clang-format runtime/bin

runtime/bin/secure_socket_ios.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED)
 
 #include "platform/globals.h"
 #if TARGET_OS_IOS
 
 #include "bin/secure_socket.h"
@@ skipping 56 matching lines @@
   return success ? result : NULL;
 }
 
 
 // Handle an error reported from the SecureTransport library.
 static void ThrowIOException(OSStatus status,
                              const char* exception_type,
                              const char* message) {
   TextBuffer status_message(SSL_ERROR_MESSAGE_BUFFER_SIZE);
   status_message.Printf("OSStatus = %ld: https://www.osstatus.com",
-      static_cast<intptr_t>(status));
+                        static_cast<intptr_t>(status));
   OSError os_error_struct(status, status_message.buf(), OSError::kBoringSSL);
   Dart_Handle os_error = DartUtils::NewDartOSError(&os_error_struct);
   Dart_Handle exception =
       DartUtils::NewDartIOException(exception_type, message, os_error);
   ASSERT(!Dart_IsError(exception));
   Dart_ThrowException(exception);
   UNREACHABLE();
 }
 
 
 static void CheckStatus(OSStatus status,
                         const char* type,
                         const char* message) {
   if (status == noErr) {
     return;
   }
   ThrowIOException(status, type, message);
 }
 
 
 static SSLFilter* GetFilter(Dart_NativeArguments args) {
   SSLFilter* filter;
   Dart_Handle dart_this = ThrowIfError(Dart_GetNativeArgument(args, 0));
   ASSERT(Dart_IsInstance(dart_this));
-  ThrowIfError(Dart_GetNativeInstanceField(
-      dart_this,
-      kSSLFilterNativeFieldIndex,
-      reinterpret_cast<intptr_t*>(&filter)));
+  ThrowIfError(
+      Dart_GetNativeInstanceField(dart_this, kSSLFilterNativeFieldIndex,
+                                  reinterpret_cast<intptr_t*>(&filter)));
   return filter;
 }
 
 
 static void DeleteFilter(void* isolate_data,
                          Dart_WeakPersistentHandle handle,
                          void* context_pointer) {
   SSLFilter* filter = reinterpret_cast<SSLFilter*>(context_pointer);
   filter->Release();
 }
 
 
 static Dart_Handle SetFilter(Dart_NativeArguments args, SSLFilter* filter) {
   ASSERT(filter != NULL);
   const int approximate_size_of_filter = 1500;
   Dart_Handle dart_this = Dart_GetNativeArgument(args, 0);
   RETURN_IF_ERROR(dart_this);
   ASSERT(Dart_IsInstance(dart_this));
-  Dart_Handle err = Dart_SetNativeInstanceField(
-      dart_this,
-      kSSLFilterNativeFieldIndex,
-      reinterpret_cast<intptr_t>(filter));
+  Dart_Handle err =
+      Dart_SetNativeInstanceField(dart_this, kSSLFilterNativeFieldIndex,
+                                  reinterpret_cast<intptr_t>(filter));
   RETURN_IF_ERROR(err);
-  Dart_NewWeakPersistentHandle(dart_this,
-                               reinterpret_cast<void*>(filter),
-                               approximate_size_of_filter,
-                               DeleteFilter);
+  Dart_NewWeakPersistentHandle(dart_this, reinterpret_cast<void*>(filter),
+                               approximate_size_of_filter, DeleteFilter);
   return Dart_Null();
 }
 
 
 static SSLCertContext* GetSecurityContext(Dart_NativeArguments args) {
   SSLCertContext* context;
   Dart_Handle dart_this = ThrowIfError(Dart_GetNativeArgument(args, 0));
   ASSERT(Dart_IsInstance(dart_this));
-  ThrowIfError(Dart_GetNativeInstanceField(
-      dart_this,
-      kSecurityContextNativeFieldIndex,
-      reinterpret_cast<intptr_t*>(&context)));
+  ThrowIfError(
+      Dart_GetNativeInstanceField(dart_this, kSecurityContextNativeFieldIndex,
+                                  reinterpret_cast<intptr_t*>(&context)));
   return context;
 }
 
 
 static void DeleteCertContext(void* isolate_data,
                               Dart_WeakPersistentHandle handle,
                               void* context_pointer) {
   SSLCertContext* context = static_cast<SSLCertContext*>(context_pointer);
   context->Release();
 }
 
