The MediatorThread worker thread needs to have a CertVerifier

for the SSLClientSocket objects it creates.

R=agl,akalin
BUG=63357,67239
TEST=Sync should not crash.
Review URL: http://codereview.chromium.org/5958001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@69549 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 75 insertions, 28 deletions

diff --git a/chrome/browser/sync/tools/sync_listen_notifications.cc b/chrome/browser/sync/tools/sync_listen_notifications.cc
index 0b20db1..d15ded3 100644
--- a/chrome/browser/sync/tools/sync_listen_notifications.cc
+++ b/chrome/browser/sync/tools/sync_listen_notifications.cc
@@ -25,6 +25,7 @@
 #include "jingle/notifier/listener/send_update_task.h"
 #include "jingle/notifier/listener/subscribe_task.h"
 #include "jingle/notifier/listener/xml_element_util.h"
+#include "net/base/cert_verifier.h"
 #include "net/base/ssl_config_service.h"
 #include "net/socket/client_socket_factory.h"
 #include "talk/base/cryptstring.h"
@@ -66,10 +67,12 @@ class XmppNotificationClient : public notifier::XmppConnection::Delegate {
   virtual ~XmppNotificationClient() {}
 
   // Connect with the given XMPP settings and run until disconnected.
-  void Run(const buzz::XmppClientSettings& xmpp_client_settings) {
+  void Run(const buzz::XmppClientSettings& xmpp_client_settings,
+           net::CertVerifier* cert_verifier) {
     DCHECK(!xmpp_connection_.get());
     xmpp_connection_.reset(
-        new notifier::XmppConnection(xmpp_client_settings, this, NULL));
+        new notifier::XmppConnection(xmpp_client_settings, cert_verifier,
+                                     this, NULL));
     MessageLoop::current()->Run();
     DCHECK(!xmpp_connection_.get());
   }
@@ -295,6 +298,8 @@ int main(int argc, char* argv[]) {
   }
   xmpp_client_settings.set_server(addr);
 
+  net::CertVerifier cert_verifier;
+
   MessageLoopForIO message_loop;
 
   // Connect and listen.
@@ -310,7 +315,7 @@ int main(int argc, char* argv[]) {
   }
   XmppNotificationClient xmpp_notification_client(
       observers.begin(), observers.end());
-  xmpp_notification_client.Run(xmpp_client_settings);
+  xmpp_notification_client.Run(xmpp_client_settings, &cert_verifier);
 
   return 0;
 }
diff --git a/jingle/notifier/base/chrome_async_socket.cc b/jingle/notifier/base/chrome_async_socket.cc
index 67c1f31..198f7db 100644
--- a/jingle/notifier/base/chrome_async_socket.cc
+++ b/jingle/notifier/base/chrome_async_socket.cc
@@ -33,6 +33,7 @@ namespace notifier {
 ChromeAsyncSocket::ChromeAsyncSocket(
     net::ClientSocketFactory* client_socket_factory,
     const net::SSLConfig& ssl_config,
+    net::CertVerifier* cert_verifier,
     size_t read_buf_size,
     size_t write_buf_size,
     net::NetLog* net_log)
@@ -46,6 +47,7 @@ ChromeAsyncSocket::ChromeAsyncSocket(
                             &ChromeAsyncSocket::ProcessSSLConnectDone),
       client_socket_factory_(client_socket_factory),
       ssl_config_(ssl_config),
+      cert_verifier_(cert_verifier),
       bound_net_log_(
           net::BoundNetLog::Make(net_log, net::NetLog::SOURCE_SOCKET)),
       state_(STATE_CLOSED),
@@ -438,7 +440,7 @@ bool ChromeAsyncSocket::StartTls(const std::string& domain_name) {
       client_socket_factory_->CreateSSLClientSocket(
           transport_socket_.release(), net::HostPortPair(domain_name, 443),
           ssl_config_, NULL /* ssl_host_info */,
-          NULL /* TODO(wtc): cert_verifier */));
+          cert_verifier_));
   int status = transport_socket_->Connect(&ssl_connect_callback_);
   if (status != net::ERR_IO_PENDING) {
     MessageLoop* message_loop = MessageLoop::current();
diff --git a/jingle/notifier/base/chrome_async_socket.h b/jingle/notifier/base/chrome_async_socket.h
index 1af5dad..a991598 100644
--- a/jingle/notifier/base/chrome_async_socket.h
+++ b/jingle/notifier/base/chrome_async_socket.h
@@ -25,6 +25,7 @@
 #include "talk/xmpp/asyncsocket.h"
 
