Add functionality to pppapi TCPSocket to support secure sockets in flash

ppapi/shared_impl/private/tcp_socket_private_impl.cc

Index: ppapi/shared_impl/private/tcp_socket_private_impl.cc
diff --git a/ppapi/shared_impl/private/tcp_socket_private_impl.cc b/ppapi/shared_impl/private/tcp_socket_private_impl.cc
index de99e204a398a682437ab1e5ce0bc2a156b4ec18..59c8faca56c51f5137b48e65f5d083bd6a0b7cd1 100644
--- a/ppapi/shared_impl/private/tcp_socket_private_impl.cc
+++ b/ppapi/shared_impl/private/tcp_socket_private_impl.cc
@@ -14,6 +14,11 @@
 #include "base/message_loop.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
+#include "ppapi/shared_impl/resource_tracker.h"
+#include "ppapi/shared_impl/var.h"
+#include "ppapi/thunk/ppb_x509_certificate_private_api.h"
 
 namespace ppapi {
 
@@ -22,13 +27,15 @@ const int32_t TCPSocketPrivateImpl::kMaxWriteSize = 1024 * 1024;
 
 TCPSocketPrivateImpl::TCPSocketPrivateImpl(PP_Instance instance,
                                            uint32 socket_id)
-    : Resource(OBJECT_IS_IMPL, instance) {
+    : Resource(OBJECT_IS_IMPL, instance),
+      resource_type_(OBJECT_IS_IMPL) {
   Init(socket_id);
 }
 
 TCPSocketPrivateImpl::TCPSocketPrivateImpl(const HostResource& resource,
                                            uint32 socket_id)
-    : Resource(OBJECT_IS_PROXY, resource) {
+    : Resource(OBJECT_IS_PROXY, resource),
+      resource_type_(OBJECT_IS_PROXY) {
   Init(socket_id);
 }
 
@@ -112,10 +119,47 @@ int32_t TCPSocketPrivateImpl::SSLHandshake(const char* server_name,
   ssl_handshake_callback_ = new TrackedCallback(this, callback);
 
   // Send the request, the browser will call us back via SSLHandshakeACK.
-  SendSSLHandshake(server_name, server_port);
+  SendSSLHandshake(server_name, server_port, trusted_certificates_,
+      untrusted_certificates_);
   return PP_OK_COMPLETIONPENDING;
 }
 
+PP_Resource TCPSocketPrivateImpl::GetServerCertificate() {
+  if (!server_certificate_.get())
+    return 0;
+  return server_certificate_->GetReference();
+}
+
+PP_Bool TCPSocketPrivateImpl::AddChainBuildingCertificate(
+    PP_Resource certificate,
+    PP_Bool trusted) {
+  // TODO(raymes): The plumbing for this functionality is implemented but the
+  // certificates aren't yet used for the connection, so just return false for
+  // now.
+  return PP_FALSE;

[yzshen1, 2012/04/06 19:24:33]

Will you get warning on some compilers for this? You have code  that can never
be reached.

[raymes, 2012/04/06 23:22:47]

I don't see a warning about this.

+
+  ppapi::thunk::PPB_X509Certificate_Private_API* resource =

[yzshen1, 2012/04/06 19:24:33]

You could use thunk::EnterResourceNoLock?

[raymes, 2012/04/06 23:22:47]

Done.

+      PpapiGlobals::Get()->GetResourceTracker()->
+      GetResource(certificate)->AsPPB_X509Certificate_Private_API();
+  if (!resource)
+    return PP_FALSE;

[Ryan Sleevi, 2012/04/06 00:37:49]

Is this correct? I thought the caller supplied a byte array, rather than a
certificate handle. How are they expected to get such a resource handle? I'm
assuming |resource| should be an ArrayBufferVar?

Note, I would also suggest that you take the ArrayBufferVar and sanity check it
by going ArrayBufferVar to X509Certificate to ArrayBufferVar. You want to make
sure that |resource| is a valid, parsable certificate before returning PP_TRUE.
If you just stored the raw bytes as is, the caller wouldn't have any signals
whether or not |resource| was a valid cert.

Of course, since this is all not implemented, it's not something you can test
right now ;)

[raymes, 2012/04/06 23:22:47]

This is exactly what happens already. The caller first has to initialize a Cert
resource with Initialize() which verifies that it is valid. Then they pass the
resource handle of the cert to this function which keeps the bytes only.

On 2012/04/06 00:37:49, Ryan Sleevi wrote:

+
+  PP_Var der_var = resource->GetField(PP_X509CERTIFICATE_PRIVATE_RAW);

[yzshen1, 2012/04/06 19:24:33]

You are leaking PP_Var reference, right? Please be careful about PP_Resource and
PP_Var references.

[raymes, 2012/04/06 23:22:47]

Sorry, this is bad. I think I've fixed it in the correct way. It would be nice
to have a wrapper that does this when it goes out of scope.

+  ArrayBufferVar* der_array_buffer = ArrayBufferVar::FromPPVar(der_var);
+  if (!der_array_buffer)
+    return PP_FALSE;
+
+  const char* der_bytes = static_cast<const char*>(der_array_buffer->Map());
+  uint32_t der_length = der_array_buffer->ByteLength();
+  std::vector<char> der(der_bytes, der_bytes + der_length);
+  if (PP_ToBool(trusted))
+    trusted_certificates_.push_back(der);
+  else
+    untrusted_certificates_.push_back(der);
+
+  return PP_TRUE;
+}
+
 int32_t TCPSocketPrivateImpl::Read(char* buffer,
                                    int32_t bytes_to_read,
                                    PP_CompletionCallback callback) {
@@ -179,6 +223,7 @@ void TCPSocketPrivateImpl::Disconnect() {
   PostAbortIfNecessary(&write_callback_);
   read_buffer_ = NULL;
   bytes_to_read_ = -1;
+  server_certificate_ = NULL;
 }
 
 void TCPSocketPrivateImpl::OnConnectCompleted(
@@ -200,7 +245,9 @@ void TCPSocketPrivateImpl::OnConnectCompleted(
                                succeeded ? PP_OK : PP_ERROR_FAILED);
 }
 
-void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(bool succeeded) {
+void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(
+    bool succeeded,
+    const PPB_X509Certificate_Fields& certificate_fields) {
   if (connection_state_ != CONNECTED ||
       !TrackedCallback::IsPending(ssl_handshake_callback_)) {
     NOTREACHED();
@@ -209,6 +256,10 @@ void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(bool succeeded) {
 
   if (succeeded) {
     connection_state_ = SSL_CONNECTED;
+    server_certificate_ = new PPB_X509Certificate_Private_Shared(
+        resource_type_,
+        pp_instance(),
+        certificate_fields);
     TrackedCallback::ClearAndRun(&ssl_handshake_callback_, PP_OK);
   } else {
     TrackedCallback::ClearAndRun(&ssl_handshake_callback_, PP_ERROR_FAILED);