Call the platform certificate parser in WorkerPool.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/stringprintf.h"
 #include "base/synchronization/lock.h"
+#include "base/task_runner_util.h"
 #include "base/threading/thread_local.h"
+#include "base/threading/worker_pool.h"
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event.h"
 #include "base/values.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/openssl_util.h"
 #include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
 #include "net/base/trace_constants.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_ev_whitelist.h"
@@ skipping 189 matching lines @@
 // TODO(davidben): Remove this after the ECDSA CBC removal sticks.
 // https:/crbug.com/666191.
 const base::Feature kLegacyECDSACiphersFeature{
     "SSLLegacyECDSACiphers", base::FEATURE_DISABLED_BY_DEFAULT};
 
 bool AreLegacyECDSACiphersEnabled() {
   return base::FeatureList::IsEnabled(kLegacyECDSACiphersFeature);
 }
 #endif
 
-scoped_refptr<X509Certificate> OSChainFromBuffers(STACK_OF(CRYPTO_BUFFER) *
-                                                  openssl_chain) {
+int GetOSChainFromBuffers(STACK_OF(CRYPTO_BUFFER) * openssl_chain,
+                          scoped_refptr<X509Certificate>* server_cert) {
   if (sk_CRYPTO_BUFFER_num(openssl_chain) == 0) {
     NOTREACHED();
-    return nullptr;
+    return ERR_SSL_SERVER_CERT_BAD_FORMAT;
   }
 
   // Convert the certificate chains to a platform certificate handle.
   std::vector<base::StringPiece> der_chain;
   der_chain.reserve(sk_CRYPTO_BUFFER_num(openssl_chain));
   for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(openssl_chain); ++i) {
     const CRYPTO_BUFFER* cert = sk_CRYPTO_BUFFER_value(openssl_chain, i);
     base::StringPiece der;
     der_chain.push_back(base::StringPiece(
         reinterpret_cast<const char*>(CRYPTO_BUFFER_data(cert)),
         CRYPTO_BUFFER_len(cert)));
   }
-  return X509Certificate::CreateFromDERCertChain(der_chain);
+  *server_cert = X509Certificate::CreateFromDERCertChain(der_chain);
+
+  // OpenSSL decoded the certificate, but the platform certificate
+  // implementation could not. This is treated as a fatal SSL-level protocol
+  // error rather than a certificate error. See https://crbug.com/91341.
+  if (!*server_cert)
+    return ERR_SSL_SERVER_CERT_BAD_FORMAT;
+  return OK;
 }
 
 #if !defined(OS_IOS)
 bssl::UniquePtr<CRYPTO_BUFFER> OSCertHandleToBuffer(
     X509Certificate::OSCertHandle os_handle) {
   std::string der_encoded;
   if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded))
     return nullptr;
   return x509_util::CreateCryptoBuffer(der_encoded);
 }
@@ skipping 858 matching lines @@
 
   if (!IsRenegotiationAllowed())
     SSL_set_renegotiate_mode(ssl_.get(), ssl_renegotiate_never);
 
   uint16_t signature_algorithm = SSL_get_peer_signature_algorithm(ssl_.get());
   if (signature_algorithm != 0) {
     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSLSignatureAlgorithm",
                                 signature_algorithm);
   }
 
-  // Verify the certificate.
-  next_handshake_state_ = STATE_VERIFY_CERT;
+  // Decode the certificate.
+  next_handshake_state_ = STATE_DECODE_CERT;
   return OK;
 }
 
 int SSLClientSocketImpl::DoChannelIDLookup() {
   NetLogParametersCallback callback = base::Bind(
       &NetLogChannelIDLookupCallback, base::Unretained(channel_id_service_));
   net_log_.BeginEvent(NetLogEventType::SSL_GET_CHANNEL_ID, callback);
   next_handshake_state_ = STATE_CHANNEL_ID_LOOKUP_COMPLETE;
   return channel_id_service_->GetOrCreateChannelID(
       host_and_port_.host(), &channel_id_key_,
@@ skipping 17 matching lines @@
     LOG(ERROR) << "Failed to set Channel ID.";
     return ERR_FAILED;
   }
 
