This adds the following to functions to the ppapi TCPSocket interface:

1) GetServer certificate, which returns the server X509Certificate if an SSL connection has been established.
2) AddChainBuilding certificate. This is currently unimplemented in Chrome but the interface and plumbing has been added so it can easily be hooked up. This should add a trusted/untrusted chain building certificate to be used by the client for a particular connection when performing the SSL handshake.

BUG=114626
TEST=out/Release/browser_tests --gtest_filter=*PPAPITest.*TCP*Trusted*


Review URL: http://codereview.chromium.org/9699100

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@131918 0039d316-1c4b-4281-b951-d872f2087c98

24 files changed, 521 insertions, 99 deletions

diff --git a/ppapi/api/private/ppb_tcp_socket_private.idl b/ppapi/api/private/ppb_tcp_socket_private.idl
index ae5cba2..385dee6 100644
--- a/ppapi/api/private/ppb_tcp_socket_private.idl
+++ b/ppapi/api/private/ppb_tcp_socket_private.idl
@@ -8,7 +8,8 @@
  */
 
 label Chrome {
-  M17 = 0.3
+  M17 = 0.3,
+  M20 = 0.4
 };
 
 /**
@@ -77,6 +78,28 @@ interface PPB_TCPSocket_Private {
                        [in] PP_CompletionCallback callback);
 
   /**
+   * Returns the server's <code>PPB_X509Certificate_Private</code> for a socket
+   * connection if an SSL connection has been established using
+   * <code>SSLHandshake</code>. If no SSL connection has been established, a
+   * null resource is returned.
+   */
+  [version=0.4]
+  PP_Resource GetServerCertificate([in] PP_Resource tcp_socket);
+
+  /**
+   * NOTE: This function is not implemented and will return
+   * <code>PP_FALSE</code>.
+   * Adds a trusted/untrusted chain building certificate to be used for this
+   * connection. The <code>certificate</code> must be a
+   * <code>PPB_X509Certificate_Private<code>. <code>PP_TRUE</code> is returned
+   * upon success.
+   */
+  [version=0.4]
+  PP_Bool AddChainBuildingCertificate([in] PP_Resource tcp_socket,
+                                      [in] PP_Resource certificate,
+                                      [in] PP_Bool is_trusted);
+
+  /**
    * Reads data from the socket. The size of |buffer| must be at least as large
    * as |bytes_to_read|. May perform a partial read. Returns the number of bytes
    * read or an error code. If the return value is 0, then it indicates that
diff --git a/ppapi/c/private/ppb_tcp_socket_private.h b/ppapi/c/private/ppb_tcp_socket_private.h
index 7cdf591..7d6ca46 100644
--- a/ppapi/c/private/ppb_tcp_socket_private.h
+++ b/ppapi/c/private/ppb_tcp_socket_private.h
@@ -3,7 +3,7 @@
  * found in the LICENSE file.
  */
 
-/* From private/ppb_tcp_socket_private.idl modified Wed Nov 16 15:27:20 2011. */
+/* From private/ppb_tcp_socket_private.idl modified Fri Apr  6 14:42:45 2012. */
 
 #ifndef PPAPI_C_PRIVATE_PPB_TCP_SOCKET_PRIVATE_H_
 #define PPAPI_C_PRIVATE_PPB_TCP_SOCKET_PRIVATE_H_
@@ -17,7 +17,8 @@
 #include "ppapi/c/private/ppb_net_address_private.h"
 
 #define PPB_TCPSOCKET_PRIVATE_INTERFACE_0_3 "PPB_TCPSocket_Private;0.3"
-#define PPB_TCPSOCKET_PRIVATE_INTERFACE PPB_TCPSOCKET_PRIVATE_INTERFACE_0_3
+#define PPB_TCPSOCKET_PRIVATE_INTERFACE_0_4 "PPB_TCPSocket_Private;0.4"
+#define PPB_TCPSOCKET_PRIVATE_INTERFACE PPB_TCPSOCKET_PRIVATE_INTERFACE_0_4
 
 /**
  * @file
@@ -33,7 +34,7 @@
  * The <code>PPB_TCPSocket_Private</code> interface provides TCP socket
  * operations.
  */
-struct PPB_TCPSocket_Private_0_3 {
+struct PPB_TCPSocket_Private_0_4 {
   /**
    * Allocates a TCP socket resource.
    */
@@ -88,6 +89,24 @@ struct PPB_TCPSocket_Private_0_3 {
                           uint16_t server_port,
                           struct PP_CompletionCallback callback);
   /**
+   * Returns the server's <code>PPB_X509Certificate_Private</code> for a socket
+   * connection if an SSL connection has been established using
+   * <code>SSLHandshake</code>. If no SSL connection has been established, a
+   * null resource is returned.
+   */
+  PP_Resource (*GetServerCertificate)(PP_Resource tcp_socket);
+  /**
+   * NOTE: This function is not implemented and will return
+   * <code>PP_FALSE</code>.
+   * Adds a trusted/untrusted chain building certificate to be used for this
+   * connection. The <code>certificate</code> must be a
+   * <code>PPB_X509Certificate_Private<code>. <code>PP_TRUE</code> is returned
+   * upon success.
+   */
+  PP_Bool (*AddChainBuildingCertificate)(PP_Resource tcp_socket,
+                                         PP_Resource certificate,
+                                         PP_Bool is_trusted);
+  /**
    * Reads data from the socket. The size of |buffer| must be at least as large
    * as |bytes_to_read|. May perform a partial read. Returns the number of bytes
    * read or an error code. If the return value is 0, then it indicates that
@@ -122,7 +141,36 @@ struct PPB_TCPSocket_Private_0_3 {
   void (*Disconnect)(PP_Resource tcp_socket);
 };
 
-typedef struct PPB_TCPSocket_Private_0_3 PPB_TCPSocket_Private;
+typedef struct PPB_TCPSocket_Private_0_4 PPB_TCPSocket_Private;
+
+struct PPB_TCPSocket_Private_0_3 {
+  PP_Resource (*Create)(PP_Instance instance);
+  PP_Bool (*IsTCPSocket)(PP_Resource resource);
+  int32_t (*Connect)(PP_Resource tcp_socket,
+                     const char* host,
+                     uint16_t port,
+                     struct PP_CompletionCallback callback);
+  int32_t (*ConnectWithNetAddress)(PP_Resource tcp_socket,
+                                   const struct PP_NetAddress_Private* addr,
+                                   struct PP_CompletionCallback callback);
+  PP_Bool (*GetLocalAddress)(PP_Resource tcp_socket,
+                             struct PP_NetAddress_Private* local_addr);
+  PP_Bool (*GetRemoteAddress)(PP_Resource tcp_socket,
+                              struct PP_NetAddress_Private* remote_addr);
+  int32_t (*SSLHandshake)(PP_Resource tcp_socket,
+                          const char* server_name,
+                          uint16_t server_port,
+                          struct PP_CompletionCallback callback);
+  int32_t (*Read)(PP_Resource tcp_socket,
+                  char* buffer,
+                  int32_t bytes_to_read,
+                  struct PP_CompletionCallback callback);
+  int32_t (*Write)(PP_Resource tcp_socket,
+                   const char* buffer,
+                   int32_t bytes_to_write,
+                   struct PP_CompletionCallback callback);
+  void (*Disconnect)(PP_Resource tcp_socket);
+};
 /**
  * @}
  */
diff --git a/ppapi/cpp/private/tcp_socket_private.cc b/ppapi/cpp/private/tcp_socket_private.cc
index e15f537..f60f2ef 100644
--- a/ppapi/cpp/private/tcp_socket_private.cc
+++ b/ppapi/cpp/private/tcp_socket_private.cc
@@ -15,15 +15,22 @@ namespace pp {
 
