    * environment variable NSS_DEFAULT_DB_TYPE to "sql".
    */
   external static void initialize({String database,
                                    String password,
                                    bool useBuiltinRoots: true});
 }
 
+/**
+ * X509Certificate represents an SSL certificate, with accessors to
+ * get the fields of the certificate.
+ */
+abstract class X509Certificate {

[Mads Ager (google), 2012/12/05 07:30:53]

I think we should just remove the abstract class. That would allow users to
create X509Certificate objects, but I don't see any harm in that.

[Bill Hesse, 2012/12/05 12:35:38]

Done.

+  String get subject;
+  String get issuer;
+  Date get startValidity;
+  Date get endValidity;
+}
+
+
+class _X509Certificate implements X509Certificate {
+  _X509Certificate(this.subject,
+                   this.issuer,
+                   this.startValidity,
+                   this.endValidity);
+  final String subject;
+  final String issuer;
+  final Date startValidity;
+  final Date endValidity;
+}
+
 
 class _SecureSocket implements SecureSocket {
   // Status states
   static final int NOT_CONNECTED = 200;
   static final int HANDSHAKE = 201;
   static final int CONNECTED = 202;
   static final int CLOSED = 203;
 
   // Buffer identifiers.
   // These must agree with those in the native C++ implementation.
@@ skipping 90 matching lines @@
     }
     _onWrite = callback;
   }
 
   void set _onWrite(void callback()) {
     _socketWriteHandler = callback;
     // Reset the one-shot onWrite handler.
     _socket.onWrite = _secureWriteHandler;
   }
 
+  void set onBadCertificate(bool callback(X509Certificate certificate)) {
+    if (callback is! Function  && callback != null) {

[Mads Ager (google), 2012/12/05 07:30:53]

Remove extra space before '&&'

+      throw new SocketIOException(
+          "Callback provided to onBadCertificate is not a function or null");
+    }
+    _secureFilter.registerBadCertificateCallback(callback);
+  }
+
   InputStream get inputStream {
     if (_inputStream == null) {
       if (_socketDataHandler != null || _socketCloseHandler != null) {
         throw new StreamException(
             "Cannot get input stream when socket handlers are used");
       }
       _inputStream = new _SocketInputStream(this);
     }
     return _inputStream;
   }
@@ skipping 405 matching lines @@
   external factory _SecureFilter();
 
   void connect(String hostName,
                int port,
                bool is_server,
                String certificateName);
   void destroy();
   void handshake();
   void init();
   int processBuffer(int bufferIndex);
+  void registerBadCertificateCallback(Function callback);
   void registerHandshakeCompleteCallback(Function handshakeCompleteHandler);
 
   List<_ExternalBuffer> get buffers;
 }