 
 static Dart_Handle SetSecurityContext(Dart_NativeArguments args,
                                       SSLCertContext* context) {
   const int approximate_size_of_context = 1500;
   Dart_Handle dart_this = Dart_GetNativeArgument(args, 0);
   RETURN_IF_ERROR(dart_this);
   ASSERT(Dart_IsInstance(dart_this));
-  Dart_Handle err = Dart_SetNativeInstanceField(
-      dart_this,
-      kSecurityContextNativeFieldIndex,
-      reinterpret_cast<intptr_t>(context));
+  Dart_Handle err =
+      Dart_SetNativeInstanceField(dart_this, kSecurityContextNativeFieldIndex,
+                                  reinterpret_cast<intptr_t>(context));
   RETURN_IF_ERROR(err);
-  Dart_NewWeakPersistentHandle(dart_this,
-                               context,
-                               approximate_size_of_context,
+  Dart_NewWeakPersistentHandle(dart_this, context, approximate_size_of_context,
                                DeleteCertContext);
   return Dart_Null();
 }
 
 
 static SecCertificateRef GetX509Certificate(Dart_NativeArguments args) {
   SecCertificateRef certificate;
   Dart_Handle dart_this = ThrowIfError(Dart_GetNativeArgument(args, 0));
   ASSERT(Dart_IsInstance(dart_this));
-  ThrowIfError(Dart_GetNativeInstanceField(
-      dart_this,
-      kX509NativeFieldIndex,
-      reinterpret_cast<intptr_t*>(&certificate)));
+  ThrowIfError(
+      Dart_GetNativeInstanceField(dart_this, kX509NativeFieldIndex,
+                                  reinterpret_cast<intptr_t*>(&certificate)));
   return certificate;
 }
 
 
 static void ReleaseCertificate(void* isolate_data,
                                Dart_WeakPersistentHandle handle,
                                void* context_pointer) {
   SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(context_pointer);
   CFRelease(cert);
 }
 
 
 static Dart_Handle WrappedX509Certificate(SecCertificateRef certificate) {
   const intptr_t approximate_size_of_certificate = 1500;
   if (certificate == NULL) {
     return Dart_Null();
   }
   Dart_Handle x509_type =
       DartUtils::GetDartType(DartUtils::kIOLibURL, "X509Certificate");
   if (Dart_IsError(x509_type)) {
     return x509_type;
   }
-  Dart_Handle arguments[] = { NULL };
+  Dart_Handle arguments[] = {NULL};
 
   Dart_Handle result =
       Dart_New(x509_type, DartUtils::NewString("_"), 0, arguments);
   if (Dart_IsError(result)) {
     return result;
   }
   ASSERT(Dart_IsInstance(result));
 
   // CFRetain in case the returned Dart object outlives the SecurityContext.
   // CFRelease is in the Dart object's finalizer
   CFRetain(certificate);
-  Dart_NewWeakPersistentHandle(result,
-                               reinterpret_cast<void*>(certificate),
+  Dart_NewWeakPersistentHandle(result, reinterpret_cast<void*>(certificate),
                                approximate_size_of_certificate,
                                ReleaseCertificate);
 
   Dart_Handle status = Dart_SetNativeInstanceField(
-      result,
-      kX509NativeFieldIndex,
-      reinterpret_cast<intptr_t>(certificate));
+      result, kX509NativeFieldIndex, reinterpret_cast<intptr_t>(certificate));
   if (Dart_IsError(status)) {
     return status;
   }
   return result;
 }
 
 
 static const char* GetPasswordArgument(Dart_NativeArguments args,
                                        intptr_t index) {
   Dart_Handle password_object =
       ThrowIfError(Dart_GetNativeArgument(args, index));
   const char* password = NULL;
   if (Dart_IsString(password_object)) {
     ThrowIfError(Dart_StringToCString(password_object, &password));
     if (strlen(password) > PEM_BUFSIZE - 1) {
       Dart_ThrowException(DartUtils::NewDartArgumentError(
           "Password length is greater than 1023 bytes."));
     }
   } else if (Dart_IsNull(password_object)) {
     password = "";
   } else {
-    Dart_ThrowException(DartUtils::NewDartArgumentError(
-        "Password is not a String or null"));
+    Dart_ThrowException(
+        DartUtils::NewDartArgumentError("Password is not a String or null"));
   }
   return password;
 }
 
 
 static OSStatus TryPKCS12Import(CFDataRef cfdata,
                                 CFStringRef password,
                                 CFArrayRef* out_certs,
                                 SecIdentityRef* out_identity) {
-  const void* keys[] = { kSecImportExportPassphrase };
-  const void* values[] = { password };
+  const void* keys[] = {kSecImportExportPassphrase};
+  const void* values[] = {password};
   CFDictionaryRef params =
       CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
   CFArrayRef items = NULL;
   OSStatus status = SecPKCS12Import(cfdata, params, &items);
   CFRelease(params);
 
   if (status != noErr) {
     if (SSL_LOG_STATUS) {
       Log::PrintErr("SecPKCS12Import: status = %ld",
-          static_cast<intptr_t>(status));
+                    static_cast<intptr_t>(status));
       return status;
     }
   }
 