 namespace {
 
-template <> const char* interface_name<PPB_TCPSocket_Private>() {
-  return PPB_TCPSOCKET_PRIVATE_INTERFACE;
+template <> const char* interface_name<PPB_TCPSocket_Private_0_4>() {
+  return PPB_TCPSOCKET_PRIVATE_INTERFACE_0_4;
+}
+
+template <> const char* interface_name<PPB_TCPSocket_Private_0_3>() {
+  return PPB_TCPSOCKET_PRIVATE_INTERFACE_0_3;
 }
 
 }  // namespace
 
 TCPSocketPrivate::TCPSocketPrivate(const InstanceHandle& instance) {
-  if (has_interface<PPB_TCPSocket_Private>()) {
-    PassRefFromConstructor(get_interface<PPB_TCPSocket_Private>()->Create(
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    PassRefFromConstructor(get_interface<PPB_TCPSocket_Private_0_4>()->Create(
+        instance.pp_instance()));
+  } else if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    PassRefFromConstructor(get_interface<PPB_TCPSocket_Private_0_3>()->Create(
         instance.pp_instance()));
   }
 }
@@ -34,76 +41,143 @@ TCPSocketPrivate::TCPSocketPrivate(PassRef, PP_Resource resource)
 
 // static
 bool TCPSocketPrivate::IsAvailable() {
-  return has_interface<PPB_TCPSocket_Private>();
+  return has_interface<PPB_TCPSocket_Private_0_4>() ||
+      has_interface<PPB_TCPSocket_Private_0_3>();
 }
 
 int32_t TCPSocketPrivate::Connect(const char* host,
                                   uint16_t port,
                                   const CompletionCallback& callback) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return callback.MayForce(PP_ERROR_NOINTERFACE);
-  return get_interface<PPB_TCPSocket_Private>()->Connect(
-      pp_resource(), host, port, callback.pp_completion_callback());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->Connect(
+        pp_resource(), host, port, callback.pp_completion_callback());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->Connect(
+        pp_resource(), host, port, callback.pp_completion_callback());
+  }
+  return callback.MayForce(PP_ERROR_NOINTERFACE);
 }
 
 int32_t TCPSocketPrivate::ConnectWithNetAddress(
     const PP_NetAddress_Private* addr,
     const CompletionCallback& callback) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return callback.MayForce(PP_ERROR_NOINTERFACE);
-  return get_interface<PPB_TCPSocket_Private>()->ConnectWithNetAddress(
-      pp_resource(), addr, callback.pp_completion_callback());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->ConnectWithNetAddress(
+        pp_resource(), addr, callback.pp_completion_callback());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->ConnectWithNetAddress(
+        pp_resource(), addr, callback.pp_completion_callback());
+  }
+  return callback.MayForce(PP_ERROR_NOINTERFACE);
 }
 
 bool TCPSocketPrivate::GetLocalAddress(PP_NetAddress_Private* local_addr) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return false;
-
-  PP_Bool result = get_interface<PPB_TCPSocket_Private>()->GetLocalAddress(
-      pp_resource(), local_addr);
-  return PP_ToBool(result);
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    PP_Bool result = get_interface<PPB_TCPSocket_Private_0_4>()->
+        GetLocalAddress(pp_resource(), local_addr);
+    return PP_ToBool(result);
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    PP_Bool result = get_interface<PPB_TCPSocket_Private_0_3>()->
+        GetLocalAddress(pp_resource(), local_addr);
+    return PP_ToBool(result);
+  }
+  return false;
 }
 
 bool TCPSocketPrivate::GetRemoteAddress(PP_NetAddress_Private* remote_addr) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return false;
-  PP_Bool result = get_interface<PPB_TCPSocket_Private>()->GetRemoteAddress(
-      pp_resource(), remote_addr);
-  return PP_ToBool(result);
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    PP_Bool result = get_interface<PPB_TCPSocket_Private_0_4>()->
+        GetRemoteAddress(pp_resource(), remote_addr);
+    return PP_ToBool(result);
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    PP_Bool result = get_interface<PPB_TCPSocket_Private_0_3>()->
+        GetRemoteAddress(pp_resource(), remote_addr);
+    return PP_ToBool(result);
+  }
+  return false;
 }
 
 int32_t TCPSocketPrivate::SSLHandshake(const char* server_name,
                                        uint16_t server_port,
                                        const CompletionCallback& callback) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return callback.MayForce(PP_ERROR_NOINTERFACE);
-  return get_interface<PPB_TCPSocket_Private>()->SSLHandshake(
-      pp_resource(), server_name, server_port,
-      callback.pp_completion_callback());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->SSLHandshake(
+        pp_resource(), server_name, server_port,
+        callback.pp_completion_callback());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->SSLHandshake(
+        pp_resource(), server_name, server_port,
+        callback.pp_completion_callback());
+  }
+  return callback.MayForce(PP_ERROR_NOINTERFACE);
+}
+
+X509CertificatePrivate TCPSocketPrivate::GetServerCertificate() {
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return X509CertificatePrivate(PASS_REF,
+        get_interface<PPB_TCPSocket_Private_0_4>()->GetServerCertificate(
+            pp_resource()));
+  }
+  return X509CertificatePrivate();
+}
+
+bool TCPSocketPrivate::AddChainBuildingCertificate(
+    const X509CertificatePrivate& cert,
+    bool trusted) {
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return PP_ToBool(get_interface<PPB_TCPSocket_Private_0_4>()->
+        AddChainBuildingCertificate(pp_resource(), cert.pp_resource(),
+                                    PP_FromBool(trusted)));
+  }
+  return false;
 }
 
 int32_t TCPSocketPrivate::Read(char* buffer,
                                int32_t bytes_to_read,
                                const CompletionCallback& callback) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return callback.MayForce(PP_ERROR_NOINTERFACE);
-  return get_interface<PPB_TCPSocket_Private>()->Read(
-      pp_resource(), buffer, bytes_to_read, callback.pp_completion_callback());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->Read(
+        pp_resource(), buffer, bytes_to_read,
+        callback.pp_completion_callback());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->Read(
+        pp_resource(), buffer, bytes_to_read,
+        callback.pp_completion_callback());
+  }
+  return callback.MayForce(PP_ERROR_NOINTERFACE);
 }
 
