Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/mock_cert_verifier.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/mock_cert_verifier.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/memory/ref_counted.h"
@@ skipping 18 matching lines @@
     DCHECK(cert);
     DCHECK(result.verified_cert);
   }
 
   scoped_refptr<X509Certificate> cert;
   std::string hostname;
   CertVerifyResult result;
   int rv;
 };
 
-MockCertVerifier::MockCertVerifier() : default_result_(ERR_CERT_INVALID) {}
+MockCertVerifier::MockCertVerifier()
+    : default_result_(ERR_CERT_INVALID), async_(false) {}
 
 MockCertVerifier::~MockCertVerifier() {}
 
 int MockCertVerifier::Verify(const RequestParams& params,
                              CRLSet* crl_set,
                              CertVerifyResult* verify_result,
                              const CompletionCallback& callback,
                              std::unique_ptr<Request>* out_req,
                              const NetLogWithSource& net_log) {
+  int result;
   RuleList::const_iterator it;
   for (it = rules_.begin(); it != rules_.end(); ++it) {
     // Check just the server cert. Intermediates will be ignored.
     if (!it->cert->Equals(params.certificate().get()))
       continue;
     if (!base::MatchPattern(params.hostname(), it->hostname))
       continue;
     *verify_result = it->result;
-    return it->rv;
+    result = it->rv;
+  }
+  if (it == rules_.end()) {
+    // Fall through to the default.
+    verify_result->verified_cert = params.certificate();
+    verify_result->cert_status = MapNetErrorToCertStatus(default_result_);
+    result = default_result_;
   }
 
-  // Fall through to the default.
-  verify_result->verified_cert = params.certificate();
-  verify_result->cert_status = MapNetErrorToCertStatus(default_result_);
-  return default_result_;
+  if (async_) {
+    callback.Run(result);

[Ryan Sleevi, 2017/04/12 21:53:17]

BUG: This isn't consistent with how Chrome's async callbacks work. You'd
actually need to PostTask to guarantee the async-ness.

In order to allow async, you also have to populate out_req so you can allow the
request to be cancelled (meaning you couldn't PostTask to callback, you'd need
to PostTask to run an internal helper that would then run the callback)

class InternalRequest : public CertVerifier::Request {
 public:
  explicit InternalRequest(const CompletionCallback& callback,
                           int result)
      : callback_(callback), result_(result), weak_factory_(this) {}

  void Start() {
    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
base::Bind(&InternalRequest::RunCallback, weak_factory_.GetWeakPtr()));
  }

  void RunCallback() {
    base::ResetAndReturn(callback_).Run(result_);
  }

 private:
  CompletionCallback callback_;
  int result_;
  base::WeakPtrFactor<InternalRequest> weak_factory_;
};


And then here, you'd do:

std::unique_ptr<InternalRequest> req(base::MakeUnique<InternalRequest>(callback,
result));
req->Start();
*out_req = req;
return ERR_IO_PENDING;



For context, the goal is to start an async task that will run the callback on
the _next_ message loop turn (very important, //net avoids re-entrant callbacks
like this would introduce), but also observe the cancellation semantics that
guarantees that |callback| won't run if |out_req| is deleted (this is
accomplished by the WeakPtrFactory, since the callback will no-op if the WeakPtr
is invalidated)

[martinkr, 2017/04/24 23:54:26]

Ah crap, I meant to look up how to properly do this asynchronously and forgot.
:o)

Since the new code is bypassing the wrapped verifier, rather than wrapping the
user-provided callback, I think we can simply drop this and the associated
tests, do you agree?

[Ryan Sleevi, 2017/04/25 18:07:09]

Yup! SG :)

+    return ERR_IO_PENDING;
+  }
+  return result;
 }
 
 void MockCertVerifier::AddResultForCert(scoped_refptr<X509Certificate> cert,
                                         const CertVerifyResult& verify_result,
                                         int rv) {
   AddResultForCertAndHost(std::move(cert), "*", verify_result, rv);
 }
 
 void MockCertVerifier::AddResultForCertAndHost(
     scoped_refptr<X509Certificate> cert,
     const std::string& host_pattern,
     const CertVerifyResult& verify_result,
     int rv) {
   rules_.push_back(Rule(std::move(cert), host_pattern, verify_result, rv));
 }
 
 }  // namespace net