An implementation of chrome.socket.secure().

chrome/browser/extensions/api/socket/socket.h

Index: chrome/browser/extensions/api/socket/socket.h
diff --git a/chrome/browser/extensions/api/socket/socket.h b/chrome/browser/extensions/api/socket/socket.h
index 2e73cb0d1fee27a496af8b9d77ca2f0a4391b8e5..542b39f702a9ef607cf8d5b902add20970a6d484 100644
--- a/chrome/browser/extensions/api/socket/socket.h
+++ b/chrome/browser/extensions/api/socket/socket.h
@@ -39,12 +39,17 @@ typedef base::Callback<
 // we need to manage it in the context of an extension.
 class Socket : public ApiResource {
  public:
-  enum SocketType {
-    TYPE_TCP,
-    TYPE_UDP,
-  };
+  enum SocketType { TYPE_TCP, TYPE_UDP, TYPE_TLS };
 
   virtual ~Socket();
+
+  const std::string& hostname() const { return hostname_; }
+
+  void set_hostname(const std::string& hostname) { hostname_ = hostname; }
+
+  // |address| is a resolved IP address. Call set_hostname() to save the
+  // original DNS name of the host if this socket may later get upgraded to
+  // TLS (see TLSSocket::UpgradeSocketToTLS()).

[Ryan Sleevi, 2014/02/24 20:06:49]

Comment wise, this wording seems a bit on the wishy-washy side, in that it seems
more of a suggestion than clear guidance. Let's try this:

// Note: |address| contains the resolved IP address, not the hostname
// of the remote endpoint. In order to upgrade this socket to TLS,
// callers must also supply the hostname of the endpoint via
// |set_hostname()|.

[lally, 2014/02/27 17:05:59]

Done.

   virtual void Connect(const std::string& address,
                        int port,
                        const CompletionCallback& callback) = 0;
@@ -102,7 +107,9 @@ class Socket : public ApiResource {
                         const net::CompletionCallback& callback) = 0;
   virtual void OnWriteComplete(int result);
 
-  const std::string address_;
+  // The DNS name of the host that this socket is connected to, used when
+  // verifying a TLS certificate.

[Ryan Sleevi, 2014/02/24 20:06:49]

// The hostname of the remote host that this socket is connected to.
// Note: This may contain an IP literal. In the case of IDNs, this
// will contain a series of A-LABELs, not U-LABELs.

Am I correct with that above comment? How do you handle IDN names? If you pass
them through, should this be a UTF-8 string? Or will you apply IDNA to
canonicalize from the JS?

And is it valid for callers to supply IP addresses, for IP address certs? If so,
what's the form of IPv6 - bracketed or unbracketed? (Presumably, the latter).

[lally, 2014/02/27 17:05:59]

I had to investigate to find out what the upper-layer behavior is.  This passes
through the UTF-8 string passed in from javascript.  It's passed directly from
the javascript API as just a hostname, so there won't be any parsing, and there
shouldn't be any brackets for IPv6 addresses.

Should I canonicalize?

[Ryan Sleevi, 2014/03/12 23:35:27]

At least the SSLSocket layer expects the canonicalized, valid form.

That is, all hostnames as A-Labels, IPv6 as bracketed. I'm not sure where you
want to do that, but that's at least needed.

+  std::string hostname_;
   bool is_connected_;
 
  private: