Make OpenSSL UpdateServerCert() OS independent.

net/socket/ssl_client_socket_openssl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 
 #include <string>
 
 #include "base/compiler_specific.h"
@@ skipping 13 matching lines @@
 // <openssl/evp.h>
 typedef struct evp_pkey_st EVP_PKEY;
 // <openssl/ssl.h>
 typedef struct ssl_st SSL;
 // <openssl/x509.h>
 typedef struct x509_st X509;
 
 namespace net {
 
 class CertVerifier;
+class PeerCertificateChain;

[wtc, 2014/03/10 21:45:34]

This class is in the net namespace and is defined in the
ssl_client_socket_openssl.cc file. This is uncommon in the Chromium source tree.
Usually we would nest this kind of class inside SSLClientSocketOpenSSL.

[haavardm, 2014/03/11 18:43:21]

Done.

 class SingleRequestCertVerifier;
 class SSLCertRequestInfo;
 class SSLInfo;
 
 // An SSL client socket implemented with OpenSSL.
 class SSLClientSocketOpenSSL : public SSLClientSocket {
  public:
   // Takes ownership of the transport_socket, which may already be connected.
   // The given hostname will be compared with the name(s) in the server's
   // certificate during the SSL handshake.  ssl_config specifies the SSL
   // settings.
   SSLClientSocketOpenSSL(scoped_ptr<ClientSocketHandle> transport_socket,
                          const HostPortPair& host_and_port,
                          const SSLConfig& ssl_config,
                          const SSLClientSocketContext& context);
   virtual ~SSLClientSocketOpenSSL();
 
   const HostPortPair& host_and_port() const { return host_and_port_; }
   const std::string& ssl_session_cache_shard() const {
     return ssl_session_cache_shard_;
   }
 
   // SSLClientSocket implementation.
   virtual void GetSSLCertRequestInfo(
       SSLCertRequestInfo* cert_request_info) OVERRIDE;
   virtual NextProtoStatus GetNextProto(std::string* proto,
                                        std::string* server_protos) OVERRIDE;
   virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
+  // For unit testing only.
+  virtual const scoped_refptr<X509Certificate> GetUnverifiedServerCertificate()

[wtc, 2014/03/10 21:45:34]

Here you list the method under an "SSLClientSocket implementation" section
correctly. So the only issue is whether this method should be public or private.

[Ryan Sleevi, 2014/03/11 00:15:15]

Yeah, not a fan of exposing this publicly.

[haavardm, 2014/03/11 18:43:21]

Done.

+      const OVERRIDE;
 
   // SSLSocket implementation.
   virtual int ExportKeyingMaterial(const base::StringPiece& label,
                                    bool has_context,
                                    const base::StringPiece& context,
                                    unsigned char* out,
                                    unsigned int outlen) OVERRIDE;
   virtual int GetTLSUniqueChannelBinding(std::string* out) OVERRIDE;
 
   // StreamSocket implementation.
@@ skipping 90 matching lines @@
   // the result to return on the *next* call to DoPayloadRead().  A value > 0
   // indicates there is no pending result, otherwise 0 indicates EOF and < 0
   // indicates an error.
   int pending_read_error_;
 
   // Used by TransportWriteComplete() and TransportReadComplete() to signify an
   // error writing to the transport socket. A value of OK indicates no error.
   int transport_write_error_;
 
   // Set when handshake finishes.
+  scoped_ptr<PeerCertificateChain> server_cert_chain_;
   scoped_refptr<X509Certificate> server_cert_;
   CertVerifyResult server_cert_verify_result_;
   bool completed_handshake_;
 
   // Stores client authentication information between ClientAuthHandler and
   // GetSSLCertRequestInfo calls.
   bool client_auth_cert_needed_;
   // List of DER-encoded X.509 DistinguishedName of certificate authorities
   // allowed by the server.
   std::vector<std::string> cert_authorities_;
@@ skipping 37 matching lines @@
   // True if channel ID extension was negotiated.
   bool channel_id_xtn_negotiated_;
   // The request handle for |server_bound_cert_service_|.
   ServerBoundCertService::RequestHandle channel_id_request_handle_;
   BoundNetLog net_log_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_