 int32_t TCPSocketPrivate::Write(const char* buffer,
                                 int32_t bytes_to_write,
                                 const CompletionCallback& callback) {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return callback.MayForce(PP_ERROR_NOINTERFACE);
-  return get_interface<PPB_TCPSocket_Private>()->Write(
-      pp_resource(), buffer, bytes_to_write, callback.pp_completion_callback());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->Write(
+        pp_resource(), buffer, bytes_to_write,
+        callback.pp_completion_callback());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->Write(
+        pp_resource(), buffer, bytes_to_write,
+        callback.pp_completion_callback());
+  }
+  return callback.MayForce(PP_ERROR_NOINTERFACE);
 }
 
 void TCPSocketPrivate::Disconnect() {
-  if (!has_interface<PPB_TCPSocket_Private>())
-    return;
-  return get_interface<PPB_TCPSocket_Private>()->Disconnect(pp_resource());
+  if (has_interface<PPB_TCPSocket_Private_0_4>()) {
+    return get_interface<PPB_TCPSocket_Private_0_4>()->Disconnect(
+        pp_resource());
+  }
+  if (has_interface<PPB_TCPSocket_Private_0_3>()) {
+    return get_interface<PPB_TCPSocket_Private_0_3>()->Disconnect(
+        pp_resource());
+  }
 }
 
 }  // namespace pp
diff --git a/ppapi/cpp/private/tcp_socket_private.h b/ppapi/cpp/private/tcp_socket_private.h
index 839c7cf..5f2b771 100644
--- a/ppapi/cpp/private/tcp_socket_private.h
+++ b/ppapi/cpp/private/tcp_socket_private.h
@@ -8,6 +8,7 @@
 #include "ppapi/c/pp_stdint.h"
 #include "ppapi/c/private/ppb_tcp_socket_private.h"
 #include "ppapi/cpp/pass_ref.h"
+#include "ppapi/cpp/private/x509_certificate_private.h"
 #include "ppapi/cpp/resource.h"
 
 namespace pp {
@@ -34,6 +35,10 @@ class TCPSocketPrivate : public Resource {
   int32_t SSLHandshake(const char* server_name,
                        uint16_t server_port,
                        const CompletionCallback& callback);
+  X509CertificatePrivate GetServerCertificate();
+  bool AddChainBuildingCertificate(const X509CertificatePrivate& cert,
+                                   bool trusted);
+
   int32_t Read(char* buffer,
                int32_t bytes_to_read,
                const CompletionCallback& callback);
diff --git a/ppapi/cpp/private/x509_certificate_private.cc b/ppapi/cpp/private/x509_certificate_private.cc
index c23481c..ec242b7 100644
--- a/ppapi/cpp/private/x509_certificate_private.cc
+++ b/ppapi/cpp/private/x509_certificate_private.cc
@@ -5,6 +5,7 @@
 #include "ppapi/cpp/private/x509_certificate_private.h"
 
 #include "ppapi/cpp/module_impl.h"
+#include "ppapi/cpp/pass_ref.h"
 #include "ppapi/cpp/var.h"
 
 namespace pp {
@@ -17,13 +18,13 @@ template <> const char* interface_name<PPB_X509Certificate_Private_0_1>() {
 
 }  // namespace
 
-X509Certificate::X509Certificate() : Resource() {
-}
+X509CertificatePrivate::X509CertificatePrivate() : Resource() {}
 
-X509Certificate::X509Certificate(PP_Resource resource) : Resource(resource) {
+X509CertificatePrivate::X509CertificatePrivate(PassRef, PP_Resource resource)
+    : Resource(PASS_REF, resource) {
 }
 
-X509Certificate::X509Certificate(const InstanceHandle& instance) {
+X509CertificatePrivate::X509CertificatePrivate(const InstanceHandle& instance) {
   if (has_interface<PPB_X509Certificate_Private_0_1>()) {
     PassRefFromConstructor(get_interface<PPB_X509Certificate_Private_0_1>()->
         Create(instance.pp_instance()));
@@ -31,11 +32,11 @@ X509Certificate::X509Certificate(const InstanceHandle& instance) {
 }
 
 // static
-bool X509Certificate::IsAvailable() {
+bool X509CertificatePrivate::IsAvailable() {
   return has_interface<PPB_X509Certificate_Private_0_1>();
 }
 
-bool X509Certificate::Initialize(const char* bytes, uint32_t length) {
+bool X509CertificatePrivate::Initialize(const char* bytes, uint32_t length) {
   if (!has_interface<PPB_X509Certificate_Private_0_1>())
     return false;
   PP_Bool result = get_interface<PPB_X509Certificate_Private_0_1>()->Initialize(
@@ -45,7 +46,8 @@ bool X509Certificate::Initialize(const char* bytes, uint32_t length) {
   return PP_ToBool(result);
 }
 
-Var X509Certificate::GetField(PP_X509Certificate_Private_Field field) const {
+Var X509CertificatePrivate::GetField(
+    PP_X509Certificate_Private_Field field) const {
   if (!has_interface<PPB_X509Certificate_Private_0_1>())
     return Var();
   return Var(PassRef(),
diff --git a/ppapi/cpp/private/x509_certificate_private.h b/ppapi/cpp/private/x509_certificate_private.h
index 5b316b4..981f581 100644
--- a/ppapi/cpp/private/x509_certificate_private.h
+++ b/ppapi/cpp/private/x509_certificate_private.h
@@ -13,12 +13,12 @@ namespace pp {
 
 class Var;
 
-class X509Certificate : public Resource {
+class X509CertificatePrivate : public Resource {
  public:
   // Creates an is_null() object.
-  X509Certificate();
-  explicit X509Certificate(PP_Resource resource);
-  explicit X509Certificate(const InstanceHandle& instance);
+  X509CertificatePrivate();
+  X509CertificatePrivate(PassRef, PP_Resource resource);
+  explicit X509CertificatePrivate(const InstanceHandle& instance);
 
   // Returns true if the required interface is available.
   static bool IsAvailable();
diff --git a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb.cc b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb.cc
index e2dbe9a..90ef45e 100644
--- a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb.cc
+++ b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb.cc
@@ -121,8 +121,10 @@ InterfaceMapElement interface_map[] = {
   { PPB_TCPSERVERSOCKET_PRIVATE_INTERFACE,
     PluginTCPServerSocketPrivate::GetInterface(),
     true },
-  { PPB_TCPSOCKET_PRIVATE_INTERFACE, PluginTCPSocketPrivate::GetInterface(),
-    true },
+  { PPB_TCPSOCKET_PRIVATE_INTERFACE_0_4,
+    PluginTCPSocketPrivate::GetInterface0_4(), true },
+  { PPB_TCPSOCKET_PRIVATE_INTERFACE_0_3,
+    PluginTCPSocketPrivate::GetInterface0_3(), true },
   { PPB_TESTING_DEV_INTERFACE_0_9, PluginTesting::GetInterface(), true },
   { PPB_TESTING_DEV_INTERFACE, PluginTesting::GetInterface(), true },
   { PPB_UDPSOCKET_PRIVATE_INTERFACE_0_2,
diff --git a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.cc b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.cc
index 77e6801..13baa22 100644
--- a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.cc
+++ b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.cc
@@ -193,6 +193,18 @@ int32_t SSLHandshake(PP_Resource tcp_socket,
   return MayForceCallback(callback, pp_error);
 }
 
