Adds RTCCertificate, a reference counted object indirectly owning an SSLCertificate

webrtc/base/rtccertificate.h

Index: webrtc/base/rtccertificate.h
diff --git a/webrtc/base/rtccertificate.h b/webrtc/base/rtccertificate.h
new file mode 100644
index 0000000000000000000000000000000000000000..98c8baecd8fc75e9553ae48d99f3089aee75e123
--- /dev/null
+++ b/webrtc/base/rtccertificate.h
@@ -0,0 +1,51 @@
+/*
+ *  Copyright 2015 The WebRTC Project Authors. All rights reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef WEBRTC_BASE_RTCCERTIFICATE_H_
+#define WEBRTC_BASE_RTCCERTIFICATE_H_
+
+#include "webrtc/base/refcount.h"
+#include "webrtc/base/scoped_ptr.h"
+#include "webrtc/base/scoped_ref_ptr.h"
+#include "webrtc/base/sslidentity.h"
+#include "webrtc/base/timeutils.h"
+
+namespace rtc {

[hbos, 2015/08/19 14:31:23]

Note that I placed this in webrtc/base under the rtc namespace and in the
rtc_base build target.

+
+// A thin abstraction layer between "lower level crypto stuff" like
+// SSLCertificate and WebRTC usage. Takes ownership of some lower level objects,
+// reference counting protects these from premature destruction.
+class RTCCertificate : public RefCountInterface {
+ public:
+  // Takes ownership of |identity|.
+  static scoped_refptr<RTCCertificate> Create(scoped_ptr<SSLIdentity> identity);
+
+  uint64 expires_ns() const;
+  const SSLCertificate& ssl_certificate() const;
+
+  // TODO(hbos): If possible, remove once RTCCertificate and its
+  // ssl_certificate() is used in all relevant places. Should not pass around
+  // raw SSLIdentity* for the sake of accessing SSLIdentity::certificate().
+  // However, some places might need SSLIdentity* for its public/private key...
+  SSLIdentity* identity() const { return identity_.get(); }

[hbos, 2015/08/19 14:31:24]

The SSLIdentity owns both the key pair and the SSLCertificate. Un-entangling
"certificate" from "key pair" would require a lot of clean up work that's
probably not worth doing now...
But theoretically a certificate should be separate from a key pair.

(Not even the WebRTC specs seems to distinguish generating keys from generating
certificates?)

I imagine we want to replace SSLIdentity* with scoped_refptr<RTCCertificate> in
a lot of places though, and for now having access to the underlying SSLIdentity*
might be necessary in some parts of the code, even though ideally a certificate
should just be expires_ns & ssl_certificate.

+
+ protected:
+  explicit RTCCertificate(SSLIdentity* identity);

[hbos, 2015/08/19 14:31:23]

Reason for not using scoped_ptr in constructor: The constructor of
RefCountedObject<RTCCertificate> does not realize it has to do .Pass() with
scoped_ptr parameters.
The static Create function substitutes a public constructor.

+  ~RTCCertificate() override;
+
+ private:
+  // The SSLIdentity is the owner of the SSLCertificate. To protect our
+  // ssl_certificate() we take ownership of |identity_|.
+  scoped_ptr<SSLIdentity> identity_;
+};
+
+}  // namespace rtc
+
+#endif  // WEBRTC_BASE_RTCCERTIFICATE_H_