1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "net/ssl/server_bound_cert_service.h"
6
7#include <algorithm>
8#include <limits>
9
10#include "base/bind.h"
11#include "base/bind_helpers.h"
12#include "base/callback_helpers.h"
13#include "base/compiler_specific.h"
14#include "base/location.h"
15#include "base/logging.h"
16#include "base/memory/ref_counted.h"
17#include "base/memory/scoped_ptr.h"
18#include "base/message_loop/message_loop_proxy.h"
19#include "base/metrics/histogram.h"
20#include "base/rand_util.h"
21#include "base/stl_util.h"
22#include "base/task_runner.h"
23#include "crypto/ec_private_key.h"
24#include "net/base/net_errors.h"
25#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
26#include "net/cert/x509_certificate.h"
27#include "net/cert/x509_util.h"
28#include "url/gurl.h"
29
30#if defined(USE_NSS)
31#include <private/pprthred.h>  // PR_DetachThread
32#endif
33
34namespace net {
35
36namespace {
37
38const int kValidityPeriodInDays = 365;
39// When we check the system time, we add this many days to the end of the check
40// so the result will still hold even after chrome has been running for a
41// while.
42const int kSystemTimeValidityBufferInDays = 90;
43
44// Used by the GetDomainBoundCertResult histogram to record the final
45// outcome of each GetDomainBoundCert or GetOrCreateDomainBoundCert call.
46// Do not re-use values.
47enum GetCertResult {
48  // Synchronously found and returned an existing domain bound cert.
49  SYNC_SUCCESS = 0,
50  // Retrieved or generated and returned a domain bound cert asynchronously.
51  ASYNC_SUCCESS = 1,
52  // Retrieval/generation request was cancelled before the cert generation
53  // completed.
54  ASYNC_CANCELLED = 2,
55  // Cert generation failed.
56  ASYNC_FAILURE_KEYGEN = 3,
57  ASYNC_FAILURE_CREATE_CERT = 4,
58  ASYNC_FAILURE_EXPORT_KEY = 5,
59  ASYNC_FAILURE_UNKNOWN = 6,
60  // GetDomainBoundCert or GetOrCreateDomainBoundCert was called with
61  // invalid arguments.
62  INVALID_ARGUMENT = 7,
63  // We don't support any of the cert types the server requested.
64  UNSUPPORTED_TYPE = 8,
65  // Server asked for a different type of certs while we were generating one.
66  TYPE_MISMATCH = 9,
67  // Couldn't start a worker to generate a cert.
68  WORKER_FAILURE = 10,
69  GET_CERT_RESULT_MAX
70};
71
72void RecordGetDomainBoundCertResult(GetCertResult result) {
73  UMA_HISTOGRAM_ENUMERATION("DomainBoundCerts.GetDomainBoundCertResult", result,
74                            GET_CERT_RESULT_MAX);
75}
76
77void RecordGetCertTime(base::TimeDelta request_time) {
78  UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTime",
79                             request_time,
80                             base::TimeDelta::FromMilliseconds(1),
81                             base::TimeDelta::FromMinutes(5),
82                             50);
83}
84
85// On success, returns a ServerBoundCert object and sets |*error| to OK.
86// Otherwise, returns NULL, and |*error| will be set to a net error code.
87// |serial_number| is passed in because base::RandInt cannot be called from an
88// unjoined thread, due to relying on a non-leaked LazyInstance
89scoped_ptr<ServerBoundCertStore::ServerBoundCert> GenerateCert(
90    const std::string& server_identifier,
91    uint32 serial_number,
92    int* error) {
93  scoped_ptr<ServerBoundCertStore::ServerBoundCert> result;
94
95  base::TimeTicks start = base::TimeTicks::Now();
96  base::Time not_valid_before = base::Time::Now();
97  base::Time not_valid_after =
98      not_valid_before + base::TimeDelta::FromDays(kValidityPeriodInDays);
99  std::string der_cert;
100  std::vector<uint8> private_key_info;
101  scoped_ptr<crypto::ECPrivateKey> key;
102  if (!x509_util::CreateKeyAndDomainBoundCertEC(server_identifier,
103                                                serial_number,
104                                                not_valid_before,
105                                                not_valid_after,
106                                                &key,
107                                                &der_cert)) {
108    DLOG(ERROR) << "Unable to create x509 cert for client";
109    *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED;
110    return result.Pass();
111  }
112
113  if (!key->ExportEncryptedPrivateKey(ServerBoundCertService::kEPKIPassword,
114                                      1, &private_key_info)) {
115    DLOG(ERROR) << "Unable to export private key";
116    *error = ERR_PRIVATE_KEY_EXPORT_FAILED;
117    return result.Pass();
118  }
119
120  // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a
121  // std::string* to prevent this copying.
