Move certificate verification off the IO thread....

net/base/ssl_client_socket_win.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_SSL_CLIENT_SOCKET_WIN_H_
 #define NET_BASE_SSL_CLIENT_SOCKET_WIN_H_
 
 #define SECURITY_WIN32  // Needs to be defined before including security.h
 
 #include <windows.h>
 #include <wincrypt.h>
 #include <security.h>
 
 #include <string>
 
 #include "base/scoped_ptr.h"
+#include "net/base/cert_verifier.h"
+#include "net/base/cert_verify_result.h"
 #include "net/base/completion_callback.h"
 #include "net/base/ssl_client_socket.h"
 #include "net/base/ssl_config_service.h"
 
 namespace net {
 
 // An SSL client socket implemented with the Windows Schannel.
 class SSLClientSocketWin : public SSLClientSocket {
  public:
   // Takes ownership of the transport_socket, which may already be connected.
@@ skipping 22 matching lines @@
   void DoCallback(int result);
   void OnIOComplete(int result);
 
   int DoLoop(int last_io_result);
   int DoConnect();
   int DoConnectComplete(int result);
   int DoHandshakeRead();
   int DoHandshakeReadComplete(int result);
   int DoHandshakeWrite();
   int DoHandshakeWriteComplete(int result);
+  int DoVerifyCert();
+  int DoVerifyCertComplete(int result);
   int DoPayloadRead();
   int DoPayloadReadComplete(int result);
   int DoPayloadEncrypt();
   int DoPayloadWrite();
   int DoPayloadWriteComplete(int result);
 
   int DidCompleteHandshake();
-  static void LogConnectionTypeMetrics(PCCERT_CHAIN_CONTEXT chain_context);
-  int VerifyServerCert();
+  void LogConnectionTypeMetrics() const;
 
   CompletionCallbackImpl<SSLClientSocketWin> io_callback_;
   scoped_ptr<ClientSocket> transport_;
   std::string hostname_;
   SSLConfig ssl_config_;
 
   CompletionCallback* user_callback_;
 
   // Used by both Read and Write functions.
   char* user_buf_;
   int user_buf_len_;
 
   enum State {
     STATE_NONE,
     STATE_CONNECT,
     STATE_CONNECT_COMPLETE,
     STATE_HANDSHAKE_READ,
     STATE_HANDSHAKE_READ_COMPLETE,
     STATE_HANDSHAKE_WRITE,
     STATE_HANDSHAKE_WRITE_COMPLETE,
+    STATE_VERIFY_CERT,
+    STATE_VERIFY_CERT_COMPLETE,
     STATE_PAYLOAD_ENCRYPT,
     STATE_PAYLOAD_WRITE,
     STATE_PAYLOAD_WRITE_COMPLETE,
     STATE_PAYLOAD_READ,
     STATE_PAYLOAD_READ_COMPLETE,
   };
   State next_state_;
 
   SecPkgContext_StreamSizes stream_sizes_;
   PCCERT_CONTEXT server_cert_;
-  int server_cert_status_;
+  CertVerifier verifier_;
+  CertVerifyResult server_cert_verify_result_;
 
   CredHandle* creds_;
   CtxtHandle ctxt_;
   SecBuffer send_buffer_;
   scoped_array<char> payload_send_buffer_;
   int payload_send_buffer_len_;
   int bytes_sent_;
 
   // recv_buffer_ holds the received ciphertext.  Since Schannel decrypts
   // data in place, sometimes recv_buffer_ may contain decrypted plaintext and
@@ skipping 23 matching lines @@
   bool ignore_ok_result_;
 
   // True if the user has no client certificate.
   bool no_client_cert_;
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_SSL_CLIENT_SOCKET_WIN_H_