 namespace net {
+class CertVerifier;
 class ClientSocket;
 class ClientSocketFactory;
 class IOBufferWithSize;
@@ -34,10 +35,11 @@ namespace notifier {
 
 class ChromeAsyncSocket : public buzz::AsyncSocket {
  public:
-  // Takes ownership of |client_socket_factory| but not |net_log|.
-  // |net_log| may be NULL.
+  // Takes ownership of |client_socket_factory| but not |cert_verifier| and
+  // |net_log|.  |cert_verifier| may not be NULL.  |net_log| may be NULL.
   ChromeAsyncSocket(net::ClientSocketFactory* client_socket_factory,
                     const net::SSLConfig& ssl_config,
+                    net::CertVerifier* cert_verifier,
                     size_t read_buf_size,
                     size_t write_buf_size,
                     net::NetLog* net_log);
@@ -187,6 +189,7 @@ class ChromeAsyncSocket : public buzz::AsyncSocket {
 
   scoped_ptr<net::ClientSocketFactory> client_socket_factory_;
   const net::SSLConfig ssl_config_;
+  net::CertVerifier* cert_verifier_;
   net::BoundNetLog bound_net_log_;
 
   // buzz::AsyncSocket state.
diff --git a/jingle/notifier/base/chrome_async_socket_unittest.cc b/jingle/notifier/base/chrome_async_socket_unittest.cc
index b6a3e26..842f8cb 100644
--- a/jingle/notifier/base/chrome_async_socket_unittest.cc
+++ b/jingle/notifier/base/chrome_async_socket_unittest.cc
@@ -11,9 +11,10 @@
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/scoped_ptr.h"
-#include "net/base/ssl_config_service.h"
 #include "net/base/capturing_net_log.h"
+#include "net/base/cert_verifier.h"
 #include "net/base/net_errors.h"
+#include "net/base/ssl_config_service.h"
 #include "net/socket/socket_test_util.h"
 #include "talk/base/sigslot.h"
 #include "talk/base/socketaddress.h"
@@ -115,7 +116,8 @@ class ChromeAsyncSocketTest
 
     chrome_async_socket_.reset(
         new ChromeAsyncSocket(mock_client_socket_factory.release(),
-                              ssl_config_, 14, 20, &capturing_net_log_)),
+                              ssl_config_, &cert_verifier_, 14, 20,
+                              &capturing_net_log_)),
 
     chrome_async_socket_->SignalConnected.connect(
         this, &ChromeAsyncSocketTest::OnConnect);
@@ -371,6 +373,7 @@ class ChromeAsyncSocketTest
 
   net::CapturingNetLog capturing_net_log_;
   net::SSLConfig ssl_config_;
+  net::CertVerifier cert_verifier_;
   scoped_ptr<ChromeAsyncSocket> chrome_async_socket_;
   std::deque<SignalSocketState> signal_socket_states_;
   const talk_base::SocketAddress addr_;
diff --git a/jingle/notifier/base/xmpp_connection.cc b/jingle/notifier/base/xmpp_connection.cc
index 5e08eb9..98d3070 100644
--- a/jingle/notifier/base/xmpp_connection.cc
+++ b/jingle/notifier/base/xmpp_connection.cc
@@ -20,7 +20,8 @@ namespace notifier {
 namespace {
 
 buzz::AsyncSocket* CreateSocket(
-    const buzz::XmppClientSettings& xmpp_client_settings) {
+    const buzz::XmppClientSettings& xmpp_client_settings,
+    net::CertVerifier* cert_verifier) {
   bool use_fake_ssl_client_socket =
       (xmpp_client_settings.protocol() == cricket::PROTO_SSLTCP);
   net::ClientSocketFactory* const client_socket_factory =
@@ -36,7 +37,7 @@ buzz::AsyncSocket* CreateSocket(
   // TODO(akalin): Use a real NetLog.
   net::NetLog* const net_log = NULL;
   return new ChromeAsyncSocket(
-      client_socket_factory, ssl_config,
+      client_socket_factory, ssl_config, cert_verifier,
       kReadBufSize, kWriteBufSize, net_log);
 }
 