+PP_Resource GetServerCertificate(PP_Resource tcp_socket) {
+  // TODO(raymes): Not implemented.
+  return 0;
+}
+
+PP_Bool AddChainBuildingCertificate(PP_Resource tcp_socket,
+                                    PP_Resource certificate,
+                                    PP_Bool is_trusted) {
+  // TODO(raymes): Not implemented.
+  return PP_FALSE;
+}
+
 int32_t Read(PP_Resource tcp_socket,
              char* buffer,
              int32_t bytes_to_read,
@@ -274,7 +286,23 @@ void Disconnect(PP_Resource tcp_socket) {
 
 }  // namespace
 
-const PPB_TCPSocket_Private* PluginTCPSocketPrivate::GetInterface() {
+const PPB_TCPSocket_Private_0_3* PluginTCPSocketPrivate::GetInterface0_3() {
+  static const PPB_TCPSocket_Private_0_3 tcpsocket_private_interface = {
+    Create,
+    IsTCPSocket,
+    Connect,
+    ConnectWithNetAddress,
+    GetLocalAddress,
+    GetRemoteAddress,
+    SSLHandshake,
+    Read,
+    Write,
+    Disconnect,
+  };
+  return &tcpsocket_private_interface;
+}
+
+const PPB_TCPSocket_Private_0_4* PluginTCPSocketPrivate::GetInterface0_4() {
   static const PPB_TCPSocket_Private tcpsocket_private_interface = {
     Create,
     IsTCPSocket,
@@ -283,6 +311,8 @@ const PPB_TCPSocket_Private* PluginTCPSocketPrivate::GetInterface() {
     GetLocalAddress,
     GetRemoteAddress,
     SSLHandshake,
+    GetServerCertificate,
+    AddChainBuildingCertificate,
     Read,
     Write,
     Disconnect,
diff --git a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.h b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.h
index 58ddde9..9d1bd6a 100644
--- a/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.h
+++ b/ppapi/native_client/src/shared/ppapi_proxy/plugin_ppb_tcp_socket_private.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -13,7 +13,8 @@ namespace ppapi_proxy {
 // Implements the untrusted side of the PPB_TCPSocket_Private interface.
 class PluginTCPSocketPrivate {
  public:
-  static const PPB_TCPSocket_Private* GetInterface();
+  static const PPB_TCPSocket_Private_0_3* GetInterface0_3();
+  static const PPB_TCPSocket_Private_0_4* GetInterface0_4();
 
  private:
   NACL_DISALLOW_COPY_AND_ASSIGN(PluginTCPSocketPrivate);
diff --git a/ppapi/ppapi_sources.gypi b/ppapi/ppapi_sources.gypi
index 67243b0..6f45f2c 100644
--- a/ppapi/ppapi_sources.gypi
+++ b/ppapi/ppapi_sources.gypi
@@ -431,6 +431,8 @@
       'tests/test_scrollbar.cc',
       'tests/test_scrollbar.h',
       'tests/test_struct_sizes.c',
+      'tests/test_tcp_socket_private_trusted.cc',
+      'tests/test_tcp_socket_private_trusted.h',
       'tests/test_uma.cc',
       'tests/test_uma.h',
       'tests/test_url_loader.cc',
diff --git a/ppapi/proxy/interface_list.cc b/ppapi/proxy/interface_list.cc
index 6d05722..3a23c94 100644
--- a/ppapi/proxy/interface_list.cc
+++ b/ppapi/proxy/interface_list.cc
@@ -63,12 +63,12 @@
 #include "ppapi/c/private/ppb_talk_private.h"
 #include "ppapi/c/private/ppb_tcp_socket_private.h"
 #include "ppapi/c/private/ppb_udp_socket_private.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
 #include "ppapi/c/trusted/ppb_broker_trusted.h"
 #include "ppapi/c/trusted/ppb_browser_font_trusted.h"
 #include "ppapi/c/trusted/ppb_char_set_trusted.h"
 #include "ppapi/c/trusted/ppb_file_io_trusted.h"
 #include "ppapi/c/trusted/ppb_url_loader_trusted.h"
-#include "ppapi/c/private/ppb_x509_certificate_private.h"
 #include "ppapi/proxy/interface_proxy.h"
 #include "ppapi/proxy/ppb_audio_input_proxy.h"
 #include "ppapi/proxy/ppb_audio_proxy.h"
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index 4c9b744..8d7d0fc 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -341,10 +341,11 @@ IPC_MESSAGE_ROUTED5(PpapiMsg_PPBTCPSocket_ConnectACK,
                     bool /* succeeded */,
                     PP_NetAddress_Private /* local_addr */,
                     PP_NetAddress_Private /* remote_addr */)
-IPC_MESSAGE_ROUTED3(PpapiMsg_PPBTCPSocket_SSLHandshakeACK,
+IPC_MESSAGE_ROUTED4(PpapiMsg_PPBTCPSocket_SSLHandshakeACK,
                     uint32 /* plugin_dispatcher_id */,
                     uint32 /* socket_id */,
-                    bool /* succeeded */)
+                    bool /* succeeded */,
+                    ppapi::PPB_X509Certificate_Fields /* certificate_fields */)
 IPC_MESSAGE_ROUTED4(PpapiMsg_PPBTCPSocket_ReadACK,
                     uint32 /* plugin_dispatcher_id */,
                     uint32 /* socket_id */,
@@ -1257,10 +1258,12 @@ IPC_MESSAGE_CONTROL3(PpapiHostMsg_PPBTCPSocket_ConnectWithNetAddress,
                      int32 /* routing_id */,
                      uint32 /* socket_id */,
                      PP_NetAddress_Private /* net_addr */)
-IPC_MESSAGE_CONTROL3(PpapiHostMsg_PPBTCPSocket_SSLHandshake,
+IPC_MESSAGE_CONTROL5(PpapiHostMsg_PPBTCPSocket_SSLHandshake,
                      uint32 /* socket_id */,
                      std::string /* server_name */,
-                     uint16_t /* server_port */)
+                     uint16_t /* server_port */,
+                     std::vector<std::vector<char> > /* trusted_certs */,
+                     std::vector<std::vector<char> > /* untrusted_certs */)
 IPC_MESSAGE_CONTROL2(PpapiHostMsg_PPBTCPSocket_Read,
                      uint32 /* socket_id */,
                      int32_t /* bytes_to_read */)
diff --git a/ppapi/proxy/ppb_tcp_socket_private_proxy.cc b/ppapi/proxy/ppb_tcp_socket_private_proxy.cc
index 26cdfcf..a032811 100644
--- a/ppapi/proxy/ppb_tcp_socket_private_proxy.cc
+++ b/ppapi/proxy/ppb_tcp_socket_private_proxy.cc
@@ -12,6 +12,7 @@
 #include "ppapi/proxy/plugin_proxy_delegate.h"
 #include "ppapi/proxy/plugin_resource_tracker.h"
 #include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 #include "ppapi/shared_impl/private/tcp_socket_private_impl.h"
 #include "ppapi/shared_impl/resource.h"
 #include "ppapi/thunk/thunk.h"
@@ -38,8 +39,11 @@ class TCPSocket : public TCPSocketPrivateImpl {
   virtual void SendConnect(const std::string& host, uint16_t port) OVERRIDE;
   virtual void SendConnectWithNetAddress(
       const PP_NetAddress_Private& addr) OVERRIDE;
-  virtual void SendSSLHandshake(const std::string& server_name,
-                                uint16_t server_port) OVERRIDE;
+  virtual void SendSSLHandshake(
+      const std::string& server_name,
+      uint16_t server_port,
+      const std::vector<std::vector<char> >& trusted_certs,
+      const std::vector<std::vector<char> >& untrusted_certs) OVERRIDE;
   virtual void SendRead(int32_t bytes_to_read) OVERRIDE;
   virtual void SendWrite(const std::string& buffer) OVERRIDE;
   virtual void SendDisconnect() OVERRIDE;
@@ -88,10 +92,13 @@ void TCPSocket::SendConnectWithNetAddress(const PP_NetAddress_Private& addr) {
       API_ID_PPB_TCPSOCKET_PRIVATE, socket_id_, addr));
 }
 