122  std::string key_out(private_key_info.begin(), private_key_info.end());
123
124  result.reset(new ServerBoundCertStore::ServerBoundCert(
125      server_identifier,
126      not_valid_before,
127      not_valid_after,
128      key_out,
129      der_cert));
130  UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime",
131                             base::TimeTicks::Now() - start,
132                             base::TimeDelta::FromMilliseconds(1),
133                             base::TimeDelta::FromMinutes(5),
134                             50);
135  *error = OK;
136  return result.Pass();
137}
138
139}  // namespace
140
141// Represents the output and result callback of a request.
142class ServerBoundCertServiceRequest {
143 public:
144  ServerBoundCertServiceRequest(base::TimeTicks request_start,
145                                const CompletionCallback& callback,
146                                std::string* private_key,
147                                std::string* cert)
148      : request_start_(request_start),
149        callback_(callback),
150        private_key_(private_key),
151        cert_(cert) {
152  }
153
154  // Ensures that the result callback will never be made.
155  void Cancel() {
156    RecordGetDomainBoundCertResult(ASYNC_CANCELLED);
157    callback_.Reset();
158    private_key_ = NULL;
159    cert_ = NULL;
160  }
161
162  // Copies the contents of |private_key| and |cert| to the caller's output
163  // arguments and calls the callback.
164  void Post(int error,
165            const std::string& private_key,
166            const std::string& cert) {
167    switch (error) {
168      case OK: {
169        base::TimeDelta request_time = base::TimeTicks::Now() - request_start_;
170        UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTimeAsync",
171                                   request_time,
172                                   base::TimeDelta::FromMilliseconds(1),
173                                   base::TimeDelta::FromMinutes(5),
174                                   50);
175        RecordGetCertTime(request_time);
176        RecordGetDomainBoundCertResult(ASYNC_SUCCESS);
177        break;
178      }
179      case ERR_KEY_GENERATION_FAILED:
180        RecordGetDomainBoundCertResult(ASYNC_FAILURE_KEYGEN);
181        break;
182      case ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED:
183        RecordGetDomainBoundCertResult(ASYNC_FAILURE_CREATE_CERT);
184        break;
185      case ERR_PRIVATE_KEY_EXPORT_FAILED:
186        RecordGetDomainBoundCertResult(ASYNC_FAILURE_EXPORT_KEY);
187        break;
188      case ERR_INSUFFICIENT_RESOURCES:
189        RecordGetDomainBoundCertResult(WORKER_FAILURE);
190        break;
191      default:
192        RecordGetDomainBoundCertResult(ASYNC_FAILURE_UNKNOWN);
193        break;
194    }
195    if (!callback_.is_null()) {
196      *private_key_ = private_key;
197      *cert_ = cert;
198      callback_.Run(error);
199    }
200    delete this;
201  }
202
203  bool canceled() const { return callback_.is_null(); }
204
205 private:
206  base::TimeTicks request_start_;
207  CompletionCallback callback_;
208  std::string* private_key_;
209  std::string* cert_;
210};
211
212// ServerBoundCertServiceWorker runs on a worker thread and takes care of the
213// blocking process of performing key generation. Will take care of deleting
214// itself once Start() is called.
