Make OpenSSL UpdateServerCert() OS independent.

net/socket/ssl_client_socket_nss.h

Index: net/socket/ssl_client_socket_nss.h
diff --git a/net/socket/ssl_client_socket_nss.h b/net/socket/ssl_client_socket_nss.h
index 47fed74d9d3361f131840b487e0971929b224b9f..659c5c4fda9872ac259d9102293f62e34982cf60 100644
--- a/net/socket/ssl_client_socket_nss.h
+++ b/net/socket/ssl_client_socket_nss.h
@@ -106,6 +106,11 @@ class SSLClientSocketNSS : public SSLClientSocket {
   virtual bool SetSendBufferSize(int32 size) OVERRIDE;
   virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
 
+ protected:
+  // SSLClientSocket implementation.
+  virtual const X509Certificate* GetUnverifiedServerCertificateChain() const

[Ryan Sleevi, 2014/03/12 23:12:03]

Don't return raw pointers to ref-counted types. It can actually lead to subtle
UAF (there in fact was a rather ugly one with an internal function that returned
an X509Certificate* - even though it was immediatedly placed into a
scoped_refptr)

either "const scoped_refptr<X509Certificate>&" (if it's always stored) or
"scoped_refptr<X509Certificate>" (if not). X509Certificates themselves are
immutable.

[haavardm, 2014/03/13 10:32:02]

OK.  Didn't realize X509Certificate was immutable. My thinking was that one
never takes ownership or passes on const pointers unless it is  documented. The
Mock implementations  returns NULL, so I'll change to
scoped_refptr<X509Certificate>.

+      OVERRIDE;
+
  private:
   // Helper class to handle marshalling any NSS interaction to and from the
   // NSS and network task runners. Not every call needs to happen on the Core