Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/mock_cert_verifier.cc

Index: net/cert/mock_cert_verifier.cc
diff --git a/net/cert/mock_cert_verifier.cc b/net/cert/mock_cert_verifier.cc
index 9cbbafd3cfe91e331348d3247d7457c055d28934..e8bdc915afd165ebcb93c6bd8b84a2f017fc0d10 100644
--- a/net/cert/mock_cert_verifier.cc
+++ b/net/cert/mock_cert_verifier.cc
@@ -36,7 +36,8 @@ struct MockCertVerifier::Rule {
   int rv;
 };
 
-MockCertVerifier::MockCertVerifier() : default_result_(ERR_CERT_INVALID) {}
+MockCertVerifier::MockCertVerifier()
+    : default_result_(ERR_CERT_INVALID), async_(false) {}
 
 MockCertVerifier::~MockCertVerifier() {}
 
@@ -46,6 +47,7 @@ int MockCertVerifier::Verify(const RequestParams& params,
                              const CompletionCallback& callback,
                              std::unique_ptr<Request>* out_req,
                              const NetLogWithSource& net_log) {
+  int result;
   RuleList::const_iterator it;
   for (it = rules_.begin(); it != rules_.end(); ++it) {
     // Check just the server cert. Intermediates will be ignored.
@@ -54,13 +56,20 @@ int MockCertVerifier::Verify(const RequestParams& params,
     if (!base::MatchPattern(params.hostname(), it->hostname))
       continue;
     *verify_result = it->result;
-    return it->rv;
+    result = it->rv;
+  }
+  if (it == rules_.end()) {
+    // Fall through to the default.
+    verify_result->verified_cert = params.certificate();
+    verify_result->cert_status = MapNetErrorToCertStatus(default_result_);
+    result = default_result_;
   }
 
-  // Fall through to the default.
-  verify_result->verified_cert = params.certificate();
-  verify_result->cert_status = MapNetErrorToCertStatus(default_result_);
-  return default_result_;
+  if (async_) {
+    callback.Run(result);

[Ryan Sleevi, 2017/04/12 21:53:17]

BUG: This isn't consistent with how Chrome's async callbacks work. You'd
actually need to PostTask to guarantee the async-ness.

In order to allow async, you also have to populate out_req so you can allow the
request to be cancelled (meaning you couldn't PostTask to callback, you'd need
to PostTask to run an internal helper that would then run the callback)

class InternalRequest : public CertVerifier::Request {
 public:
  explicit InternalRequest(const CompletionCallback& callback,
                           int result)
      : callback_(callback), result_(result), weak_factory_(this) {}

  void Start() {
    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
base::Bind(&InternalRequest::RunCallback, weak_factory_.GetWeakPtr()));
  }

  void RunCallback() {
    base::ResetAndReturn(callback_).Run(result_);
  }

 private:
  CompletionCallback callback_;
  int result_;
  base::WeakPtrFactor<InternalRequest> weak_factory_;
};


And then here, you'd do:

std::unique_ptr<InternalRequest> req(base::MakeUnique<InternalRequest>(callback,
result));
req->Start();
*out_req = req;
return ERR_IO_PENDING;



For context, the goal is to start an async task that will run the callback on
the _next_ message loop turn (very important, //net avoids re-entrant callbacks
like this would introduce), but also observe the cancellation semantics that
guarantees that |callback| won't run if |out_req| is deleted (this is
accomplished by the WeakPtrFactory, since the callback will no-op if the WeakPtr
is invalidated)

[martinkr, 2017/04/24 23:54:26]

Ah crap, I meant to look up how to properly do this asynchronously and forgot.
:o)

Since the new code is bypassing the wrapped verifier, rather than wrapping the
user-provided callback, I think we can simply drop this and the associated
tests, do you agree?

[Ryan Sleevi, 2017/04/25 18:07:09]

Yup! SG :)

+    return ERR_IO_PENDING;
+  }
+  return result;
 }
 
 void MockCertVerifier::AddResultForCert(scoped_refptr<X509Certificate> cert,