OpenSSL/NSS implementation of ProofVerfifier.

net/quic/crypto/proof_verifier.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_QUIC_CRYPTO_PROOF_VERIFIER_H_
 #define NET_QUIC_CRYPTO_PROOF_VERIFIER_H_
 
 #include <string>
 #include <vector>
 
+#include "net/base/completion_callback.h"
 #include "net/base/net_export.h"
 
 namespace net {
 
 // A ProofVerifier checks the signature on a server config, and the certificate
 // chain that backs the public key.
 class NET_EXPORT_PRIVATE ProofVerifier {
  public:
   virtual ~ProofVerifier() {}
 
   // VerifyProof checks that |signature| is a valid signature of
   // |server_config| by the public key in the leaf certificate of |certs|, and
-  // that |certs| is a valid chain for |hostname|. On success, it returns true.
+  // that |certs| is a valid chain for |hostname|. On success, it returns OK.
   // On failure, it returns false and sets |*error_details| to a description of
-  // the problem.
+  // the problem and returns ERR_FAILED.

[wtc, 2013/06/24 22:36:56]

"returns ERR_FAILED" should replace the "returns false" on the previous line.

We also need to add comments to document the |callback| argument and the
async behavior (the function may return ERR_IO_PENDING, in which case the
|callback| will be run with the final OK/ERR_FAILED result when the proof is
verified).

[ramant (doing other things), 2013/06/28 19:16:56]

Done.

   //
   // The signature uses SHA-256 as the hash function and PSS padding in the
   // case of RSA.
   //
   // Note: this is just for testing. The CN of the certificate is ignored and
   // wildcards in the SANs are not supported.
-  virtual bool VerifyProof(const std::string& hostname,
-                           const std::string& server_config,
-                           const std::vector<std::string>& certs,
-                           const std::string& signature,
-                           std::string* error_details) const = 0;
+  virtual int VerifyProof(const std::string& hostname,
+                          const std::string& server_config,
+                          const std::vector<std::string>& certs,
+                          const std::string& signature,
+                          const CompletionCallback& callback,

[wtc, 2013/06/24 22:36:56]

The |callback| argument seems to be the last argument by convention.
Could you check some other methods in net that take a |callback| argument?
Thanks.

[ramant (doing other things), 2013/06/28 19:16:56]

./socket/client_socket_pool_manager.h:106, socet_test_util.h and others don't
seem to follow that convention (they have callback argument in the middle).
Should I change it? thanks.

+                          std::string* error_details) = 0;
 };
 
 }  // namespace net
 
 #endif  // NET_QUIC_CRYPTO_PROOF_VERIFIER_H_