Stop caching DER-encoded certificates unnecessarily

remoting/protocol/ssl_hmac_channel_authenticator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/protocol/ssl_hmac_channel_authenticator.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 240 matching lines @@
   if (is_ssl_server()) {
 #if defined(OS_NACL)
     // Client plugin doesn't use server SSL sockets, and so SSLServerSocket
     // implementation is not compiled for NaCl as part of net_nacl.
     NOTREACHED();
     result = net::ERR_FAILED;
 #else
     scoped_refptr<net::X509Certificate> cert =
         net::X509Certificate::CreateFromBytes(local_cert_.data(),
                                               local_cert_.length());
-    if (!cert.get()) {
+    if (!cert) {
       LOG(ERROR) << "Failed to parse X509Certificate";
       NotifyError(net::ERR_FAILED);
       return;
     }
 
     net::SSLServerConfig ssl_config;
     ssl_config.require_ecdhe = true;
 
     server_context_ = net::CreateSSLServerContext(
         cert.get(), *local_key_pair_->private_key(), ssl_config);
 
     std::unique_ptr<net::SSLServerSocket> server_socket =
         server_context_->CreateSSLServerSocket(
             base::MakeUnique<NetStreamSocketAdapter>(std::move(socket)));
     net::SSLServerSocket* raw_server_socket = server_socket.get();
     socket_ = std::move(server_socket);
     result = raw_server_socket->Handshake(
         base::Bind(&SslHmacChannelAuthenticator::OnConnected,
                    base::Unretained(this)));
 #endif
   } else {
     transport_security_state_.reset(new net::TransportSecurityState);
     cert_verifier_.reset(new FailingCertVerifier);
     ct_verifier_.reset(new IgnoresCTVerifier);
     ct_policy_enforcer_.reset(new IgnoresCTPolicyEnforcer);
 
-    net::SSLConfig::CertAndStatus cert_and_status;
-    cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID;
-    cert_and_status.der_cert = remote_cert_;
-
     net::SSLConfig ssl_config;
     // Certificate verification and revocation checking are not needed
     // because we use self-signed certs. Disable it so that the SSL
     // layer doesn't try to initialize OCSP (OCSP works only on the IO
     // thread).
     ssl_config.cert_io_enabled = false;
     ssl_config.rev_checking_enabled = false;
-    ssl_config.allowed_bad_certs.push_back(cert_and_status);
     ssl_config.require_ecdhe = true;
 
+    scoped_refptr<net::X509Certificate> cert =
+        net::X509Certificate::CreateFromBytes(remote_cert_.data(),
+                                              remote_cert_.length());
+    if (!cert) {
+      LOG(ERROR) << "Failed to parse X509Certificate";
+      NotifyError(net::ERR_FAILED);
+      return;
+    }
+
+    net::SSLConfig::CertAndStatus cert_and_status;
+    cert_and_status.cert = std::move(cert);
+    cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID;
+    ssl_config.allowed_bad_certs.emplace_back(std::move(cert_and_status));

[davidben, 2016/09/01 19:44:40]

Ditto

+
     net::HostPortPair host_and_port(kSslFakeHostName, 0);
     net::SSLClientSocketContext context;
     context.transport_security_state = transport_security_state_.get();
     context.cert_verifier = cert_verifier_.get();
     context.cert_transparency_verifier = ct_verifier_.get();
     context.ct_policy_enforcer = ct_policy_enforcer_.get();
     std::unique_ptr<net::ClientSocketHandle> socket_handle(
         new net::ClientSocketHandle);
     socket_handle->SetSocket(
         base::MakeUnique<NetStreamSocketAdapter>(std::move(socket)));
@@ skipping 168 matching lines @@
                           std::move(socket_), std::move(server_context_)));
   }
 }
 
 void SslHmacChannelAuthenticator::NotifyError(int error) {
   base::ResetAndReturn(&done_callback_).Run(error, nullptr);
 }
 
 }  // namespace protocol
 }  // namespace remoting