   CFIndex items_length = (items == NULL) ? 0 : CFArrayGetCount(items);
   if (SSL_LOG_CERTS) {
     Log::PrintErr("TryPKCS12Import succeeded, count = %ld\n", items_length);
   }
 
   // Empty list indicates a decoding failure of some sort.
@@ skipping 40 matching lines @@
 
     // Certificates.
     CFTypeRef cert_items = CFDictionaryGetValue(dict, kSecImportItemCertChain);
     if (cert_items != NULL) {
       ASSERT(CFGetTypeID(cert_items) == CFArrayGetTypeID());
       CFArrayRef certs = reinterpret_cast<CFArrayRef>(cert_items);
       if (SSL_LOG_CERTS) {
         CFIndex count = CFArrayGetCount(certs);
         Log::PrintErr("\titem %ld has a cert chain %ld certs long\n", i, count);
       }
-      CFArrayAppendArray(
-          result_certs, certs, CFRangeMake(0, CFArrayGetCount(certs)));
+      CFArrayAppendArray(result_certs, certs,
+                         CFRangeMake(0, CFArrayGetCount(certs)));
     }
   }
 
   if (out_certs == NULL) {
     if (result_certs != NULL) {
       CFRelease(result_certs);
     }
   } else {
     *out_certs = result_certs;
   }
@@ skipping 15 matching lines @@
 
 static OSStatus ExtractSecItems(uint8_t* buffer,
                                 intptr_t length,
                                 const char* password,
                                 CFArrayRef* out_certs,
                                 SecIdentityRef* out_identity) {
   ASSERT(buffer != NULL);
   ASSERT(password != NULL);
   OSStatus status = noErr;
 
-  CFDataRef cfdata = CFDataCreateWithBytesNoCopy(
-      NULL, buffer, length, kCFAllocatorNull);
+  CFDataRef cfdata =
+      CFDataCreateWithBytesNoCopy(NULL, buffer, length, kCFAllocatorNull);
   CFStringRef cfpassword = CFStringCreateWithCStringNoCopy(
       NULL, password, kCFStringEncodingUTF8, kCFAllocatorNull);
   ASSERT(cfdata != NULL);
   ASSERT(cfpassword != NULL);
 
   status = TryPKCS12Import(cfdata, cfpassword, out_certs, out_identity);
 
   CFRelease(cfdata);
   CFRelease(cfpassword);
   return status;
@@ skipping 28 matching lines @@
   bool require_client_certificate =
       DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 5));
 
   const char* host_name = NULL;
   // TODO(whesse): Is truncating a Dart string containing \0 what we want?
   ThrowIfError(Dart_StringToCString(host_name_object, &host_name));
 
   SSLCertContext* context = NULL;
   if (!Dart_IsNull(context_object)) {
     ThrowIfError(Dart_GetNativeInstanceField(
-        context_object,
-        kSecurityContextNativeFieldIndex,
+        context_object, kSecurityContextNativeFieldIndex,
         reinterpret_cast<intptr_t*>(&context)));
   }
 
-  GetFilter(args)->Connect(dart_this,
-                           host_name,
-                           context,
-                           is_server,
+  GetFilter(args)->Connect(dart_this, host_name, context, is_server,
                            request_client_certificate,
                            require_client_certificate);
 }
 
 
 void FUNCTION_NAME(SecureSocket_Destroy)(Dart_NativeArguments args) {
   SSLFilter* filter = GetFilter(args);
   // The SSLFilter is deleted in the finalizer for the Dart object created by
   // SetFilter. There is no need to NULL-out the native field for the SSLFilter
   // here because the SSLFilter won't be deleted until the finalizer for the
@@ skipping 16 matching lines @@
 }
 
 
 void FUNCTION_NAME(SecureSocket_Renegotiate)(Dart_NativeArguments args) {
   bool use_session_cache =
       DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 1));
   bool request_client_certificate =
       DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 2));
   bool require_client_certificate =
       DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 3));
-  GetFilter(args)->Renegotiate(use_session_cache,
-                               request_client_certificate,
+  GetFilter(args)->Renegotiate(use_session_cache, request_client_certificate,
                                require_client_certificate);
 }
 
