Move certificate verification off the IO thread....

net/base/ssl_client_socket_mac.cc

 // Copyright (c) 2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/ssl_client_socket_mac.h"
 
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_info.h"
@@ skipping 141 matching lines @@
       return errSSLClosedAbort;
     case OK:
       return noErr;
     default:
       LOG(WARNING) << "Unknown error " << net_error <<
           " mapped to errSSLIllegalParam";
       return errSSLIllegalParam;
   }
 }
 
-// Shared with the Windows code. TODO(avi): merge to a common place
-int CertStatusFromNetError(int error) {
-  switch (error) {
-    case ERR_CERT_COMMON_NAME_INVALID:
-      return CERT_STATUS_COMMON_NAME_INVALID;
-    case ERR_CERT_DATE_INVALID:
-      return CERT_STATUS_DATE_INVALID;
-    case ERR_CERT_AUTHORITY_INVALID:
-      return CERT_STATUS_AUTHORITY_INVALID;
-    case ERR_CERT_NO_REVOCATION_MECHANISM:
-      return CERT_STATUS_NO_REVOCATION_MECHANISM;
-    case ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
-      return CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
-    case ERR_CERT_REVOKED:
-      return CERT_STATUS_REVOKED;
-    case ERR_CERT_CONTAINS_ERRORS:
-      NOTREACHED();
-      // Falls through.
-    case ERR_CERT_INVALID:
-      return CERT_STATUS_INVALID;
-    default:
-      return 0;
-  }
-}
-
 // Converts from a cipher suite to its key size. If the suite is marked with a
 // **, it's not actually implemented in Secure Transport and won't be returned
 // (but we'll code for it anyway).  The reference here is
 // http://www.opensource.apple.com/darwinsource/10.5.5/libsecurity_ssl-32463/lib/cipherSpecs.c
 // Seriously, though, there has to be an API for this, but I can't find one.
 // Anybody?
 int KeySizeOfCipherSuite(SSLCipherSuite suite) {
   switch (suite) {
     // SSL 2 only
     
@@ skipping 330 matching lines @@
   // At this point we have a connection. For now, we're going to use the default
   // certificate verification that the system does, and accept its answer for
   // the cert status. In the future, we'll need to call SSLSetEnableCertVerify
   // to disable cert verification and do the verification ourselves. This allows
   // very fine-grained control over what we'll accept for certification.
   // TODO(avi): ditto
   
   // TODO(wtc): for now, always check revocation.
   server_cert_status_ = CERT_STATUS_REV_CHECKING_ENABLED;
   if (net_error)
-    server_cert_status_ |= CertStatusFromNetError(net_error);
+    server_cert_status_ |= MapNetErrorToCertStatus(net_error);
   
   return net_error;
 }
 
 int SSLClientSocketMac::DoReadComplete(int result) {
   if (result < 0)
     return result;
   
   recv_buffer_tail_slop_ -= result;
     
@@ skipping 224 matching lines @@
   if (rv < 0 && rv != ERR_IO_PENDING) {
     return OSStatusFromNetError(rv);
   }
   
   // always lie to our caller
   return noErr;
 }
 
 }  // namespace net