-void TCPSocket::SendSSLHandshake(const std::string& server_name,
-                                 uint16_t server_port) {
+void TCPSocket::SendSSLHandshake(
+    const std::string& server_name,
+    uint16_t server_port,
+    const std::vector<std::vector<char> >& trusted_certs,
+    const std::vector<std::vector<char> >& untrusted_certs) {
   SendToBrowser(new PpapiHostMsg_PPBTCPSocket_SSLHandshake(
-      socket_id_, server_name, server_port));
+      socket_id_, server_name, server_port, trusted_certs, untrusted_certs));
 }
 
 void TCPSocket::SendRead(int32_t bytes_to_read) {
@@ -188,7 +195,8 @@ void PPB_TCPSocket_Private_Proxy::OnMsgConnectACK(
 void PPB_TCPSocket_Private_Proxy::OnMsgSSLHandshakeACK(
     uint32 /* plugin_dispatcher_id */,
     uint32 socket_id,
-    bool succeeded) {
+    bool succeeded,
+    const PPB_X509Certificate_Fields& certificate_fields) {
   if (!g_id_to_socket) {
     NOTREACHED();
     return;
@@ -196,7 +204,7 @@ void PPB_TCPSocket_Private_Proxy::OnMsgSSLHandshakeACK(
   IDToSocketMap::iterator iter = g_id_to_socket->find(socket_id);
   if (iter == g_id_to_socket->end())
     return;
-  iter->second->OnSSLHandshakeCompleted(succeeded);
+  iter->second->OnSSLHandshakeCompleted(succeeded, certificate_fields);
 }
 
 void PPB_TCPSocket_Private_Proxy::OnMsgReadACK(
diff --git a/ppapi/proxy/ppb_tcp_socket_private_proxy.h b/ppapi/proxy/ppb_tcp_socket_private_proxy.h
index a7b2e79..4667216 100644
--- a/ppapi/proxy/ppb_tcp_socket_private_proxy.h
+++ b/ppapi/proxy/ppb_tcp_socket_private_proxy.h
@@ -15,6 +15,9 @@
 #include "ppapi/proxy/ppapi_proxy_export.h"
 
 namespace ppapi {
+
+class PPB_X509Certificate_Fields;
+
 namespace proxy {
 
 class PPB_TCPSocket_Private_Proxy : public InterfaceProxy {
@@ -41,9 +44,11 @@ class PPB_TCPSocket_Private_Proxy : public InterfaceProxy {
                        bool succeeded,
                        const PP_NetAddress_Private& local_addr,
                        const PP_NetAddress_Private& remote_addr);
-  void OnMsgSSLHandshakeACK(uint32 plugin_dispatcher_id,
-                            uint32 socket_id,
-                            bool succeeded);
+  void OnMsgSSLHandshakeACK(
+      uint32 plugin_dispatcher_id,
+      uint32 socket_id,
+      bool succeeded,
+      const PPB_X509Certificate_Fields& certificate_fields);
   void OnMsgReadACK(uint32 plugin_dispatcher_id,
                     uint32 socket_id,
                     bool succeeded,
diff --git a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
index 665ca73..35c9d0e 100644
--- a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
+++ b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
@@ -11,6 +11,13 @@
 
 namespace ppapi {
 
+PPB_X509Certificate_Fields::PPB_X509Certificate_Fields() {}
+
+PPB_X509Certificate_Fields::PPB_X509Certificate_Fields(
+    const PPB_X509Certificate_Fields& fields) {
+  values_.Swap(fields.values_.DeepCopy());
+}
+
 void PPB_X509Certificate_Fields::SetField(
     PP_X509Certificate_Private_Field field,
     base::Value* value) {
@@ -84,9 +91,9 @@ PPB_X509Certificate_Private_Shared::PPB_X509Certificate_Private_Shared(
 PPB_X509Certificate_Private_Shared::PPB_X509Certificate_Private_Shared(
     ResourceObjectType type,
     PP_Instance instance,
-    PPB_X509Certificate_Fields* fields)
+    const PPB_X509Certificate_Fields& fields)
     : Resource(type, instance),
-      fields_(fields) {
+      fields_(new PPB_X509Certificate_Fields(fields)) {
 }
 
 PPB_X509Certificate_Private_Shared::~PPB_X509Certificate_Private_Shared() {
diff --git a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
index 70f84cd..8e87517 100644
--- a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
+++ b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
@@ -22,6 +22,9 @@ namespace ppapi {
 
 class PPAPI_SHARED_EXPORT PPB_X509Certificate_Fields {
  public:
+  PPB_X509Certificate_Fields();
+  PPB_X509Certificate_Fields(const PPB_X509Certificate_Fields& fields);
+
   // Takes ownership of |value|.
   void SetField(PP_X509Certificate_Private_Field field, base::Value* value);
   PP_Var GetFieldAsPPVar(PP_X509Certificate_Private_Field field) const;
@@ -42,10 +45,10 @@ class PPAPI_SHARED_EXPORT PPB_X509Certificate_Private_Shared
   PPB_X509Certificate_Private_Shared(ResourceObjectType type,
                                      PP_Instance instance);
   // Used by tcp_socket_shared_impl to construct a certificate resource from a
-  // server certificate. This object owns the pointer passed in.
+  // server certificate.
   PPB_X509Certificate_Private_Shared(ResourceObjectType type,
                                      PP_Instance instance,
-                                     PPB_X509Certificate_Fields* fields);
+                                     const PPB_X509Certificate_Fields& fields);
   virtual ~PPB_X509Certificate_Private_Shared();
 