 
 void FUNCTION_NAME(SecureSocket_RegisterHandshakeCompleteCallback)(
     Dart_NativeArguments args) {
   Dart_Handle handshake_complete =
       ThrowIfError(Dart_GetNativeArgument(args, 1));
   if (!Dart_IsClosure(handshake_complete)) {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "Illegal argument to RegisterHandshakeCompleteCallback"));
   }
   GetFilter(args)->RegisterHandshakeCompleteCallback(handshake_complete);
 }
 
 
 void FUNCTION_NAME(SecureSocket_RegisterBadCertificateCallback)(
     Dart_NativeArguments args) {
-  Dart_Handle callback =
-      ThrowIfError(Dart_GetNativeArgument(args, 1));
+  Dart_Handle callback = ThrowIfError(Dart_GetNativeArgument(args, 1));
   if (!Dart_IsClosure(callback) && !Dart_IsNull(callback)) {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "Illegal argument to RegisterBadCertificateCallback"));
   }
   GetFilter(args)->RegisterBadCertificateCallback(callback);
 }
 
 
 void FUNCTION_NAME(SecureSocket_PeerCertificate)(Dart_NativeArguments args) {
   Dart_SetReturnValue(args, GetFilter(args)->PeerCertificate());
@@ skipping 24 matching lines @@
 void FUNCTION_NAME(SecurityContext_UsePrivateKeyBytes)(
     Dart_NativeArguments args) {
   SSLCertContext* context = GetSecurityContext(args);
   const char* password = GetPasswordArgument(args, 2);
 
   OSStatus status;
   CFArrayRef cert_chain = NULL;
   SecIdentityRef identity = NULL;
   {
     ScopedMemBuffer buffer(ThrowIfError(Dart_GetNativeArgument(args, 1)));
-    status = ExtractSecItems(
-        buffer.get(), buffer.length(), password, &cert_chain, &identity);
+    status = ExtractSecItems(buffer.get(), buffer.length(), password,
+                             &cert_chain, &identity);
   }
 
   // Set the context fields. Repeated calls to usePrivateKeyBytes are an error.
   bool set_failure = false;
   if ((identity != NULL) && !context->set_identity(identity)) {
     CFRelease(identity);
     if (cert_chain != NULL) {
       CFRelease(cert_chain);
     }
     set_failure = true;
@@ skipping 94 matching lines @@
 }
 
 
 void FUNCTION_NAME(X509_StartValidity)(Dart_NativeArguments args) {
   Dart_ThrowException(DartUtils::NewDartUnsupportedError(
       "X509Certificate.startValidity is not supported on this platform."));
 }
 
 
 void FUNCTION_NAME(X509_EndValidity)(Dart_NativeArguments args) {
-    Dart_ThrowException(DartUtils::NewDartUnsupportedError(
+  Dart_ThrowException(DartUtils::NewDartUnsupportedError(
       "X509Certificate.endValidity is not supported on this platform."));
 }
 
 
 // Pushes data through the SSL filter, reading and writing from circular
 // buffers shared with Dart. Called from the IOService thread.
 //
 // The Dart _SecureFilterImpl class contains 4 ExternalByteArrays used to
 // pass encrypted and plaintext data to and from the C++ SSLFilter object.
 //
@@ skipping 18 matching lines @@
   bool in_handshake = CObjectBool(request[1]).Value();
   intptr_t starts[SSLFilter::kNumBuffers];
   intptr_t ends[SSLFilter::kNumBuffers];
   for (intptr_t i = 0; i < SSLFilter::kNumBuffers; ++i) {
     starts[i] = CObjectInt32(request[2 * i + 2]).Value();
     ends[i] = CObjectInt32(request[2 * i + 3]).Value();
   }
 
   OSStatus status = filter->ProcessAllBuffers(starts, ends, in_handshake);
   if (status == noErr) {
-    CObjectArray* result = new CObjectArray(
-        CObject::NewArray(SSLFilter::kNumBuffers * 2));
+    CObjectArray* result =
+        new CObjectArray(CObject::NewArray(SSLFilter::kNumBuffers * 2));
     for (intptr_t i = 0; i < SSLFilter::kNumBuffers; ++i) {
       result->SetAt(2 * i, new CObjectInt32(CObject::NewInt32(starts[i])));
       result->SetAt(2 * i + 1, new CObjectInt32(CObject::NewInt32(ends[i])));
     }
     return result;
   } else {
     TextBuffer status_message(SSL_ERROR_MESSAGE_BUFFER_SIZE);
     status_message.Printf("OSStatus = %ld: https://www.osstatus.com",
-        static_cast<intptr_t>(status));
+                          static_cast<intptr_t>(status));
     CObjectArray* result = new CObjectArray(CObject::NewArray(2));
     result->SetAt(0, new CObjectInt32(CObject::NewInt32(status)));
-    result->SetAt(1, new CObjectString(CObject::NewString(
-        status_message.buf())));
+    result->SetAt(1,
+                  new CObjectString(CObject::NewString(status_message.buf())));
     return result;
   }
 }
 
