Move certificate verification off the IO thread....

net/base/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/ssl_client_socket_nss.h"
 
 #include <nspr.h>
 #include <nss.h>
 #include <secerr.h>
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
@@ skipping 82 matching lines @@
             " mapped to net::ERR_CERT_INVALID";
         return ERR_CERT_INVALID;
       }
       LOG(WARNING) << "Unknown error " << err <<
           " mapped to net::ERR_FAILED";
       return ERR_FAILED;
     }
   }
 }
 
-// Shared with the Windows code. TODO(avi): merge to a common place
-int CertStatusFromNetError(int error) {
-  switch (error) {
-    case ERR_CERT_COMMON_NAME_INVALID:
-      return CERT_STATUS_COMMON_NAME_INVALID;
-    case ERR_CERT_DATE_INVALID:
-      return CERT_STATUS_DATE_INVALID;
-    case ERR_CERT_AUTHORITY_INVALID:
-      return CERT_STATUS_AUTHORITY_INVALID;
-    case ERR_CERT_NO_REVOCATION_MECHANISM:
-      return CERT_STATUS_NO_REVOCATION_MECHANISM;
-    case ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
-      return CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
-    case ERR_CERT_REVOKED:
-      return CERT_STATUS_REVOKED;
-    case ERR_CERT_CONTAINS_ERRORS:
-      NOTREACHED();
-      // Falls through.
-    case ERR_CERT_INVALID:
-      return CERT_STATUS_INVALID;
-    default:
-      return 0;
-  }
-}
-
 }  // namespace
 
 bool SSLClientSocketNSS::nss_options_initialized_ = false;
 
 SSLClientSocketNSS::SSLClientSocketNSS(ClientSocket* transport_socket,
                                        const std::string& hostname,
                                        const SSLConfig& ssl_config)
     :
       buffer_send_callback_(this, &SSLClientSocketNSS::BufferSendComplete),
       buffer_recv_callback_(this, &SSLClientSocketNSS::BufferRecvComplete),
@@ skipping 393 matching lines @@
     // Indicate we're ready to handle I/O.  Badly named?
     GotoState(STATE_NONE);
   } else {
     PRErrorCode prerr = PR_GetError();
     net_error = NetErrorFromNSPRError(prerr);
 
     // If not done, stay in this state
     if (net_error == ERR_IO_PENDING) {
       GotoState(STATE_HANDSHAKE_READ);
     } else {
-      server_cert_status_ = CertStatusFromNetError(net_error);
+      server_cert_status_ = MapNetErrorToCertStatus(net_error);
       LOG(ERROR) << "handshake failed; NSS error code " << prerr
                  << ", net_error " << net_error << ", server_cert_status "
                  << server_cert_status_;
     }
   }
 
   LeaveFunction("");
   return net_error;
 }
 
@@ skipping 31 matching lines @@
     GotoState(STATE_PAYLOAD_WRITE);
     return ERR_IO_PENDING;
   }
   user_buf_ = NULL;
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net