   // Resource overrides.
diff --git a/ppapi/shared_impl/private/tcp_socket_private_impl.cc b/ppapi/shared_impl/private/tcp_socket_private_impl.cc
index de99e20..c37940b 100644
--- a/ppapi/shared_impl/private/tcp_socket_private_impl.cc
+++ b/ppapi/shared_impl/private/tcp_socket_private_impl.cc
@@ -14,6 +14,12 @@
 #include "base/message_loop.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
+#include "ppapi/shared_impl/var_tracker.h"
+#include "ppapi/shared_impl/var.h"
+#include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_x509_certificate_private_api.h"
 
 namespace ppapi {
 
@@ -22,13 +28,15 @@ const int32_t TCPSocketPrivateImpl::kMaxWriteSize = 1024 * 1024;
 
 TCPSocketPrivateImpl::TCPSocketPrivateImpl(PP_Instance instance,
                                            uint32 socket_id)
-    : Resource(OBJECT_IS_IMPL, instance) {
+    : Resource(OBJECT_IS_IMPL, instance),
+      resource_type_(OBJECT_IS_IMPL) {
   Init(socket_id);
 }
 
 TCPSocketPrivateImpl::TCPSocketPrivateImpl(const HostResource& resource,
                                            uint32 socket_id)
-    : Resource(OBJECT_IS_PROXY, resource) {
+    : Resource(OBJECT_IS_PROXY, resource),
+      resource_type_(OBJECT_IS_PROXY) {
   Init(socket_id);
 }
 
@@ -112,10 +120,48 @@ int32_t TCPSocketPrivateImpl::SSLHandshake(const char* server_name,
   ssl_handshake_callback_ = new TrackedCallback(this, callback);
 
   // Send the request, the browser will call us back via SSLHandshakeACK.
-  SendSSLHandshake(server_name, server_port);
+  SendSSLHandshake(server_name, server_port, trusted_certificates_,
+      untrusted_certificates_);
   return PP_OK_COMPLETIONPENDING;
 }
 
+PP_Resource TCPSocketPrivateImpl::GetServerCertificate() {
+  if (!server_certificate_.get())
+    return 0;
+  return server_certificate_->GetReference();
+}
+
+PP_Bool TCPSocketPrivateImpl::AddChainBuildingCertificate(
+    PP_Resource certificate,
+    PP_Bool trusted) {
+  // TODO(raymes): The plumbing for this functionality is implemented but the
+  // certificates aren't yet used for the connection, so just return false for
+  // now.
+  return PP_FALSE;
+
+  thunk::EnterResourceNoLock<thunk::PPB_X509Certificate_Private_API>
+  enter_cert(certificate, true);
+  if (enter_cert.failed())
+    return PP_FALSE;
+
+  PP_Var der_var = enter_cert.object()->GetField(
+      PP_X509CERTIFICATE_PRIVATE_RAW);
+  ArrayBufferVar* der_array_buffer = ArrayBufferVar::FromPPVar(der_var);
+  PP_Bool success = PP_FALSE;
+  if (der_array_buffer) {
+    const char* der_bytes = static_cast<const char*>(der_array_buffer->Map());
+    uint32_t der_length = der_array_buffer->ByteLength();
+    std::vector<char> der(der_bytes, der_bytes + der_length);
+    if (PP_ToBool(trusted))
+      trusted_certificates_.push_back(der);
+    else
+      untrusted_certificates_.push_back(der);
+    success = PP_TRUE;
+  }
+  PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(der_var);
+  return success;
+}
+
 int32_t TCPSocketPrivateImpl::Read(char* buffer,
                                    int32_t bytes_to_read,
                                    PP_CompletionCallback callback) {
@@ -179,6 +225,7 @@ void TCPSocketPrivateImpl::Disconnect() {
   PostAbortIfNecessary(&write_callback_);
   read_buffer_ = NULL;
   bytes_to_read_ = -1;
+  server_certificate_ = NULL;
 }
 
 void TCPSocketPrivateImpl::OnConnectCompleted(
@@ -200,7 +247,9 @@ void TCPSocketPrivateImpl::OnConnectCompleted(
                                succeeded ? PP_OK : PP_ERROR_FAILED);
 }
 
-void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(bool succeeded) {
+void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(
+    bool succeeded,
+    const PPB_X509Certificate_Fields& certificate_fields) {
   if (connection_state_ != CONNECTED ||
       !TrackedCallback::IsPending(ssl_handshake_callback_)) {
     NOTREACHED();
@@ -209,6 +258,10 @@ void TCPSocketPrivateImpl::OnSSLHandshakeCompleted(bool succeeded) {
 
   if (succeeded) {
     connection_state_ = SSL_CONNECTED;
+    server_certificate_ = new PPB_X509Certificate_Private_Shared(
+        resource_type_,
+        pp_instance(),
+        certificate_fields);
     TrackedCallback::ClearAndRun(&ssl_handshake_callback_, PP_OK);
   } else {
     TrackedCallback::ClearAndRun(&ssl_handshake_callback_, PP_ERROR_FAILED);
diff --git a/ppapi/shared_impl/private/tcp_socket_private_impl.h b/ppapi/shared_impl/private/tcp_socket_private_impl.h
index c9a65a7..8038b5c 100644
--- a/ppapi/shared_impl/private/tcp_socket_private_impl.h
+++ b/ppapi/shared_impl/private/tcp_socket_private_impl.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -6,6 +6,7 @@
 #define PPAPI_SHARED_IMPL_PRIVATE_TCP_SOCKET_PRIVATE_IMPL_H_
 
 #include <string>
+#include <vector>
 
 #include "base/compiler_specific.h"
 #include "ppapi/shared_impl/resource.h"
@@ -14,6 +15,9 @@
 
 namespace ppapi {
 
+class PPB_X509Certificate_Fields;
+class PPB_X509Certificate_Private_Shared;
+
 // This class provides the shared implementation of a
 // PPB_TCPSocket_Private.  The functions that actually send messages
 // to browser are implemented differently for the proxied and
@@ -51,6 +55,9 @@ class PPAPI_SHARED_EXPORT TCPSocketPrivateImpl
   virtual int32_t SSLHandshake(const char* server_name,
                               uint16_t server_port,
                               PP_CompletionCallback callback) OVERRIDE;
+  virtual PP_Resource GetServerCertificate() OVERRIDE;
+  virtual PP_Bool AddChainBuildingCertificate(PP_Resource certificate,
+                                              PP_Bool trusted) OVERRIDE;
   virtual int32_t Read(char* buffer,
                       int32_t bytes_to_read,
                       PP_CompletionCallback callback) OVERRIDE;
@@ -63,7 +70,9 @@ class PPAPI_SHARED_EXPORT TCPSocketPrivateImpl
   void OnConnectCompleted(bool succeeded,
                           const PP_NetAddress_Private& local_addr,
                           const PP_NetAddress_Private& remote_addr);
-  void OnSSLHandshakeCompleted(bool succeeded);
+  void OnSSLHandshakeCompleted(
+      bool succeeded,
+      const PPB_X509Certificate_Fields& certificate_fields);
   void OnReadCompleted(bool succeeded, const std::string& data);
   void OnWriteCompleted(bool succeeded, int32_t bytes_written);
 