 
 // Usually buffer_starts_ and buffer_ends_ are populated by ProcessAllBuffers,
 // called from ProcessFilterRequest, called from the IOService thread.
 // However, the first call to SSLHandshake comes from the Dart thread, and so
 // doesn't go through there. This results in calls to SSLReadCallback and
 // SSLWriteCallback in which buffer_starts_ and buffer_ends_ haven't been set
@@ skipping 25 matching lines @@
 }
 
 
 void SSLFilter::SetBufferStart(intptr_t idx, intptr_t value) {
   if (buffer_starts_[idx] != NULL) {
     *buffer_starts_[idx] = value;
     return;
   }
   Dart_Handle buffer_handle =
       ThrowIfError(Dart_HandleFromPersistent(dart_buffer_objects_[idx]));
-  ThrowIfError(DartUtils::SetIntegerField(
-      buffer_handle, "start", static_cast<int64_t>(value)));
+  ThrowIfError(DartUtils::SetIntegerField(buffer_handle, "start",
+                                          static_cast<int64_t>(value)));
 }
 
 
 void SSLFilter::SetBufferEnd(intptr_t idx, intptr_t value) {
   if (buffer_ends_[idx] != NULL) {
     *buffer_ends_[idx] = value;
     return;
   }
   Dart_Handle buffer_handle =
       ThrowIfError(Dart_HandleFromPersistent(dart_buffer_objects_[idx]));
-  ThrowIfError(DartUtils::SetIntegerField(
-      buffer_handle, "end", static_cast<int64_t>(value)));
+  ThrowIfError(DartUtils::SetIntegerField(buffer_handle, "end",
+                                          static_cast<int64_t>(value)));
 }
 
 
 OSStatus SSLFilter::ProcessAllBuffers(intptr_t starts[kNumBuffers],
                                       intptr_t ends[kNumBuffers],
                                       bool in_handshake) {
   for (intptr_t i = 0; i < kNumBuffers; ++i) {
     buffer_starts_[i] = &starts[i];
     buffer_ends_[i] = &ends[i];
   }
@@ skipping 113 matching lines @@
 Dart_Handle SSLFilter::InitializeBuffers(Dart_Handle dart_this) {
   // Create SSLFilter buffers as ExternalUint8Array objects.
   Dart_Handle buffers_string = DartUtils::NewString("buffers");
   RETURN_IF_ERROR(buffers_string);
   Dart_Handle dart_buffers_object = Dart_GetField(dart_this, buffers_string);
   RETURN_IF_ERROR(dart_buffers_object);
   Dart_Handle secure_filter_impl_type = Dart_InstanceGetType(dart_this);
   RETURN_IF_ERROR(secure_filter_impl_type);
   Dart_Handle size_string = DartUtils::NewString("SIZE");
   RETURN_IF_ERROR(size_string);
-  Dart_Handle dart_buffer_size = Dart_GetField(
-      secure_filter_impl_type, size_string);
+  Dart_Handle dart_buffer_size =
+      Dart_GetField(secure_filter_impl_type, size_string);
   RETURN_IF_ERROR(dart_buffer_size);
 
   int64_t buffer_size = 0;
   Dart_Handle err = Dart_IntegerToInt64(dart_buffer_size, &buffer_size);
   RETURN_IF_ERROR(err);
 
   Dart_Handle encrypted_size_string = DartUtils::NewString("ENCRYPTED_SIZE");
   RETURN_IF_ERROR(encrypted_size_string);
 
-  Dart_Handle dart_encrypted_buffer_size = Dart_GetField(
-      secure_filter_impl_type, encrypted_size_string);
+  Dart_Handle dart_encrypted_buffer_size =
+      Dart_GetField(secure_filter_impl_type, encrypted_size_string);
   RETURN_IF_ERROR(dart_encrypted_buffer_size);
 
   int64_t encrypted_buffer_size = 0;
   err = Dart_IntegerToInt64(dart_encrypted_buffer_size, &encrypted_buffer_size);
   RETURN_IF_ERROR(err);
 
   if (buffer_size <= 0 || buffer_size > 1 * MB) {
     FATAL("Invalid buffer size in _ExternalBuffer");
   }
   if (encrypted_buffer_size <= 0 || encrypted_buffer_size > 1 * MB) {
@@ skipping 87 matching lines @@
     FATAL("Connect called twice on the same _SecureFilter.");
   }
 