215class ServerBoundCertServiceWorker {
216 public:
217  typedef base::Callback<void(
218      const std::string&,
219      int,
220      scoped_ptr<ServerBoundCertStore::ServerBoundCert>)> WorkerDoneCallback;
221
222  ServerBoundCertServiceWorker(
223      const std::string& server_identifier,
224      const WorkerDoneCallback& callback)
225      : server_identifier_(server_identifier),
226        serial_number_(base::RandInt(0, std::numeric_limits<int>::max())),
227        origin_loop_(base::MessageLoopProxy::current()),
228        callback_(callback) {
229  }
230
231  // Starts the worker on |task_runner|. If the worker fails to start, such as
232  // if the task runner is shutting down, then it will take care of deleting
233  // itself.
234  bool Start(const scoped_refptr<base::TaskRunner>& task_runner) {
235    DCHECK(origin_loop_->RunsTasksOnCurrentThread());
236
237    return task_runner->PostTask(
238        FROM_HERE,
239        base::Bind(&ServerBoundCertServiceWorker::Run, base::Owned(this)));
240  }
241
242 private:
243  void Run() {
244    // Runs on a worker thread.
245    int error = ERR_FAILED;
246    scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert =
247        GenerateCert(server_identifier_, serial_number_, &error);
248    DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error;
249#if defined(USE_NSS)
250    // Detach the thread from NSPR.
251    // Calling NSS functions attaches the thread to NSPR, which stores
252    // the NSPR thread ID in thread-specific data.
253    // The threads in our thread pool terminate after we have called
254    // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets
255    // segfaults on shutdown when the threads' thread-specific data
256    // destructors run.
257    PR_DetachThread();
258#endif
259    origin_loop_->PostTask(FROM_HERE,
260                           base::Bind(callback_, server_identifier_, error,
261                                      base::Passed(&cert)));
262  }
263
264  const std::string server_identifier_;
265  // Note that serial_number_ must be initialized on a non-worker thread
266  // (see documentation for GenerateCert).
267  uint32 serial_number_;
268  scoped_refptr<base::SequencedTaskRunner> origin_loop_;
269  WorkerDoneCallback callback_;
270
271  DISALLOW_COPY_AND_ASSIGN(ServerBoundCertServiceWorker);
272};
273
274// A ServerBoundCertServiceJob is a one-to-one counterpart of an
275// ServerBoundCertServiceWorker. It lives only on the ServerBoundCertService's
276// origin message loop.
277class ServerBoundCertServiceJob {
278 public:
279  ServerBoundCertServiceJob(bool create_if_missing)
280      : create_if_missing_(create_if_missing) {
281  }
282
283  ~ServerBoundCertServiceJob() {
284    if (!requests_.empty())
285      DeleteAllCanceled();
286  }
287
288  void AddRequest(ServerBoundCertServiceRequest* request,
289                  bool create_if_missing = false) {
290    create_if_missing_ |= create_if_missing;
291    requests_.push_back(request);
292  }
293
294  void HandleResult(int error,
295                    const std::string& private_key,
296                    const std::string& cert) {
297    PostAll(error, private_key, cert);
298  }
299
300  bool CreateIfMissing() const { return create_if_missing_; }
301
302 private:
303  void PostAll(int error,
304               const std::string& private_key,
305               const std::string& cert) {
306    std::vector<ServerBoundCertServiceRequest*> requests;
307    requests_.swap(requests);
308
309    for (std::vector<ServerBoundCertServiceRequest*>::iterator
310         i = requests.begin(); i != requests.end(); i++) {
311      (*i)->Post(error, private_key, cert);
312      // Post() causes the ServerBoundCertServiceRequest to delete itself.