@@ -71,8 +80,11 @@ class PPAPI_SHARED_EXPORT TCPSocketPrivateImpl
   // proxied and non-proxied derived classes.
   virtual void SendConnect(const std::string& host, uint16_t port) = 0;
   virtual void SendConnectWithNetAddress(const PP_NetAddress_Private& addr) = 0;
-  virtual void SendSSLHandshake(const std::string& server_name,
-                                uint16_t server_port) = 0;
+  virtual void SendSSLHandshake(
+      const std::string& server_name,
+      uint16_t server_port,
+      const std::vector<std::vector<char> >& trusted_certs,
+      const std::vector<std::vector<char> >& untrusted_certs) = 0;
   virtual void SendRead(int32_t bytes_to_read) = 0;
   virtual void SendWrite(const std::string& buffer) = 0;
   virtual void SendDisconnect() = 0;
@@ -95,6 +107,8 @@ class PPAPI_SHARED_EXPORT TCPSocketPrivateImpl
   bool IsConnected() const;
   void PostAbortIfNecessary(scoped_refptr<TrackedCallback>* callback);
 
+  ResourceObjectType resource_type_;
+
   uint32 socket_id_;
   ConnectionState connection_state_;
 
@@ -109,6 +123,11 @@ class PPAPI_SHARED_EXPORT TCPSocketPrivateImpl
   PP_NetAddress_Private local_addr_;
   PP_NetAddress_Private remote_addr_;
 
+  scoped_refptr<PPB_X509Certificate_Private_Shared> server_certificate_;
+
+  std::vector<std::vector<char> > trusted_certificates_;
+  std::vector<std::vector<char> > untrusted_certificates_;
+
   DISALLOW_COPY_AND_ASSIGN(TCPSocketPrivateImpl);
 };
 
diff --git a/ppapi/tests/test_tcp_socket_private_trusted.cc b/ppapi/tests/test_tcp_socket_private_trusted.cc
new file mode 100644
index 0000000..debb3ce
--- /dev/null
+++ b/ppapi/tests/test_tcp_socket_private_trusted.cc
@@ -0,0 +1,65 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/tests/test_tcp_socket_private_trusted.h"
+
+#include "ppapi/cpp/private/tcp_socket_private.h"
+#include "ppapi/cpp/private/x509_certificate_private.h"
+#include "ppapi/tests/testing_instance.h"
+#include "ppapi/tests/test_utils.h"
+
+REGISTER_TEST_CASE(TCPSocketPrivateTrusted);
+
+TestTCPSocketPrivateTrusted::TestTCPSocketPrivateTrusted(
+    TestingInstance* instance)
+    : TestCase(instance) {
+}
+
+bool TestTCPSocketPrivateTrusted::Init() {
+  if (!pp::TCPSocketPrivate::IsAvailable())
+    return false;
+
+  // We need something to connect to, so we connect to the HTTP server whence we
+  // came. Grab the host and port.
+  if (!EnsureRunningOverHTTP())
+    return false;
+
+  if (!GetLocalHostPort(instance_->pp_instance(), &host_, &port_))
+    return false;
+
+  // Get the port for the SSL server.
+  ssl_port_ = instance_->ssl_server_port();
+
+  return true;
+}
+
+void TestTCPSocketPrivateTrusted::RunTests(const std::string& filter) {
+  RUN_TEST_FORCEASYNC_AND_NOT(GetServerCertificate, filter);
+}
+
+std::string TestTCPSocketPrivateTrusted::TestGetServerCertificate() {
+  pp::TCPSocketPrivate socket(instance_);
+  TestCompletionCallback cb(instance_->pp_instance(), force_async_);
+
+  int32_t rv = socket.Connect(host_.c_str(), ssl_port_, cb);
+  ASSERT_TRUE(!force_async_ || rv == PP_OK_COMPLETIONPENDING);
+  if (rv == PP_OK_COMPLETIONPENDING)
+    rv = cb.WaitForResult();
+  ASSERT_EQ(PP_OK, rv);
+
+  rv = socket.SSLHandshake(host_.c_str(), ssl_port_, cb);
+  ASSERT_TRUE(!force_async_ || rv == PP_OK_COMPLETIONPENDING);
+  if (rv == PP_OK_COMPLETIONPENDING)
+    rv = cb.WaitForResult();
+  ASSERT_EQ(PP_OK, rv);
+
+  const pp::X509CertificatePrivate& cert = socket.GetServerCertificate();
+  ASSERT_EQ(
+      cert.GetField(PP_X509CERTIFICATE_PRIVATE_ISSUER_COMMON_NAME).AsString(),
+      "Test CA");
+  ASSERT_EQ(
+      cert.GetField(PP_X509CERTIFICATE_PRIVATE_SUBJECT_COMMON_NAME).AsString(),
+      "127.0.0.1");
+  PASS();
+}
diff --git a/ppapi/tests/test_tcp_socket_private_trusted.h b/ppapi/tests/test_tcp_socket_private_trusted.h
new file mode 100644
index 0000000..364229a
--- /dev/null
+++ b/ppapi/tests/test_tcp_socket_private_trusted.h
@@ -0,0 +1,32 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PAPPI_TESTS_TEST_TCP_SOCKET_PRIVATE_TRUSTED_H_
+#define PAPPI_TESTS_TEST_TCP_SOCKET_PRIVATE_TRUSTED_H_
+
+#include <string>
+
+#include "ppapi/c/pp_stdint.h"
+#include "ppapi/tests/test_case.h"
+
+// This class is necessary to test the portions of TCP socket which are
+// not exposed to NaCl yet. In particular, functionality related to
+// X509 Certificates is tested here.
+class TestTCPSocketPrivateTrusted : public TestCase {
+ public:
+  explicit TestTCPSocketPrivateTrusted(TestingInstance* instance);
+
+  // TestCase implementation.
+  virtual bool Init();
+  virtual void RunTests(const std::string& filter);
+
+ private:
+  std::string TestGetServerCertificate();
+
+  std::string host_;
+  uint16_t port_;
+  uint16_t ssl_port_;
+};
+
+#endif  // PAPPI_TESTS_TEST_TCP_SOCKET_PRIVATE_TRUSTED_H_
diff --git a/ppapi/tests/test_x509_certificate_private.cc b/ppapi/tests/test_x509_certificate_private.cc
index 9bf950e..a8bf649 100644
--- a/ppapi/tests/test_x509_certificate_private.cc
+++ b/ppapi/tests/test_x509_certificate_private.cc
@@ -17,7 +17,7 @@ REGISTER_TEST_CASE(X509CertificatePrivate);
 namespace {
 
 bool FieldMatchesString(
-    const pp::X509Certificate& certificate,
+    const pp::X509CertificatePrivate& certificate,
     PP_X509Certificate_Private_Field field,
     const std::string& expected) {
   pp::Var field_value = certificate.GetField(field);
@@ -27,7 +27,7 @@ bool FieldMatchesString(
 }
 