   // Create the underlying context
   SSLContextRef ssl_context = SSLCreateContext(
       NULL, is_server ? kSSLServerSide : kSSLClientSide, kSSLStreamType);
 
   // Configure the context.
   OSStatus status;
   status = SSLSetPeerDomainName(ssl_context, hostname, strlen(hostname));
-  CheckStatus(status,
-      "TlsException",
-      "Failed to set peer domain name");
+  CheckStatus(status, "TlsException", "Failed to set peer domain name");
 
-  status = SSLSetIOFuncs(
-      ssl_context, SSLFilter::SSLReadCallback, SSLFilter::SSLWriteCallback);
-  CheckStatus(status,
-      "TlsException",
-      "Failed to set IO Callbacks");
+  status = SSLSetIOFuncs(ssl_context, SSLFilter::SSLReadCallback,
+                         SSLFilter::SSLWriteCallback);
+  CheckStatus(status, "TlsException", "Failed to set IO Callbacks");
 
-  status = SSLSetConnection(
-      ssl_context, reinterpret_cast<SSLConnectionRef>(this));
-  CheckStatus(status,
-      "TlsException",
-      "Failed to set connection object");
+  status =
+      SSLSetConnection(ssl_context, reinterpret_cast<SSLConnectionRef>(this));
+  CheckStatus(status, "TlsException", "Failed to set connection object");
 
   // Always evaluate the certs manually so that we can cache the peer
   // certificates in the context for calls to peerCertificate.
-  status = SSLSetSessionOption(
-      ssl_context, kSSLSessionOptionBreakOnServerAuth, true);
-  CheckStatus(status,
-      "TlsException",
-      "Failed to set BreakOnServerAuth option");
+  status = SSLSetSessionOption(ssl_context, kSSLSessionOptionBreakOnServerAuth,
+                               true);
+  CheckStatus(status, "TlsException", "Failed to set BreakOnServerAuth option");
 
   status = SSLSetProtocolVersionMin(ssl_context, kTLSProtocol1);
-  CheckStatus(status,
-      "TlsException",
-      "Failed to set minimum protocol version to kTLSProtocol1");
+  CheckStatus(status, "TlsException",
+              "Failed to set minimum protocol version to kTLSProtocol1");
 
   // If the context has an identity pass it to SSLSetCertificate().
   if (context->identity() != NULL) {
     CFMutableArrayRef chain =
         CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
     CFArrayAppendValue(chain, context->identity());
 
     // Append the certificate chain if there is one.
     if (context->cert_chain() != NULL) {
       // Skip the first one, it's already included in the identity.
       CFIndex chain_length = CFArrayGetCount(context->cert_chain());
       if (chain_length > 1) {
-        CFArrayAppendArray(
-            chain, context->cert_chain(), CFRangeMake(1, chain_length));
+        CFArrayAppendArray(chain, context->cert_chain(),
+                           CFRangeMake(1, chain_length));
       }
     }
 
     status = SSLSetCertificate(ssl_context, chain);
     CFRelease(chain);
     CheckStatus(status, "TlsException", "SSLSetCertificate failed");
   }
 
   if (is_server) {
     SSLAuthenticate auth =
         require_client_certificate
-        ? kAlwaysAuthenticate
-        : (request_client_certificate ? kTryAuthenticate : kNeverAuthenticate);
+            ? kAlwaysAuthenticate
+            : (request_client_certificate ? kTryAuthenticate
+                                          : kNeverAuthenticate);
     status = SSLSetClientSideAuthenticate(ssl_context, auth);
-    CheckStatus(status,
-        "TlsException",
-        "Failed to set client authentication mode");
+    CheckStatus(status, "TlsException",
+                "Failed to set client authentication mode");
 
     // If we're at least trying client authentication, then break handshake
     // for client authentication.
     if (auth != kNeverAuthenticate) {
-      status = SSLSetSessionOption(
-          ssl_context, kSSLSessionOptionBreakOnClientAuth, true);
-      CheckStatus(status,
-          "TlsException",
-          "Failed to set client authentication mode");
+      status = SSLSetSessionOption(ssl_context,
+                                   kSSLSessionOptionBreakOnClientAuth, true);
+      CheckStatus(status, "TlsException",
+                  "Failed to set client authentication mode");
     }
   }
 
