Set Token-Binding HTTP header

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <stdint.h>
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
+#include "crypto/ec_private_key.h"

[davidben, 2016/01/22 00:19:21]

Can be forward-declared.

[nharper, 2016/01/22 19:36:52]

Done.

 #include "net/base/completion_callback.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/socket/ssl_socket.h"
 #include "net/socket/stream_socket.h"
 #include "net/ssl/ssl_failure_state.h"
 
 namespace base {
 class FilePath;
 class SequencedTaskRunner;
@@ skipping 114 matching lines @@
   static bool IgnoreCertError(int error, int load_flags);
 
   // ClearSessionCache clears the SSL session cache, used to resume SSL
   // sessions.
   static void ClearSessionCache();
 
   // Returns the ChannelIDService used by this socket, or NULL if
   // channel ids are not supported.
   virtual ChannelIDService* GetChannelIDService() const = 0;
 
+  // Signs the EKM value for Token Binding with |*key| and puts it in |*out|.
+  // Returns a net error code of ERR_FAILED or OK.

[davidben, 2016/01/22 00:19:21]

Nit: Also returns ERR_NOT_IMPLEMENTED, strictly speaking. Maybe have it return
an Error and then the type system catures it?

[nharper, 2016/01/22 19:36:52]

Done. I also changed the same method in HttpStream to return an Error instead of
an int (since I'm not returning a non-Error value with my int).

+  virtual int GetSignedEKMForTokenBinding(crypto::ECPrivateKey* key,
+                                          std::vector<uint8_t>* out) = 0;
+
   // Returns the state of the handshake when it failed, or |SSL_FAILURE_NONE| if
   // the handshake succeeded. This is used to classify causes of the TLS version
   // fallback.
   virtual SSLFailureState GetSSLFailureState() const = 0;
 
  protected:
   void set_negotiation_extension(
       SSLNegotiationExtension negotiation_extension) {
     negotiation_extension_ = negotiation_extension;
   }
@@ skipping 54 matching lines @@
   bool signed_cert_timestamps_received_;
   // True if a stapled OCSP response was received.
   bool stapled_ocsp_response_received_;
   // Protocol negotiation extension used.
   SSLNegotiationExtension negotiation_extension_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_