Add PPAPI interface for secure sockets in flash

ppapi/api/private/ppb_flash_tcp_socket.idl

 /* Copyright (c) 2012 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 /**
  * This file defines the <code>PPB_Flash_TCPSocket</code> interface.
  */
 
 label Chrome {
@@ skipping 59 matching lines @@
    * SSLHandshake() will fail without starting a handshake. Otherwise, any
    * failure during the handshake process will cause the socket to be
    * disconnected.
    */
   int32_t SSLHandshake([in] PP_Resource tcp_socket,
                        [in] str_t server_name,
                        [in] uint16_t server_port,
                        [in] PP_CompletionCallback callback);
 
   /**
+   * Returns the <code>PPB_Flash_X509Certificate</code> for a socket connection
+   * if an SSL connection has been established using <code>SSL_Handshake</code>.
+   * If no SSL connection has been established, a null resource is returned.
+   */
+  PP_Resource GetX509Certificate([in] PP_Resource tcp_socket);

[Ryan Sleevi, 2012/02/16 21:29:23]

Why only return a single certificate?

A (typical) SSL handshake is made up of 1 or more certificates, with the first
certificate asserting the servers identity, and the remaining certificates used
to assist in establishing that identity.

Further, is this the list the server sends? Or is this the list that was
actually validated - which may be completely different than what the server sent
(with the exception of the first certificate, the server's identity, which
remains constant)

[raymes, 2012/02/16 22:31:29]

I guess the intention is only to return the server's certificate here, which is
the data that flash requires. I can update the name/comment.

On 2012/02/16 21:29:23, Ryan Sleevi wrote:

[Ryan Sleevi, 2012/02/16 23:06:33]

If going the Flash-specific interface route: GetServerCertificate
If going the general purpose route: I would return an array (of server supplied)
certificates.

[raymes, 2012/02/21 19:07:40]

Done.

+
+  /**
+   * Add a trusted/untrusted root certificate to be used for this connection.
+   * The <code>PP_Resource</code> must be a
+   * <code>PPB_Flash_X509Certificate<code>. <code>PP_TRUE</code> is returned
+   * upon success.
+   */
+  PP_Bool AddRootCertificates([in] PP_Resource certificate,

[Ryan Sleevi, 2012/02/16 23:06:33]

Looking at the Flash API, I would suggest dropping the term root here.

This is a chain building certificate, which may be trusted or not. This is a
separate dimension than root certificates (root certificates can be trusted or
untrusted, intermediate certificates can be trusted or untrusted, if an
intermediate is trusted you don't need a root)

[raymes, 2012/02/21 19:07:40]

Done.

+                              [in] PP_Bool is_trusted);
+
+  /**
    * Reads data from the socket. The size of |buffer| must be at least as large
    * as |bytes_to_read|. May perform a partial read. Returns the number of bytes
    * read or an error code. If the return value is 0, then it indicates that
    * end-of-file was reached.
    * This method won't return more than 1 megabyte, so if |bytes_to_read|
    * exceeds 1 megabyte, it will always perform a partial read.
    * Multiple outstanding read requests are not supported.
    */
   int32_t Read([in] PP_Resource tcp_socket,
                [out] str_t buffer,
@@ skipping 15 matching lines @@
   /**
    * Cancels any IO that may be pending, and disconnects the socket. Any pending
    * callbacks will still run, reporting PP_Error_Aborted if pending IO was
    * interrupted. It is NOT valid to call Connect() again after a call to this
    * method. Note: If the socket is destroyed when it is still connected, then
    * it will be implicitly disconnected, so you are not required to call this
    * method.
    */
   void Disconnect([in] PP_Resource tcp_socket);
 };