BHttpRequest: propagate SSL errors to listener

This way it's possible to handle them in applications.

headers/os/net/HttpRequest.h

@@ -8,6 +8,7 @@
 
 #include <deque>
 
+#include <Certificate.h>
 #include <HttpForm.h>
 #include <HttpHeaders.h>
 #include <HttpResult.h>
@@ -74,6 +75,12 @@ private:
 			void				_SetResultStatusCode(int32 statusCode);
 			BString&			_ResultStatusText();
 
+	// SSL failure management
+	friend	class				CheckedSecureSocket;
+			bool				_CertificateVerificationFailed(
+									BCertificate& certificate,
+									const char* message);
+
 	// Utility methods
 			bool				_IsDefaultPort();
 

headers/os/net/UrlProtocolDispatchingListener.h

@@ -26,7 +26,8 @@ enum {
 	B_URL_PROTOCOL_DATA_RECEIVED,
 	B_URL_PROTOCOL_DOWNLOAD_PROGRESS,
 	B_URL_PROTOCOL_UPLOAD_PROGRESS,
-	B_URL_PROTOCOL_REQUEST_COMPLETED
+	B_URL_PROTOCOL_REQUEST_COMPLETED,
+	B_URL_PROTOCOL_CERTIFICATE_VERIFICATION_FAILED
 };
 
 
@@ -52,6 +53,10 @@ public:
 									ssize_t bytesSent, ssize_t bytesTotal);
 	virtual void				RequestCompleted(BUrlRequest* caller,
 									bool success);
+	virtual bool				CertificateVerificationFailed(
+									BUrlRequest* caller,
+									BCertificate& certificate,
+									const char* message);
 
 private:
 			void				_SendMessage(BMessage* message,

headers/os/net/UrlProtocolListener.h

@@ -9,6 +9,8 @@
 #include <stddef.h>
 #include <cstdlib>
 
+
+class BCertificate;
 class BUrlRequest;
 
 
@@ -117,6 +119,19 @@ public:
 	virtual void				DebugMessage(BUrlRequest* caller,
 									BUrlProtocolDebugMessage type,
 									const char* text);
+
+	/**
+		CertificateVerificationFailed(certificate, message)
+		Frequency: Once
+		Parameters: certificate	SSL certificate which coulnd't be validated
+					message error message describing the problem
+
+		Return true to proceed anyway, false to abort the connection
+	*/
+	virtual bool				CertificateVerificationFailed(
+									BUrlRequest* caller,
+									BCertificate& certificate,
+									const char* message);
 };
 
 #endif // _B_URL_PROTOCOL_LISTENER_H_

src/kits/network/libnetapi/HttpRequest.cpp

@@ -19,6 +19,7 @@
 #include <new>
 
 #include <AutoDeleter.h>
+#include <Certificate.h>
 #include <Debug.h>
 #include <DynamicBuffer.h>
 #include <File.h>
@@ -31,6 +32,35 @@
 static const int32 kHttpBufferSize = 4096;
 
 
+class CheckedSecureSocket: public BSecureSocket
+{
+public:
+					CheckedSecureSocket(BHttpRequest* request);
+
+	bool			CertificateVerificationFailed(BCertificate& certificate,
+						const char* message);
+
+private:
+	BHttpRequest*	fRequest;
+};
+
+
+CheckedSecureSocket::CheckedSecureSocket(BHttpRequest* request)
+	:
+	BSecureSocket(),
+	fRequest(request)
+{
+}
+
+
+bool
+CheckedSecureSocket::CertificateVerificationFailed(BCertificate& certificate,
+	const char* message)
+{
+	return fRequest->_CertificateVerificationFailed(certificate, message);
+}
+
+
 BHttpRequest::BHttpRequest(const BUrl& url, bool ssl, const char* protocolName,
 	BUrlProtocolListener* listener, BUrlContext* context)
 	:
@@ -50,7 +80,7 @@ BHttpRequest::BHttpRequest(const BUrl& url, bool ssl, const char* protocolName,
 {
 	_ResetOptions();
 	if (fSSL)
-		fSocket = new(std::nothrow) BSecureSocket();
+		fSocket = new(std::nothrow) CheckedSecureSocket(this);
 	else
 		fSocket = new(std::nothrow) BSocket();
 }
@@ -76,7 +106,7 @@ BHttpRequest::BHttpRequest(const BHttpRequest& other)
 	_ResetOptions();
 		// FIXME some options may be copied from other instead.
 	if (fSSL)
-		fSocket = new(std::nothrow) BSecureSocket();
+		fSocket = new(std::nothrow) CheckedSecureSocket(this);
 	else
 		fSocket = new(std::nothrow) BSocket();
 }
@@ -1022,7 +1052,21 @@ BHttpRequest::_ResultStatusText()
 }
 
 
-bool BHttpRequest::_IsDefaultPort()
+bool
+BHttpRequest::_CertificateVerificationFailed(BCertificate& certificate,
+	const char* message)
+{
+	if (fListener != NULL) {
+		return fListener->CertificateVerificationFailed(this, certificate,
+			message);
+	}
+
+	return false;
+}
+
+
+bool
+BHttpRequest::_IsDefaultPort()
 {
 	if (fSSL && Url().Port() == 443)
 		return true;

src/kits/network/libnetapi/UrlProtocolAsynchronousListener.cpp

@@ -142,6 +142,20 @@ BUrlProtocolAsynchronousListener::MessageReceived(BMessage* message)
 			}
 			break;
 
+		case B_URL_PROTOCOL_CERTIFICATE_VERIFICATION_FAILED:
+			{
+				const char* error = message->FindString("url:error");
+				BCertificate* certificate;
+				message->FindPointer("url:certificate", (void**)&certificate);
+				bool result = CertificateVerificationFailed(caller,
+					*certificate, error);
+
+				BMessage reply;
+				reply.AddBool("url:continue", result);
+				message->SendReply(&reply);
+			}
+			break;
+
 		default:
 			PRINT(("BUrlProtocolAsynchronousListener: Unknown notification %d\n",
 				notification));

src/kits/network/libnetapi/UrlProtocolDispatchingListener.cpp

@@ -125,6 +125,25 @@ BUrlProtocolDispatchingListener::RequestCompleted(BUrlRequest* caller,
 }
 
 
+bool
+BUrlProtocolDispatchingListener::CertificateVerificationFailed(
+	BUrlRequest* caller, BCertificate& certificate, const char* error)
+{
+	BMessage message(B_URL_PROTOCOL_NOTIFICATION);
+	message.AddString("url:error", error);
+	message.AddPointer("url:certificate", &certificate);
+	message.AddInt8(kUrlProtocolMessageType,
+		B_URL_PROTOCOL_CERTIFICATE_VERIFICATION_FAILED);
+	message.AddPointer(kUrlProtocolCaller, caller);
+
+	// Warning: synchronous reply
+	BMessage reply;
+	fMessenger.SendMessage(&message, &reply);
+
+	return reply.FindBool("url:continue");
+}
+
+
 void
 BUrlProtocolDispatchingListener::_SendMessage(BMessage* message, 
 	int8 notification, BUrlRequest* caller)

src/kits/network/libnetapi/UrlProtocolListener.cpp

@@ -27,6 +27,14 @@ BUrlProtocolListener::HostnameResolved(BUrlRequest*, const char*)
 }
 
 
+bool
+BUrlProtocolListener::CertificateVerificationFailed(BUrlRequest* caller,
+	BCertificate& certificate, const char* message)
+{
+	return false;
+}
+
+
 void
 BUrlProtocolListener::ResponseStarted(BUrlRequest*)
 {