WKWebView: Added cert verification API to web controller.

ios/web/net/cert_verifier_block_adapter.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ios/web/net/cert_verifier_block_adapter.h"
 
 #include "base/mac/bind_objc_block.h"
 #include "net/base/net_errors.h"
-#include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
 #include "net/cert/x509_certificate.h"
+#include "net/log/net_log.h"
 
 namespace net {
 
 namespace {
 
-// Resource manager which keeps CertVerifier::Request, CertVerifyResult and
-// X509Certificate alive until verification is completed.
-struct VerificationContext : public base::RefCounted<VerificationContext> {
-  VerificationContext(scoped_refptr<net::X509Certificate> cert) : cert(cert) {
-    result.cert_status = CERT_STATUS_INVALID;
-  }
-  // Verification request. Must be alive until verification is completed,
-  // otherwise it will be cancelled.
-  scoped_ptr<CertVerifier::Request> request;
+// Resource manager which keeps CertVerifyResult, X509Certificate and
+// BoundNetLog alive until verification is completed. Also holds unowned pointer
+// to |CertVerifier::Request|.
+struct VerificationContext
+    : public base::RefCountedThreadSafe<VerificationContext> {
+  VerificationContext(scoped_refptr<net::X509Certificate> cert, NetLog* net_log)
+      : request(nullptr),
+        cert(cert),

[Ryan Sleevi, 2015/08/14 02:29:43]

cert.Pass()

[Eugene But (OOO till 7-30), 2015/08/14 21:18:19]

Done.

+        net_log(
+            BoundNetLog::Make(net_log, NetLog::IOS_WEB_VIEW_CERT_VERIFIER)) {}
+  // Unowned verification request.
+  CertVerifier::Request* request;
   // The result of certificate verification.
-  CertVerifyResult result;
+  CertVerifyResult cert_verify_result;
   // Certificate being verificated.
   scoped_refptr<net::X509Certificate> cert;
-
-  // Copies CertVerifyResult and wraps it into a scoped_ptr.
-  scoped_ptr<CertVerifyResult> scoped_result() {
-    scoped_ptr<CertVerifyResult> scoped_result(new CertVerifyResult());
-    scoped_result->CopyFrom(result);
-    return scoped_result.Pass();
-  }
+  // BoundNetLog required by CertVerifier.
+  BoundNetLog net_log;
 
  private:
   VerificationContext() = delete;
   // Required by base::RefCounted.
-  friend class base::RefCounted<VerificationContext>;
+  friend class base::RefCountedThreadSafe<VerificationContext>;

[Ryan Sleevi, 2015/08/14 02:29:43]

This should be the first (e.g. on line 37, after line 36). Comment is
unnecessary (and out of date)

[Eugene But (OOO till 7-30), 2015/08/14 21:18:19]

Done.

   ~VerificationContext() {}
 };
 }
 
-CertVerifierBlockAdapter::CertVerifierBlockAdapter()
-    : CertVerifierBlockAdapter(
-          scoped_ptr<CertVerifier>(CertVerifier::CreateDefault())) {
-}
-
-CertVerifierBlockAdapter::CertVerifierBlockAdapter(
-    scoped_ptr<CertVerifier> cert_verifier)
-    : cert_verifier_(cert_verifier.Pass()) {
+CertVerifierBlockAdapter::CertVerifierBlockAdapter(CertVerifier* cert_verifier,
+                                                   NetLog* net_log)
+    : cert_verifier_(cert_verifier), net_log_(net_log) {
   DCHECK(cert_verifier_);
+  DCHECK(net_log_);
 }
 
 CertVerifierBlockAdapter::~CertVerifierBlockAdapter() {
+  DCHECK(thread_checker_.CalledOnValidThread());
 }
 
-CertVerifierBlockAdapter::Params::Params(scoped_refptr<X509Certificate> cert,
-                                         const std::string& hostname)
-    : cert(cert),
-      hostname(hostname),
-      flags(static_cast<CertVerifier::VerifyFlags>(0)) {
-}
+CertVerifierBlockAdapter::Params::Params(
+    const scoped_refptr<X509Certificate>& cert,
+    const std::string& hostname)
+    : cert(cert), hostname(hostname), flags(0) {}
 
 CertVerifierBlockAdapter::Params::~Params() {
 }
 
 void CertVerifierBlockAdapter::Verify(
     const Params& params,
-    void (^completion_handler)(scoped_ptr<CertVerifyResult>, int)) {
+    void (^completion_handler)(CertVerifyResult, int)) {
+  DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(completion_handler);
+  if (!params.cert || params.hostname.empty()) {
+    completion_handler(CertVerifyResult(), ERR_INVALID_ARGUMENT);
+    return;
+  }
 
   scoped_refptr<VerificationContext> context(
-      new VerificationContext(params.cert));
-  CompletionCallback callback = base::BindBlock(^(int) {
-    completion_handler(context->scoped_result(), 0);
+      new VerificationContext(params.cert, net_log_));
+  CompletionCallback callback = base::BindBlock(^(int status_result) {
+    // Remove pending request.
+    auto request_iterator = std::find(
+        pending_requests_.begin(), pending_requests_.end(), context->request);
+    DCHECK(pending_requests_.end() != request_iterator);
+    pending_requests_.erase(request_iterator);
+
+    completion_handler(context->cert_verify_result, status_result);
   });
-  int status = cert_verifier_->Verify(params.cert.get(), params.hostname,
-                                      params.ocsp_response, params.flags,
-                                      params.crl_set.get(), &(context->result),
-                                      callback, &(context->request), net_log_);
-
-  if (status == ERR_IO_PENDING) {
+  scoped_ptr<CertVerifier::Request> request(new CertVerifier::Request);
+  int status_result = cert_verifier_->Verify(
+      params.cert.get(), params.hostname, params.ocsp_response, params.flags,
+      params.crl_set.get(), &(context->cert_verify_result), callback, &request,
+      context->net_log);
+  if (status_result == ERR_IO_PENDING) {
+    // Make sure that |CertVerifier::Request| is alive until either verification
+    // is completed or CertVerifierBlockAdapter is destroyed.
+    pending_requests_.push_back(request.Pass());
+    context->request = pending_requests_.back();
     // Completion handler will be called from |callback| when verification
     // request is completed.
     return;
   }
 
   // Verification has either failed or result was retrieved from the cache.
-  completion_handler(status ? nullptr : context->scoped_result(), status);
+  completion_handler(context->cert_verify_result, status_result);
 }
 
 }  // net