Add support for walking and modifying the CachingCertVerifier

net/cert/caching_cert_verifier.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/caching_cert_verifier.h"
 
 #include "base/time/time.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_trust_anchor_provider.h"
 
@@ skipping 68 matching lines @@
     AddResultToCache(new_params, start_time, *verify_result, result);
   }
 
   return result;
 }
 
 bool CachingCertVerifier::SupportsOCSPStapling() {
   return verifier_->SupportsOCSPStapling();
 }
 
+bool CachingCertVerifier::AddEntry(const RequestParams& params,
+                                   int error,
+                                   const CertVerifyResult& verify_result,
+                                   base::Time verification_time) {
+  // If the cache is full, don't bother.
+  if (cache_.size() == cache_.max_entries())
+    return false;
+
+  // If there is an existing entry, don't bother updating it.
+  const CertVerificationCache::value_type* entry =
+      cache_.Get(params, CacheValidityPeriod(base::Time::Now()));
+  if (entry)
+    return false;
+
+  // Otherwise, go and add it.
+  AddResultToCache(params, verification_time, verify_result, error);
+  return true;
+}
+
 CachingCertVerifier::CachedResult::CachedResult() : error(ERR_FAILED) {}
 
 CachingCertVerifier::CachedResult::~CachedResult() {}
 
 CachingCertVerifier::CacheValidityPeriod::CacheValidityPeriod(base::Time now)
     : verification_time(now), expiration_time(now) {}
 
 CachingCertVerifier::CacheValidityPeriod::CacheValidityPeriod(
     base::Time now,
     base::Time expiration)
@@ skipping 75 matching lines @@
   // invalid result for kTTLSecs.
   CachedResult cached_result;
   cached_result.error = error;
   cached_result.result = verify_result;
   cache_.Put(
       params, cached_result, CacheValidityPeriod(start_time),
       CacheValidityPeriod(start_time,
                           start_time + base::TimeDelta::FromSeconds(kTTLSecs)));
 }
 
+void CachingCertVerifier::VisitEntries(CacheVisitor* visitor) {
+  DCHECK(visitor);
+
+  CacheValidityPeriod now(base::Time::Now());
+  CacheExpirationFunctor expiration_cmp;
+
+  using Iter = CertVerificationCache::Iterator;
+  Iter it(cache_);

[eroman, 2016/06/16 00:25:04]

optional: Move the definition of "it" into the for loop. Does that work with
ctor?

+  for (; it.HasNext(); it.Advance()) {
+    if (!expiration_cmp(now, it.expiration()))
+      continue;
+    if (!visitor->VisitEntry(it.key(), it.value().error, it.value().result,
+                             it.expiration().verification_time,
+                             it.expiration().expiration_time)) {
+      break;
+    }
+  }
+}
+
 void CachingCertVerifier::OnCACertChanged(const X509Certificate* cert) {
   ClearCache();
 }
 
 void CachingCertVerifier::ClearCache() {
   cache_.Clear();
 }
 
 size_t CachingCertVerifier::GetCacheSize() const {
   return cache_.size();
 }
 
 }  // namespace net