313    }
314  }
315
316  void DeleteAllCanceled() {
317    for (std::vector<ServerBoundCertServiceRequest*>::iterator
318         i = requests_.begin(); i != requests_.end(); i++) {
319      if ((*i)->canceled()) {
320        delete *i;
321      } else {
322        LOG(DFATAL) << "ServerBoundCertServiceRequest leaked!";
323      }
324    }
325  }
326
327  std::vector<ServerBoundCertServiceRequest*> requests_;
328  bool create_if_missing_;
329};
330
331// static
332const char ServerBoundCertService::kEPKIPassword[] = "";
333
334ServerBoundCertService::RequestHandle::RequestHandle()
335    : service_(NULL),
336      request_(NULL) {}
337
338ServerBoundCertService::RequestHandle::~RequestHandle() {
339  Cancel();
340}
341
342void ServerBoundCertService::RequestHandle::Cancel() {
343  if (request_) {
344    service_->CancelRequest(request_);
345    request_ = NULL;
346    callback_.Reset();
347  }
348}
349
350void ServerBoundCertService::RequestHandle::RequestStarted(
351    ServerBoundCertService* service,
352    ServerBoundCertServiceRequest* request,
353    const CompletionCallback& callback) {
354  DCHECK(request_ == NULL);
355  service_ = service;
356  request_ = request;
357  callback_ = callback;
358}
359
360void ServerBoundCertService::RequestHandle::OnRequestComplete(int result) {
361  request_ = NULL;
362  // Running the callback might delete |this|, so we can't touch any of our
363  // members afterwards. Reset callback_ first.
364  base::ResetAndReturn(&callback_).Run(result);
365}
366
367ServerBoundCertService::ServerBoundCertService(
368    ServerBoundCertStore* server_bound_cert_store,
369    const scoped_refptr<base::TaskRunner>& task_runner)
370    : server_bound_cert_store_(server_bound_cert_store),
371      task_runner_(task_runner),
372      requests_(0),
373      cert_store_hits_(0),
374      inflight_joins_(0),
375      workers_created_(0),
376      weak_ptr_factory_(this) {
377  base::Time start = base::Time::Now();
378  base::Time end = start + base::TimeDelta::FromDays(
379      kValidityPeriodInDays + kSystemTimeValidityBufferInDays);
380  is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end);
381}
382
383ServerBoundCertService::~ServerBoundCertService() {
384  STLDeleteValues(&inflight_);
385}
386
387//static
388std::string ServerBoundCertService::GetDomainForHost(const std::string& host) {
389  std::string domain =
390      registry_controlled_domains::GetDomainAndRegistry(
391          host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
392  if (domain.empty())
393    return host;
394  return domain;
395}
396
397int ServerBoundCertService::GetOrCreateDomainBoundCert(
398    const std::string& host,
399    std::string* private_key,
400    std::string* cert,
401    const CompletionCallback& callback,
402    RequestHandle* out_req) {
403  DVLOG(1) << __FUNCTION__ << " " << host;
404  DCHECK(CalledOnValidThread());
405  base::TimeTicks request_start = base::TimeTicks::Now();
406
407  if (callback.is_null() || !private_key || !cert || host.empty()) {
408    RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
409    return ERR_INVALID_ARGUMENT;
410  }
411
412  std::string domain = GetDomainForHost(host);
413  if (domain.empty()) {
414    RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
415    return ERR_INVALID_ARGUMENT;
416  }
417
418  requests_++;
419
420  // See if a request for the same domain is currently in flight.
421  bool create_if_missing = true;
422  if (JoinToInFlightRequest(request_start, domain, private_key, cert,
423                            create_if_missing, callback, out_req)) {
424    return ERR_IO_PENDING;
425  }
426
427  int err = LookupDomainBoundCert(request_start, domain, private_key, cert,
428                                  create_if_missing, callback, out_req);
429  if (err == ERR_FILE_NOT_FOUND) {
430    // Sync lookup did not find a valid cert.  Start generating a new one.
431    workers_created_++;
432    ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker(
433        domain,
434        base::Bind(&ServerBoundCertService::GeneratedServerBoundCert,
435                   weak_ptr_factory_.GetWeakPtr()));
436    if (!worker->Start(task_runner_)) {
437      // TODO(rkn): Log to the NetLog.
438      LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started.";
439      RecordGetDomainBoundCertResult(WORKER_FAILURE);
440      return ERR_INSUFFICIENT_RESOURCES;
441    }
442    // We are waiting for cert generation.  Create a job & request to track it.