   // Return to the handshake.
   channel_id_sent_ = true;
   next_handshake_state_ = STATE_HANDSHAKE;
   return OK;
 }
 
+int SSLClientSocketImpl::DoDecodeCert(int result) {
+  scoped_refptr<base::TaskRunner> slow_task_runner =
+      base::WorkerPool::GetTaskRunner(true /* task_is_slow */);
+  base::PostTaskAndReplyWithResult(
+      slow_task_runner.get(), FROM_HERE,
+      base::Bind(&GetOSChainFromBuffers, SSL_get0_peer_certificates(ssl_.get()),
+                 &server_cert_),
+      base::Bind(&SSLClientSocketImpl::OnHandshakeIOComplete,
+                 base::Unretained(this)));
+  next_handshake_state_ = STATE_DECODE_CERT_COMPLETE;
+  return ERR_IO_PENDING;
+}
+
+int SSLClientSocketImpl::DoDecodeCertComplete(int result) {
+  if (result != OK)
+    return result;
+
+  net_log_.AddEvent(NetLogEventType::SSL_CERTIFICATES_RECEIVED,
+                    base::Bind(&NetLogX509CertificateCallback,
+                               base::Unretained(server_cert_.get())));
+
+  next_handshake_state_ = STATE_VERIFY_CERT;
+  return OK;
+}
+
 int SSLClientSocketImpl::DoVerifyCert(int result) {
   DCHECK(start_cert_verification_time_.is_null());
 
-  server_cert_ = OSChainFromBuffers(SSL_get0_peer_certificates(ssl_.get()));
-
-  // OpenSSL decoded the certificate, but the platform certificate
-  // implementation could not. This is treated as a fatal SSL-level protocol
-  // error rather than a certificate error. See https://crbug.com/91341.
-  if (!server_cert_)
-    return ERR_SSL_SERVER_CERT_BAD_FORMAT;
-
-  net_log_.AddEvent(NetLogEventType::SSL_CERTIFICATES_RECEIVED,
-                    base::Bind(&NetLogX509CertificateCallback,
-                               base::Unretained(server_cert_.get())));
-
   next_handshake_state_ = STATE_VERIFY_CERT_COMPLETE;
 
   // If the certificate is bad and has been previously accepted, use
   // the previous status and bypass the error.
   CertStatus cert_status;
   if (ssl_config_.IsAllowedBadCert(server_cert_.get(), &cert_status)) {
     server_cert_verify_result_.Reset();
     server_cert_verify_result_.cert_status = cert_status;
     server_cert_verify_result_.verified_cert = server_cert_;
     return OK;
@@ skipping 119 matching lines @@
       case STATE_HANDSHAKE_COMPLETE:
         rv = DoHandshakeComplete(rv);
         break;
       case STATE_CHANNEL_ID_LOOKUP:
         DCHECK_EQ(OK, rv);
         rv = DoChannelIDLookup();
         break;
       case STATE_CHANNEL_ID_LOOKUP_COMPLETE:
         rv = DoChannelIDLookupComplete(rv);
         break;
+      case STATE_DECODE_CERT:
+        DCHECK_EQ(OK, rv);
+        rv = DoDecodeCert(rv);
+        break;
+      case STATE_DECODE_CERT_COMPLETE:
+        rv = DoDecodeCertComplete(rv);
+        break;
       case STATE_VERIFY_CERT:
         DCHECK_EQ(OK, rv);
         rv = DoVerifyCert(rv);
         break;
       case STATE_VERIFY_CERT_COMPLETE:
         rv = DoVerifyCertComplete(rv);
         break;
       case STATE_NONE:
       default:
         rv = ERR_UNEXPECTED;
@@ skipping 626 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net