@@ -44,6 +45,7 @@ buzz::AsyncSocket* CreateSocket(
 
 XmppConnection::XmppConnection(
     const buzz::XmppClientSettings& xmpp_client_settings,
+    net::CertVerifier* cert_verifier,
     Delegate* delegate, buzz::PreXmppAuth* pre_xmpp_auth)
     : task_pump_(new TaskPump()),
       on_connect_called_(false),
@@ -61,7 +63,8 @@ XmppConnection::XmppConnection(
   const char kLanguage[] = "en";
   buzz::XmppReturnStatus connect_status =
       weak_xmpp_client->Connect(xmpp_client_settings, kLanguage,
-                                CreateSocket(xmpp_client_settings),
+                                CreateSocket(xmpp_client_settings,
+                                             cert_verifier),
                                 pre_xmpp_auth);
   // buzz::XmppClient::Connect() should never fail.
   DCHECK_EQ(connect_status, buzz::XMPP_RETURN_OK);
diff --git a/jingle/notifier/base/xmpp_connection.h b/jingle/notifier/base/xmpp_connection.h
index 06d267b..6df2c9e 100644
--- a/jingle/notifier/base/xmpp_connection.h
+++ b/jingle/notifier/base/xmpp_connection.h
@@ -22,6 +22,10 @@ class XmlElement;
 class XmppClientSettings;
 }  // namespace
 
+namespace net {
+class CertVerifier;
+}  // namespace
+
 namespace talk_base {
 class Task;
 }  // namespace
@@ -59,11 +63,13 @@ class XmppConnection : public sigslot::has_slots<> {
                          const buzz::XmlElement* stream_error) = 0;
   };
 
+  // Does not take ownership of |cert_verifier|, which may not be NULL.
   // Does not take ownership of |delegate|, which may not be NULL.
   // Takes ownership of |pre_xmpp_auth|, which may be NULL.
   //
   // TODO(akalin): Avoid the need for |pre_xmpp_auth|.
   XmppConnection(const buzz::XmppClientSettings& xmpp_client_settings,
+                 net::CertVerifier* cert_verifier,
                  Delegate* delegate, buzz::PreXmppAuth* pre_xmpp_auth);
 
   // Invalidates any weak pointers passed to the delegate by
diff --git a/jingle/notifier/base/xmpp_connection_unittest.cc b/jingle/notifier/base/xmpp_connection_unittest.cc
index 88adfab..38f4b8f 100644
--- a/jingle/notifier/base/xmpp_connection_unittest.cc
+++ b/jingle/notifier/base/xmpp_connection_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/message_loop.h"
 #include "base/weak_ptr.h"
 #include "jingle/notifier/base/weak_xmpp_client.h"
+#include "net/base/cert_verifier.h"
 #include "talk/xmpp/prexmppauth.h"
 #include "talk/xmpp/xmppclientsettings.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -76,12 +77,13 @@ class XmppConnectionTest : public testing::Test {
 
   // Needed by XmppConnection.
   MessageLoop message_loop_;
+  net::CertVerifier cert_verifier_;
   MockXmppConnectionDelegate mock_xmpp_connection_delegate_;
   scoped_ptr<MockPreXmppAuth> mock_pre_xmpp_auth_;
 };
 
 TEST_F(XmppConnectionTest, CreateDestroy) {
-  XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+  XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                  &mock_xmpp_connection_delegate_, NULL);
 }
 
@@ -92,7 +94,7 @@ TEST_F(XmppConnectionTest, ImmediateFailure) {
   EXPECT_CALL(mock_xmpp_connection_delegate_,
               OnError(buzz::XmppEngine::ERROR_NONE, 0, NULL));
 