443    ServerBoundCertServiceJob* job =
444        new ServerBoundCertServiceJob(create_if_missing);
445    inflight_[domain] = job;
446
447    ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
448        request_start,
449        base::Bind(&RequestHandle::OnRequestComplete,
450                   base::Unretained(out_req)),
451        private_key,
452        cert);
453    job->AddRequest(request);
454    out_req->RequestStarted(this, request, callback);
455    return ERR_IO_PENDING;
456  }
457
458  return err;
459}
460
461int ServerBoundCertService::GetDomainBoundCert(
462    const std::string& host,
463    std::string* private_key,
464    std::string* cert,
465    const CompletionCallback& callback,
466    RequestHandle* out_req) {
467  DVLOG(1) << __FUNCTION__ << " " << host;
468  DCHECK(CalledOnValidThread());
469  base::TimeTicks request_start = base::TimeTicks::Now();
470
471  if (callback.is_null() || !private_key || !cert || host.empty()) {
472    RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
473    return ERR_INVALID_ARGUMENT;
474  }
475
476  std::string domain = GetDomainForHost(host);
477  if (domain.empty()) {
478    RecordGetDomainBoundCertResult(INVALID_ARGUMENT);
479    return ERR_INVALID_ARGUMENT;
480  }
481
482  requests_++;
483
484  // See if a request for the same domain currently in flight.
485  bool create_if_missing = false;
486  if (JoinToInFlightRequest(request_start, domain, private_key, cert,
487                            create_if_missing, callback, out_req)) {
488    return ERR_IO_PENDING;
489  }
490
491  int err = LookupDomainBoundCert(request_start, domain, private_key, cert,
492                                  create_if_missing, callback, out_req);
493  return err;
494}
495
496void ServerBoundCertService::GotServerBoundCert(
497    int err,
498    const std::string& server_identifier,
499    base::Time expiration_time,
500    const std::string& key,
501    const std::string& cert) {
502  DCHECK(CalledOnValidThread());
503
504  std::map<std::string, ServerBoundCertServiceJob*>::iterator j;
505  j = inflight_.find(server_identifier);
506  if (j == inflight_.end()) {
507    NOTREACHED();
508    return;
509  }
510
511  if (err == OK) {
512    // Async DB lookup found a valid cert.
513    DVLOG(1) << "Cert store had valid cert for " << server_identifier;
514    cert_store_hits_++;
515    // ServerBoundCertServiceRequest::Post will do the histograms and stuff.
516    HandleResult(OK, server_identifier, key, cert);
517    return;
518  }
519  // Async lookup did not find a valid cert. If no request asked to create one,
520  // return the error directly.
521  if (!j->second->CreateIfMissing()) {
522    HandleResult(err, server_identifier, key, cert);
523    return;
524  }
525  // At least one request asked to create a cert => start generating a new one.
526  workers_created_++;
527  ServerBoundCertServiceWorker* worker = new ServerBoundCertServiceWorker(
528      server_identifier,
529      base::Bind(&ServerBoundCertService::GeneratedServerBoundCert,
530                 weak_ptr_factory_.GetWeakPtr()));
531  if (!worker->Start(task_runner_)) {
532    // TODO(rkn): Log to the NetLog.
533    LOG(ERROR) << "ServerBoundCertServiceWorker couldn't be started.";
534    HandleResult(ERR_INSUFFICIENT_RESOURCES,
535                 server_identifier,
536                 std::string(),
537                 std::string());
538  }
539}
540
541ServerBoundCertStore* ServerBoundCertService::GetCertStore() {
542  return server_bound_cert_store_.get();
543}
544
545void ServerBoundCertService::CancelRequest(ServerBoundCertServiceRequest* req) {
546  DCHECK(CalledOnValidThread());
547  req->Cancel();
548}
549
550void ServerBoundCertService::GeneratedServerBoundCert(
551    const std::string& server_identifier,
552    int error,
553    scoped_ptr<ServerBoundCertStore::ServerBoundCert> cert) {
554  DCHECK(CalledOnValidThread());
555
556  if (error == OK) {
557    // TODO(mattm): we should just Pass() the cert object to
558    // SetServerBoundCert().
