Cache certificate verification results in memory.

net/socket/ssl_host_info.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_host_info.h"
 
 #include "base/metrics/histogram.h"
 #include "base/string_piece.h"
-#include "net/base/cert_verifier.h"
 #include "net/base/ssl_config_service.h"
 #include "net/base/x509_certificate.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/ssl_host_info.pb.h"
 
 namespace net {
 
 SSLHostInfo::State::State()
     : npn_valid(false),
       npn_status(SSLClientSocket::kNextProtoUnsupported) {
 }
 
 SSLHostInfo::State::~State() {}
 
 SSLHostInfo::SSLHostInfo(
     const std::string& hostname,
-    const SSLConfig& ssl_config)
+    const SSLConfig& ssl_config,
+    CertVerifier* cert_verifier)
     : cert_verification_complete_(false),
       cert_verification_error_(ERR_CERT_INVALID),
       hostname_(hostname),
       cert_parsing_failed_(false),
       cert_verification_callback_(NULL),
       rev_checking_enabled_(ssl_config.rev_checking_enabled),
       verify_ev_cert_(ssl_config.verify_ev_cert),
+      verifier_(cert_verifier),
       callback_(new CancelableCompletionCallback<SSLHostInfo>(
                         ALLOW_THIS_IN_INITIALIZER_LIST(this),
                         &SSLHostInfo::VerifyCallback)) {
   state_.npn_valid = false;
 }
 
 SSLHostInfo::~SSLHostInfo() {}
 
 // This array and the next two functions serve to map between the internal NPN
 // status enum (which might change across versions) and the protocol buffer
@@ skipping 59 matching lines @@
     std::vector<base::StringPiece> der_certs(state->certs.size());
     for (size_t i = 0; i < state->certs.size(); i++)
       der_certs[i] = state->certs[i];
     cert_ = X509Certificate::CreateFromDERCertChain(der_certs);
     if (cert_.get()) {
       int flags = 0;
       if (verify_ev_cert_)
         flags |= X509Certificate::VERIFY_EV_CERT;
       if (rev_checking_enabled_)
         flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED;
-      verifier_.reset(new CertVerifier);
       VLOG(1) << "Kicking off verification for " << hostname_;
       verification_start_time_ = base::TimeTicks::Now();
-      if (verifier_->Verify(cert_.get(), hostname_, flags,
-                            &cert_verify_result_, callback_) == OK) {
+      if (verifier_.Verify(cert_.get(), hostname_, flags,
+                           &cert_verify_result_, callback_) == OK) {
         VerifyCallback(OK);
       }
     } else {
       cert_parsing_failed_ = true;
       DCHECK(!cert_verification_callback_);
     }
   }
 
   return true;
 }
@@ skipping 41 matching lines @@
   if (cert_verification_callback_) {
     CompletionCallback* callback = cert_verification_callback_;
     cert_verification_callback_ = NULL;
     callback->Run(rv);
   }
 }
 
 SSLHostInfoFactory::~SSLHostInfoFactory() {}
 
 }  // namespace net