-  XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+  XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                  &mock_xmpp_connection_delegate_, NULL);
 
   // We need to do this *before* |xmpp_connection| gets destroyed or
@@ -111,8 +113,8 @@ TEST_F(XmppConnectionTest, PreAuthFailure) {
               OnError(buzz::XmppEngine::ERROR_AUTH, 5, NULL));
 
   XmppConnection xmpp_connection(
-      buzz::XmppClientSettings(), &mock_xmpp_connection_delegate_,
-      mock_pre_xmpp_auth_.release());
+      buzz::XmppClientSettings(), &cert_verifier_,
+      &mock_xmpp_connection_delegate_, mock_pre_xmpp_auth_.release());
 
   // We need to do this *before* |xmpp_connection| gets destroyed or
   // our delegate won't be called.
@@ -129,8 +131,8 @@ TEST_F(XmppConnectionTest, FailureAfterPreAuth) {
               OnError(buzz::XmppEngine::ERROR_NONE, 0, NULL));
 
   XmppConnection xmpp_connection(
-      buzz::XmppClientSettings(), &mock_xmpp_connection_delegate_,
-      mock_pre_xmpp_auth_.release());
+      buzz::XmppClientSettings(), &cert_verifier_,
+      &mock_xmpp_connection_delegate_, mock_pre_xmpp_auth_.release());
 
   // We need to do this *before* |xmpp_connection| gets destroyed or
   // our delegate won't be called.
@@ -141,7 +143,7 @@ TEST_F(XmppConnectionTest, RaisedError) {
   EXPECT_CALL(mock_xmpp_connection_delegate_,
               OnError(buzz::XmppEngine::ERROR_NONE, 0, NULL));
 
-  XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+  XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                  &mock_xmpp_connection_delegate_, NULL);
 
   xmpp_connection.weak_xmpp_client_->
@@ -154,7 +156,7 @@ TEST_F(XmppConnectionTest, Connect) {
       WillOnce(SaveArg<0>(&weak_ptr));
 
   {
-    XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+    XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                    &mock_xmpp_connection_delegate_, NULL);
 
     xmpp_connection.weak_xmpp_client_->
@@ -171,7 +173,7 @@ TEST_F(XmppConnectionTest, MultipleConnect) {
     EXPECT_CALL(mock_xmpp_connection_delegate_, OnConnect(_)).
         WillOnce(SaveArg<0>(&weak_ptr));
 
-    XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+    XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                    &mock_xmpp_connection_delegate_, NULL);
 
     xmpp_connection.weak_xmpp_client_->
@@ -192,7 +194,7 @@ TEST_F(XmppConnectionTest, ConnectThenError) {
   EXPECT_CALL(mock_xmpp_connection_delegate_,
               OnError(buzz::XmppEngine::ERROR_NONE, 0, NULL));
 
-  XmppConnection xmpp_connection(buzz::XmppClientSettings(),
+  XmppConnection xmpp_connection(buzz::XmppClientSettings(), &cert_verifier_,
                                  &mock_xmpp_connection_delegate_, NULL);
 
   xmpp_connection.weak_xmpp_client_->
diff --git a/jingle/notifier/communicator/login.cc b/jingle/notifier/communicator/login.cc
index 33a2124..de0d525 100644
--- a/jingle/notifier/communicator/login.cc
+++ b/jingle/notifier/communicator/login.cc
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <string>
-
 #include "jingle/notifier/communicator/login.h"
 
