Make OpenSSL UpdateServerCert() OS independent.

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
 #include "net/base/completion_callback.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/socket/ssl_socket.h"
 #include "net/socket/stream_socket.h"
 
 namespace net {
 
 class CertVerifier;
 class CTVerifier;
 class ServerBoundCertService;
 class SSLCertRequestInfo;
 struct SSLConfig;
 class SSLInfo;
 class TransportSecurityState;
+class X509Certificate;
 
 // This struct groups together several fields which are used by various
 // classes related to SSLClientSocket.
 struct SSLClientSocketContext {
   SSLClientSocketContext()
       : cert_verifier(NULL),
         server_bound_cert_service(NULL),
         transport_security_state(NULL),
         cert_transparency_verifier(NULL) {}
 
@@ skipping 111 matching lines @@
       ServerBoundCertService* server_bound_cert_service,
       bool negotiated_channel_id,
       bool channel_id_enabled,
       bool supports_ecc);
 
   // Returns whether TLS channel ID is enabled.
   static bool IsChannelIDEnabled(
       const SSLConfig& ssl_config,
       ServerBoundCertService* server_bound_cert_service);
 
+  // For unit testing only.
+  // Returns the unverified certificate chain as presented by server.
+  // Note that chain may be different than the verified chain returned by
+  // StreamSocket::GetSSLInfo().
+  virtual scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
+      const = 0;
+
  private:
   // For signed_cert_timestamps_received_ and stapled_ocsp_response_received_.
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsEnabledTLSExtension);
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsEnabledOCSP);
   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
                            ConnectSignedCertTimestampsDisabled);
+  FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
+                           VerifyServerChainProperlyOrdered);
 
   // True if NPN was responded to, independent of selecting SPDY or HTTP.
   bool was_npn_negotiated_;
   // True if NPN successfully negotiated SPDY.
   bool was_spdy_negotiated_;
   // Protocol that we negotiated with the server.
   NextProto protocol_negotiated_;
   // True if a channel ID was sent.
   bool channel_id_sent_;
   // True if SCTs were received via a TLS extension.
   bool signed_cert_timestamps_received_;
   // True if a stapled OCSP response was received.
   bool stapled_ocsp_response_received_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_