Implement Token Binding negotiation TLS extension

net/socket/ssl_client_socket_openssl.h

Index: net/socket/ssl_client_socket_openssl.h
diff --git a/net/socket/ssl_client_socket_openssl.h b/net/socket/ssl_client_socket_openssl.h
index dbceeafa3fc5dbe0dc4f9ae8c4f348dfacd09220..e411b68126e0c645f1f114be05870111c875d121 100644
--- a/net/socket/ssl_client_socket_openssl.h
+++ b/net/socket/ssl_client_socket_openssl.h
@@ -210,6 +210,35 @@ class SSLClientSocketOpenSSL : public SSLClientSocket {
   void OnPrivateKeySignComplete(Error error,
                                 const std::vector<uint8_t>& signature);
 
+  // Token Binding Extension callbacks. RegisterTokenBindingExtensionCallbacks
+  // sets the following static methods as the callbacks for the boringssl custom
+  // extension API. The Add and Parse callbacks are wrappers around the instance
+  // methods; The Free callback is a wrapper around OPENSSL_free.

[davidben, 2015/11/04 00:40:36]

"; The" -> "; the"

Though I'd probably just drop that bit altogether. I don't think readers of the
header file need to know that's what the Free callbacbk is.

[nharper, 2015/11/04 02:28:04]

Done.

+  static bool RegisterTokenBindingExtensionCallbacks(SSL_CTX* ssl_ctx);
+  static int TokenBindingAddCallback(SSL* ssl,
+                                     unsigned int extension_value,
+                                     const uint8_t** out,
+                                     size_t* out_len,
+                                     int* out_alert_value,
+                                     void* add_arg);
+  static void TokenBindingFreeCallback(SSL* ssl,
+                                       unsigned int extension_value,
+                                       const uint8_t* out,
+                                       void* add_arg);
+  static int TokenBindingParseCallback(SSL* ssl,
+                                       unsigned int extension_value,
+                                       const uint8_t* contents,
+                                       size_t contents_len,
+                                       int* out_alert_value,
+                                       void* parse_arg);
+
+  int TokenBindingAdd(const uint8_t** out,
+                      size_t* out_len,
+                      int* out_alert_value);
+  int TokenBindingParse(const uint8_t* contents,
+                        size_t contents_len,
+                        int* out_alert_value);
+
   bool transport_send_busy_;
   bool transport_recv_busy_;
 
@@ -281,6 +310,8 @@ class SSLClientSocketOpenSSL : public SSLClientSocket {
 
   // The service for retrieving Channel ID keys.  May be NULL.
   ChannelIDService* channel_id_service_;
+  bool tb_was_negotiated_;
+  TokenBindingParam tb_negotiated_param_;
 
   // OpenSSL stuff
   SSL* ssl_;