+#include <string>
+
 #include "base/logging.h"
 #include "base/rand_util.h"
 #include "base/time.h"
@@ -34,6 +34,7 @@ Login::Login(Delegate* delegate,
              const buzz::XmppClientSettings& user_settings,
              const ConnectionOptions& options,
              net::HostResolver* host_resolver,
+             net::CertVerifier* cert_verifier,
              ServerInformation* server_list,
              int server_count,
              bool try_ssltcp_first)
@@ -41,6 +42,7 @@ Login::Login(Delegate* delegate,
       login_settings_(new LoginSettings(user_settings,
                                         options,
                                         host_resolver,
+                                        cert_verifier,
                                         server_list,
                                         server_count,
                                         try_ssltcp_first)),
diff --git a/jingle/notifier/communicator/login.h b/jingle/notifier/communicator/login.h
index fec490e..e4ec069b 100644
--- a/jingle/notifier/communicator/login.h
+++ b/jingle/notifier/communicator/login.h
@@ -22,6 +22,7 @@ class XmppClientSettings;
 }  // namespace buzz
 
 namespace net {
+class CertVerifier;
 class HostResolver;
 }  // namespace net
 
@@ -54,12 +55,13 @@ class Login : public net::NetworkChangeNotifier::Observer,
     virtual void OnDisconnect() = 0;
   };
 
-  // Does not take ownership of |delegate|, |host_resolver|, or
-  // |server_list|, none of which may be NULL.
+  // Does not take ownership of |delegate|, |host_resolver|, |cert_verifier|,
+  // or |server_list|, none of which may be NULL.
   Login(Delegate* delegate,
         const buzz::XmppClientSettings& user_settings,
         const ConnectionOptions& options,
         net::HostResolver* host_resolver,
+        net::CertVerifier* cert_verifier,
         ServerInformation* server_list,
         int server_count,
         bool try_ssltcp_first);
diff --git a/jingle/notifier/communicator/login_settings.cc b/jingle/notifier/communicator/login_settings.cc
index 01b47f6..fd70400 100644
--- a/jingle/notifier/communicator/login_settings.cc
+++ b/jingle/notifier/communicator/login_settings.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -9,6 +9,7 @@
 #include "base/logging.h"
 #include "jingle/notifier/communicator/connection_options.h"
 #include "jingle/notifier/communicator/xmpp_connection_generator.h"
+#include "net/base/cert_verifier.h"
 #include "talk/base/common.h"
 #include "talk/base/socketaddress.h"
 #include "talk/xmpp/xmppclientsettings.h"
@@ -18,11 +19,13 @@ namespace notifier {
 LoginSettings::LoginSettings(const buzz::XmppClientSettings& user_settings,
                              const ConnectionOptions& options,
                              net::HostResolver* host_resolver,
+                             net::CertVerifier* cert_verifier,
                              ServerInformation* server_list,
                              int server_count,
                              bool try_ssltcp_first)
     :  try_ssltcp_first_(try_ssltcp_first),
        host_resolver_(host_resolver),
+       cert_verifier_(cert_verifier),
        server_list_(new ServerInformation[server_count]),
        server_count_(server_count),
        user_settings_(new buzz::XmppClientSettings(user_settings)),
@@ -30,6 +33,7 @@ LoginSettings::LoginSettings(const buzz::XmppClientSettings& user_settings,
   // Note: firewall may be NULL.
   DCHECK(server_list);
   DCHECK(host_resolver);
+  DCHECK(cert_verifier);
   DCHECK_GT(server_count, 0);
   for (int i = 0; i < server_count_; ++i) {
     server_list_[i] = server_list[i];
diff --git a/jingle/notifier/communicator/login_settings.h b/jingle/notifier/communicator/login_settings.h
index d97e987..79d0e22 100644
--- a/jingle/notifier/communicator/login_settings.h
+++ b/jingle/notifier/communicator/login_settings.h
@@ -14,6 +14,7 @@ class XmppClientSettings;
 }
 
 namespace net {
+class CertVerifier;
 class HostPortPair;
 class HostResolver;
 }
@@ -31,6 +32,7 @@ class LoginSettings {
   LoginSettings(const buzz::XmppClientSettings& user_settings,
                 const ConnectionOptions& options,
                 net::HostResolver* host_resolver,
+                net::CertVerifier* cert_verifier,
                 ServerInformation* server_list,
                 int server_count,
                 bool try_ssltcp_first);
@@ -45,6 +47,10 @@ class LoginSettings {
     return host_resolver_;
   }
 