559    server_bound_cert_store_->SetServerBoundCert(
560        cert->server_identifier(),
561        cert->creation_time(),
562        cert->expiration_time(),
563        cert->private_key(),
564        cert->cert());
565
566    HandleResult(error, server_identifier, cert->private_key(), cert->cert());
567  } else {
568    HandleResult(error, server_identifier, std::string(), std::string());
569  }
570}
571
572void ServerBoundCertService::HandleResult(
573    int error,
574    const std::string& server_identifier,
575    const std::string& private_key,
576    const std::string& cert) {
577  DCHECK(CalledOnValidThread());
578
579  std::map<std::string, ServerBoundCertServiceJob*>::iterator j;
580  j = inflight_.find(server_identifier);
581  if (j == inflight_.end()) {
582    NOTREACHED();
583    return;
584  }
585  ServerBoundCertServiceJob* job = j->second;
586  inflight_.erase(j);
587
588  job->HandleResult(error, private_key, cert);
589  delete job;
590}
591
592bool ServerBoundCertService::JoinToInFlightRequest(
593    const base::TimeTicks& request_start,
594    const std::string& domain,
595    std::string* private_key,
596    std::string* cert,
597    bool create_if_missing,
598    const CompletionCallback& callback,
599    RequestHandle* out_req) {
600  ServerBoundCertServiceJob* job = NULL;
601  std::map<std::string, ServerBoundCertServiceJob*>::const_iterator j =
602      inflight_.find(domain);
603  if (j != inflight_.end()) {
604    // A request for the same domain is in flight already. We'll attach our
605    // callback, but we'll also mark it as requiring a cert if one's mising.
606    job = j->second;
607    inflight_joins_++;
608
609    ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
610        request_start,
611        base::Bind(&RequestHandle::OnRequestComplete,
612                   base::Unretained(out_req)),
613        private_key,
614        cert);
615    job->AddRequest(request, create_if_missing);
616    out_req->RequestStarted(this, request, callback);
617    return true;
618  }
619  return false;
620}
621
622int ServerBoundCertService::LookupDomainBoundCert(
623    const base::TimeTicks& request_start,
624    const std::string& domain,
625    std::string* private_key,
626    std::string* cert,
627    bool create_if_missing,
628    const CompletionCallback& callback,
629    RequestHandle* out_req) {
630  // Check if a domain bound cert already exists for this domain. Note that
631  // |expiration_time| is ignored, and expired certs are considered valid.
632  base::Time expiration_time;
633  int err = server_bound_cert_store_->GetServerBoundCert(
634      domain,
635      &expiration_time  /* ignored */,
636      private_key,
637      cert,
638      base::Bind(&ServerBoundCertService::GotServerBoundCert,
639                 weak_ptr_factory_.GetWeakPtr()));
640
641  if (err == OK) {
642    // Sync lookup found a valid cert.
643    DVLOG(1) << "Cert store had valid cert for " << domain;
644    cert_store_hits_++;
645    RecordGetDomainBoundCertResult(SYNC_SUCCESS);
646    base::TimeDelta request_time = base::TimeTicks::Now() - request_start;
647    UMA_HISTOGRAM_TIMES("DomainBoundCerts.GetCertTimeSync", request_time);
648    RecordGetCertTime(request_time);
649    return OK;
650  }
651
652  if (err == ERR_IO_PENDING) {
653    // We are waiting for async DB lookup.  Create a job & request to track it.
654    ServerBoundCertServiceJob* job =
655        new ServerBoundCertServiceJob(create_if_missing);
656    inflight_[domain] = job;
657
658    ServerBoundCertServiceRequest* request = new ServerBoundCertServiceRequest(
659        request_start,
660        base::Bind(&RequestHandle::OnRequestComplete,
661                   base::Unretained(out_req)),
662        private_key,
663        cert);
664    job->AddRequest(request);
665    out_req->RequestStarted(this, request, callback);
666    return ERR_IO_PENDING;
667  }
668
669  return err;
670}
671
672int ServerBoundCertService::cert_count() {
673  return server_bound_cert_store_->GetCertCount();
674}
675
676}  // namespace net
677