Make OpenSSL UpdateServerCert() OS independent.

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
 #include "net/base/completion_callback.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/socket/ssl_socket.h"
 #include "net/socket/stream_socket.h"
 
 namespace net {
 
 class CertVerifier;
 class CTVerifier;
 class ServerBoundCertService;
 class SSLCertRequestInfo;
 struct SSLConfig;
 class SSLInfo;
 class TransportSecurityState;
+class X509Certificate;
 
 // This struct groups together several fields which are used by various
 // classes related to SSLClientSocket.
 struct SSLClientSocketContext {
   SSLClientSocketContext()
       : cert_verifier(NULL),
         server_bound_cert_service(NULL),
         transport_security_state(NULL),
         cert_transparency_verifier(NULL) {}
 
@@ skipping 119 matching lines @@
       ServerBoundCertService* server_bound_cert_service);
 
  private:
   // For signed_cert_timestamps_received_ and stapled_ocsp_response_received_.
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsEnabledTLSExtension);
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsEnabledOCSP);
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsDisabled);
+  FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
+                           VerifyServerChainProperlyOrdered);
+
+  // Returns the certificate chain as presented by server.
+  // For unit testing only.
+  virtual const scoped_refptr<X509Certificate> GetUnverifiedServerCertificate()

[wtc, 2014/03/10 21:45:34]

1. Nit: change "ServerCertificate" to "ServerCertChain" to make it clear the
returned X509Certificate object also contains the CA certificates presented by
the server.

2. I am not familiar with this aspect of C++, but it seems strange to see a
*private* virtual method. I would think this needs to be protected to allow
subclasses to override this method. Perhaps the "private" keyword just means
only this class can *call* this method, and doesn't care which class can
override this method.

3. Nit: in the comment you may want to point out that the cert returned by the
GetSSLInfo method is a verified certificate chain, which may be different. This
difference may not be obvious to someone unfamiliar with this code.

[Ryan Sleevi, 2014/03/11 00:15:15]

Yeah, seems like this should be protected.

[haavardm, 2014/03/11 18:43:21]

It doesn't have to be protected to allow subclasses to override it, only for
letting subclasses call it. Letting it be private here and public in the
subclass have the affect that you can call the function if you have a instance
of subclass. If you only have a instance of this class you cannot call it. The
idea was that no code having a SSLClientSocketOpenSSL instance should be able to
call GetUnverifiedServerCertificate(), while it could be interesting for
internal socket code to call it when having a nss/openssl instance or one of the
test ssl socket implementations.

I realize it can be a bit confusing though, so I'll make all of them protected
instead.

[haavardm, 2014/03/11 18:43:21]

Done.

+      const = 0;
 
   // True if NPN was responded to, independent of selecting SPDY or HTTP.
   bool was_npn_negotiated_;
   // True if NPN successfully negotiated SPDY.
   bool was_spdy_negotiated_;
   // Protocol that we negotiated with the server.
   NextProto protocol_negotiated_;
   // True if a channel ID was sent.
   bool channel_id_sent_;
   // True if SCTs were received via a TLS extension.
   bool signed_cert_timestamps_received_;
   // True if a stapled OCSP response was received.
   bool stapled_ocsp_response_received_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_