+  net::CertVerifier* cert_verifier() {
+    return cert_verifier_;
+  }
+
   const ServerInformation* server_list() const {
     return server_override_.get() ? server_override_.get() : server_list_.get();
   }
@@ -72,6 +78,7 @@ class LoginSettings {
   bool try_ssltcp_first_;
 
   net::HostResolver* host_resolver_;
+  net::CertVerifier* cert_verifier_;
   talk_base::scoped_array<ServerInformation> server_list_;
   int server_count_;
   // Used to handle redirects
diff --git a/jingle/notifier/communicator/single_login_attempt.cc b/jingle/notifier/communicator/single_login_attempt.cc
index 548174b..fdd8ad5 100644
--- a/jingle/notifier/communicator/single_login_attempt.cc
+++ b/jingle/notifier/communicator/single_login_attempt.cc
@@ -115,7 +115,8 @@ void SingleLoginAttempt::OnNewSettings(
           jid.Str(), client_settings.auth_cookie(),
           client_settings.token_service());
   xmpp_connection_.reset(
-      new XmppConnection(client_settings, this, pre_xmpp_auth));
+      new XmppConnection(client_settings, login_settings_->cert_verifier(),
+                         this, pre_xmpp_auth));
 }
 
 void SingleLoginAttempt::OnExhaustedSettings(
diff --git a/jingle/notifier/listener/mediator_thread_impl.cc b/jingle/notifier/listener/mediator_thread_impl.cc
index ca384af..032c08e 100644
--- a/jingle/notifier/listener/mediator_thread_impl.cc
+++ b/jingle/notifier/listener/mediator_thread_impl.cc
@@ -13,6 +13,7 @@
 #include "jingle/notifier/listener/listen_task.h"
 #include "jingle/notifier/listener/send_update_task.h"
 #include "jingle/notifier/listener/subscribe_task.h"
+#include "net/base/cert_verifier.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/host_resolver.h"
 #include "talk/xmpp/xmppclientsettings.h"
@@ -118,16 +119,19 @@ void MediatorThreadImpl::DoLogin(
 
   // TODO(akalin): Use an existing HostResolver from somewhere (maybe
   // the IOThread one).
+  // TODO(wtc): Sharing HostResolver and CertVerifier with the IO Thread won't
+  // work because HostResolver and CertVerifier are single-threaded.
   host_resolver_.reset(
       net::CreateSystemHostResolver(net::HostResolver::kDefaultParallelism,
                                     NULL, NULL));
+  cert_verifier_.reset(new net::CertVerifier);
 
   notifier::ServerInformation server_list[2];
   int server_list_count = 0;
 
   // Override the default servers with a test notification server if one was
   // provided.
-  if(!notifier_options_.xmpp_host_port.host().empty()) {
+  if (!notifier_options_.xmpp_host_port.host().empty()) {
     server_list[0].server = notifier_options_.xmpp_host_port;
     server_list[0].special_port_magic = false;
     server_list_count = 1;
@@ -149,6 +153,7 @@ void MediatorThreadImpl::DoLogin(
                                    settings,
                                    options,
                                    host_resolver_.get(),
+                                   cert_verifier_.get(),
                                    server_list,
                                    server_list_count,
                                    notifier_options_.try_ssltcp_first));
@@ -159,6 +164,7 @@ void MediatorThreadImpl::DoDisconnect() {
   DCHECK_EQ(MessageLoop::current(), worker_message_loop());
   VLOG(1) << "P2P: Thread logging out of talk network.";
   login_.reset();
+  cert_verifier_.reset();
   host_resolver_.reset();
   base_task_.reset();
 }
diff --git a/jingle/notifier/listener/mediator_thread_impl.h b/jingle/notifier/listener/mediator_thread_impl.h
index 302c183..c55cab1 100644
--- a/jingle/notifier/listener/mediator_thread_impl.h
+++ b/jingle/notifier/listener/mediator_thread_impl.h
@@ -105,6 +105,7 @@ class MediatorThreadImpl : public MediatorThread, public LoginDelegate,
 
   base::Thread worker_thread_;
   scoped_ptr<net::HostResolver> host_resolver_;
+  scoped_ptr<net::CertVerifier> cert_verifier_;
 
   scoped_ptr<notifier::Login> login_;