Enable SSLClientSocketTest unit tests on Mac OS X by implementing our own cer...

net/base/x509_certificate.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 
 #include <string.h>
 
 #include <map>
@@ skipping 191 matching lines @@
   // Gets the DNS names in the certificate.  Pursuant to RFC 2818, Section 3.1
   // Server Identity, if the certificate has a subjectAltName extension of
   // type dNSName, this method gets the DNS names in that extension.
   // Otherwise, it gets the common name in the subject field.
   void GetDNSNames(std::vector<std::string>* dns_names) const;
 
   // Convenience method that returns whether this certificate has expired as of
   // now.
   bool HasExpired() const;
 
+#if defined(OS_MACOSX)
+    // Adds an untrusted intermediate certificate that may be needed for

[wtc, 2009/08/27 00:14:18]

Nit: Fix indentation.

+    // chain building.
+    void AddIntermediateCertificate(SecCertificateRef cert);
+#endif
+
   // Verifies the certificate against the given hostname.  Returns OK if
   // successful or an error code upon failure.
   //
   // The |*verify_result| structure, including the |verify_result->cert_status|
   // bitmask, is always filled out regardless of the return value.  If the
   // certificate has multiple errors, the corresponding status flags are set in
   // |verify_result->cert_status|, and the error code for the most serious
   // error is returned.
   //
   // |flags| is bitwise OR'd of VerifyFlags.
@@ skipping 70 matching lines @@
 
   // This certificate is not valid after |valid_expiry_|
   base::Time valid_expiry_;
 
   // The fingerprint of this certificate.
   Fingerprint fingerprint_;
 
   // A handle to the certificate object in the underlying crypto library.
   OSCertHandle cert_handle_;
 
+#if defined(OS_MACOSX)
+    // Untrusted intermediate certificates associated with this certificate
+    // that may be needed for chain building.
+    CFMutableArrayRef intermediate_ca_certs_;

[wtc, 2009/08/27 00:14:18]

intermediate_certs_ is fine.  I found that Mac OS X
documentation uses the term "intermediate certificate",
so I'm now used to this term.

But actually, why don't we just stick the CFArrayRef
returned by SSLCopyPeerCertificates here as
  CFArrayRef cert_chain_;

Then we can just pass the cert_chain_ member directly
to SecTrustCreateWithCertificates in X509Certificate::Verify.
This avoids the calls to AddIntermediateCertificate
and rebuilding cert_array from intermediate_ca_certs_.

+#endif
+
   // Where the certificate comes from.
   Source source_;
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_