   // Add the contexts to our wrapper.
   cert_context_.set(context);
   ssl_context_ = ssl_context;
   is_server_ = is_server;
 
   // Kick-off the handshake. Expect the handshake to need more data.
   // SSLHandshake calls our SSLReadCallback and SSLWriteCallback.
   status = SSLHandshake(ssl_context);
   ASSERT(status != noErr);
   if (status == errSSLWouldBlock) {
     status = noErr;
     in_handshake_ = true;
   }
-  CheckStatus(status,
-     "HandshakeException",
-      is_server_ ? "Handshake error in server" : "Handshake error in client");
+  CheckStatus(status, "HandshakeException", is_server_
+                                                ? "Handshake error in server"
+                                                : "Handshake error in client");
 }
 
 
 OSStatus SSLFilter::EvaluatePeerTrust() {
   OSStatus status = noErr;
 
   if (SSL_LOG_STATUS) {
     Log::PrintErr("Handshake evaluating trust.\n");
   }
   SecTrustRef peer_trust = NULL;
   status = SSLCopyPeerTrust(ssl_context_, &peer_trust);
   if (status != noErr) {
     if (is_server_ && (status == errSSLBadCert)) {
       // A client certificate was requested, but not required, and wasn't sent.
       return noErr;
     }
     if (SSL_LOG_STATUS) {
       Log::PrintErr("Handshake error from SSLCopyPeerTrust(): %ld.\n",
-          static_cast<intptr_t>(status));
+                    static_cast<intptr_t>(status));
     }
     return status;
   }
 
   CFArrayRef trusted_certs = NULL;
   if (cert_context_.get()->trusted_certs() != NULL) {
     trusted_certs =
         CFArrayCreateCopy(NULL, cert_context_.get()->trusted_certs());
   } else {
     trusted_certs = CFArrayCreate(NULL, NULL, 0, &kCFTypeArrayCallBacks);
   }
 
   status = SecTrustSetAnchorCertificates(peer_trust, trusted_certs);
   if (status != noErr) {
     if (SSL_LOG_STATUS) {
       Log::PrintErr("Handshake error from SecTrustSetAnchorCertificates: %ld\n",
-          static_cast<intptr_t>(status));
+                    static_cast<intptr_t>(status));
     }
     CFRelease(trusted_certs);
     CFRelease(peer_trust);
     return status;
   }
 
   if (SSL_LOG_STATUS) {
-    Log::PrintErr("Handshake %s built in root certs\n",
+    Log::PrintErr(
+        "Handshake %s built in root certs\n",
         cert_context_.get()->trust_builtin() ? "trusting" : "not trusting");
   }
 
   status = SecTrustSetAnchorCertificatesOnly(
       peer_trust, !cert_context_.get()->trust_builtin());
   if (status != noErr) {
     CFRelease(trusted_certs);
     CFRelease(peer_trust);
     return status;
   }
@@ skipping 191 matching lines @@
     handshake_complete_ = NULL;
   }
   if (bad_certificate_callback_ != NULL) {
     Dart_DeletePersistentHandle(bad_certificate_callback_);
     bad_certificate_callback_ = NULL;
   }
 }
 
 
 OSStatus SSLFilter::SSLReadCallback(SSLConnectionRef connection,
-                                    void* data, size_t* data_requested) {
+                                    void* data,
+                                    size_t* data_requested) {
   // Copy at most `data_requested` bytes from `buffers_[kReadEncrypted]` into
   // `data`
   ASSERT(connection != NULL);
   ASSERT(data != NULL);
   ASSERT(data_requested != NULL);
 
   SSLFilter* filter =
       const_cast<SSLFilter*>(reinterpret_cast<const SSLFilter*>(connection));
   uint8_t* datap = reinterpret_cast<uint8_t*>(data);
   uint8_t* buffer = filter->buffers_[kReadEncrypted];
@@ skipping 25 matching lines @@
     memmove(datap, &buffer[start], bytes);
     start += bytes;
     datap += bytes;
     data_read += bytes;
     requested -= bytes;
     ASSERT(start <= end);
   }
 
   if (SSL_LOG_DATA) {
     Log::PrintErr("SSLReadCallback: requested: %ld, read %ld bytes\n",
-        *data_requested, data_read);
+                  *data_requested, data_read);
   }
 
   filter->SetBufferStart(kReadEncrypted, start);
   bool short_read = data_read < static_cast<intptr_t>(*data_requested);
   *data_requested = data_read;
   return short_read ? errSSLWouldBlock : noErr;
 }
 
 
 // Read decrypted data from the filter to the circular buffer.
 OSStatus SSLFilter::ProcessReadPlaintextBuffer(intptr_t start,
                                                intptr_t end,
                                                intptr_t* bytes_processed) {
   ASSERT(bytes_processed != NULL);
   intptr_t length = end - start;
   OSStatus status = noErr;
   size_t bytes = 0;
   if (length > 0) {
-    status = SSLRead(
-        ssl_context_,
-        reinterpret_cast<void*>((buffers_[kReadPlaintext] + start)),
-        length,
-        &bytes);
+    status =
+        SSLRead(ssl_context_,
+                reinterpret_cast<void*>((buffers_[kReadPlaintext] + start)),
+                length, &bytes);
     if (SSL_LOG_STATUS) {
       Log::PrintErr("SSLRead: status = %ld\n", static_cast<intptr_t>(status));
     }
     if ((status != noErr) && (status != errSSLWouldBlock)) {
       *bytes_processed = 0;
       return status;
     }
   }
   if (SSL_LOG_DATA) {
     Log::PrintErr(
-        "ProcessReadPlaintextBuffer: requested: %ld, read %ld bytes\n",
-        length, bytes);
+        "ProcessReadPlaintextBuffer: requested: %ld, read %ld bytes\n", length,
+        bytes);
   }
   *bytes_processed = static_cast<intptr_t>(bytes);
   return status;
 }
 
 
 OSStatus SSLFilter::SSLWriteCallback(SSLConnectionRef connection,
-                                     const void* data, size_t* data_provided) {
+                                     const void* data,
+                                     size_t* data_provided) {
   // Copy at most `data_provided` bytes from data into
   // `buffers_[kWriteEncrypted]`.
   ASSERT(connection != NULL);
   ASSERT(data != NULL);
   ASSERT(data_provided != NULL);
 
   SSLFilter* filter =
-    const_cast<SSLFilter*>(reinterpret_cast<const SSLFilter*>(connection));
+      const_cast<SSLFilter*>(reinterpret_cast<const SSLFilter*>(connection));
   const uint8_t* datap = reinterpret_cast<const uint8_t*>(data);
   uint8_t* buffer = filter->buffers_[kWriteEncrypted];
   intptr_t start = filter->GetBufferStart(kWriteEncrypted);
   intptr_t end = filter->GetBufferEnd(kWriteEncrypted);
   intptr_t size = filter->encrypted_buffer_size_;
   intptr_t provided = static_cast<intptr_t>(*data_provided);
   intptr_t data_written = 0;
 
   // is full, neither if statement is executed and nothing happens.
   if (start <= end) {
@@ skipping 20 matching lines @@
     memmove(&buffer[end], datap, bytes);
     end += bytes;
     datap += bytes;
     data_written += bytes;
     provided -= bytes;
     ASSERT(end < start);
   }
 
   if (SSL_LOG_DATA) {
     Log::PrintErr("SSLWriteCallback: provided: %ld, written %ld bytes\n",
-        *data_provided, data_written);
+                  *data_provided, data_written);
   }
 
   filter->SetBufferEnd(kWriteEncrypted, end);
   *data_provided = data_written;
   return (data_written == 0) ? errSSLWouldBlock : noErr;
 }
 
 
 OSStatus SSLFilter::ProcessWritePlaintextBuffer(intptr_t start,
                                                 intptr_t end,
                                                 intptr_t* bytes_processed) {
   ASSERT(bytes_processed != NULL);
   intptr_t length = end - start;
   OSStatus status = noErr;
   size_t bytes = 0;
   if (length > 0) {
-    status = SSLWrite(
-        ssl_context_,
-        reinterpret_cast<void*>(buffers_[kWritePlaintext] + start),
-        length,
-        &bytes);
+    status =
+        SSLWrite(ssl_context_,
+                 reinterpret_cast<void*>(buffers_[kWritePlaintext] + start),
+                 length, &bytes);
     if (SSL_LOG_STATUS) {
       Log::PrintErr("SSLWrite: status = %ld\n", static_cast<intptr_t>(status));
     }
     if ((status != noErr) && (status != errSSLWouldBlock)) {
       *bytes_processed = 0;
       return status;
     }
   }
   if (SSL_LOG_DATA) {
     Log::PrintErr("ProcessWritePlaintextBuffer: requested: %ld, written: %ld\n",
-        length, bytes);
+                  length, bytes);
   }
   *bytes_processed = static_cast<intptr_t>(bytes);
   return status;
 }
 
 }  // namespace bin
 }  // namespace dart
 
 #endif  // TARGET_OS_IOS
 
 #endif  // !defined(DART_IO_SECURE_SOCKET_DISABLED)