 bool FieldMatchesDouble(
-    const pp::X509Certificate& certificate,
+    const pp::X509CertificatePrivate& certificate,
     PP_X509Certificate_Private_Field field,
     double expected) {
   pp::Var field_value = certificate.GetField(field);
@@ -38,7 +38,7 @@ bool FieldMatchesDouble(
 }
 
 bool FieldMatchesBuffer(
-    const pp::X509Certificate& certificate,
+    const pp::X509CertificatePrivate& certificate,
     PP_X509Certificate_Private_Field field,
     const char* expected,
     uint32_t expected_length) {
@@ -54,7 +54,7 @@ bool FieldMatchesBuffer(
 }
 
 bool FieldIsNull(
-    const pp::X509Certificate& certificate,
+    const pp::X509CertificatePrivate& certificate,
     PP_X509Certificate_Private_Field field) {
   return certificate.GetField(field).is_null();
 }
@@ -139,7 +139,7 @@ TestX509CertificatePrivate::TestX509CertificatePrivate(
 }
 
 bool TestX509CertificatePrivate::Init() {
-  if (!pp::X509Certificate::IsAvailable())
+  if (!pp::X509CertificatePrivate::IsAvailable())
     return false;
 
   return true;
@@ -151,7 +151,7 @@ void TestX509CertificatePrivate::RunTests(const std::string& filter) {
 }
 
 std::string TestX509CertificatePrivate::TestValidCertificate() {
-  pp::X509Certificate certificate(instance_);
+  pp::X509CertificatePrivate certificate(instance_);
   bool successful = certificate.Initialize(
       reinterpret_cast<const char*>(kGoogleDer), sizeof(kGoogleDer));
   ASSERT_TRUE(successful);
@@ -212,11 +212,11 @@ std::string TestX509CertificatePrivate::TestValidCertificate() {
 
 std::string TestX509CertificatePrivate::TestInvalidCertificate() {
   bool successful;
-  pp::X509Certificate null_certificate(instance_);
+  pp::X509CertificatePrivate null_certificate(instance_);
   successful = null_certificate.Initialize(NULL, 0);
   ASSERT_FALSE(successful);
 
-  pp::X509Certificate bad_certificate(instance_);
+  pp::X509CertificatePrivate bad_certificate(instance_);
   successful = bad_certificate.Initialize("acbde", 0);
   ASSERT_FALSE(successful);
 
diff --git a/ppapi/thunk/interfaces_ppb_private.h b/ppapi/thunk/interfaces_ppb_private.h
index 85a0842..d2378b4 100644
--- a/ppapi/thunk/interfaces_ppb_private.h
+++ b/ppapi/thunk/interfaces_ppb_private.h
@@ -49,6 +49,8 @@ PROXIED_IFACE(PPB_TCPServerSocket_Private,
               PPB_TCPServerSocket_Private_0_1)
 PROXIED_IFACE(PPB_TCPSocket_Private, PPB_TCPSOCKET_PRIVATE_INTERFACE_0_3,
               PPB_TCPSocket_Private_0_3)
+PROXIED_IFACE(PPB_TCPSocket_Private, PPB_TCPSOCKET_PRIVATE_INTERFACE_0_4,
+              PPB_TCPSocket_Private_0_4)
 PROXIED_IFACE(PPB_UDPSocket_Private, PPB_UDPSOCKET_PRIVATE_INTERFACE_0_2,
               PPB_UDPSocket_Private_0_2)
 PROXIED_IFACE(PPB_UDPSocket_Private, PPB_UDPSOCKET_PRIVATE_INTERFACE_0_3,
diff --git a/ppapi/thunk/ppb_tcp_socket_private_api.h b/ppapi/thunk/ppb_tcp_socket_private_api.h
index 18792ae..689f590f 100644
--- a/ppapi/thunk/ppb_tcp_socket_private_api.h
+++ b/ppapi/thunk/ppb_tcp_socket_private_api.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -25,6 +25,9 @@ class PPAPI_THUNK_EXPORT PPB_TCPSocket_Private_API {
   virtual int32_t SSLHandshake(const char* server_name,
                                uint16_t server_port,
                                PP_CompletionCallback callback) = 0;
+  virtual PP_Resource GetServerCertificate() = 0;
+  virtual PP_Bool AddChainBuildingCertificate(PP_Resource certificate,
+                                              PP_Bool trusted) = 0;
   virtual int32_t Read(char* buffer,
                        int32_t bytes_to_read,
                        PP_CompletionCallback callback) = 0;
diff --git a/ppapi/thunk/ppb_tcp_socket_private_thunk.cc b/ppapi/thunk/ppb_tcp_socket_private_thunk.cc
index 3997d08..bd9703e 100644
--- a/ppapi/thunk/ppb_tcp_socket_private_thunk.cc
+++ b/ppapi/thunk/ppb_tcp_socket_private_thunk.cc
@@ -75,6 +75,22 @@ int32_t SSLHandshake(PP_Resource tcp_socket,
                                                       callback));
 }
 
+PP_Resource GetServerCertificate(PP_Resource tcp_socket) {
+  EnterTCP enter(tcp_socket, true);
+  if (enter.failed())
+    return 0;
+  return enter.object()->GetServerCertificate();
+}
+
+PP_Bool AddChainBuildingCertificate(PP_Resource tcp_socket,
+                                    PP_Resource certificate,
+                                    PP_Bool trusted) {
+  EnterTCP enter(tcp_socket, true);
+  if (enter.failed())
+    return PP_FALSE;
+  return enter.object()->AddChainBuildingCertificate(certificate, trusted);
+}
+
 int32_t Read(PP_Resource tcp_socket,
              char* buffer,
              int32_t bytes_to_read,
@@ -102,7 +118,20 @@ void Disconnect(PP_Resource tcp_socket) {
     enter.object()->Disconnect();
 }
 
-const PPB_TCPSocket_Private g_ppb_tcp_socket_thunk = {
+const PPB_TCPSocket_Private_0_3 g_ppb_tcp_socket_thunk_0_3 = {
+  &Create,
+  &IsTCPSocket,
+  &Connect,
+  &ConnectWithNetAddress,
+  &GetLocalAddress,
+  &GetRemoteAddress,
+  &SSLHandshake,
+  &Read,
+  &Write,
+  &Disconnect
+};
+
+const PPB_TCPSocket_Private g_ppb_tcp_socket_thunk_0_4 = {
   &Create,
   &IsTCPSocket,
   &Connect,
@@ -110,6 +139,8 @@ const PPB_TCPSocket_Private g_ppb_tcp_socket_thunk = {
   &GetLocalAddress,
   &GetRemoteAddress,
   &SSLHandshake,
+  &GetServerCertificate,
+  &AddChainBuildingCertificate,
   &Read,
   &Write,
   &Disconnect
@@ -118,7 +149,11 @@ const PPB_TCPSocket_Private g_ppb_tcp_socket_thunk = {
 }  // namespace
 
 const PPB_TCPSocket_Private_0_3* GetPPB_TCPSocket_Private_0_3_Thunk() {
-  return &g_ppb_tcp_socket_thunk;
+  return &g_ppb_tcp_socket_thunk_0_3;
+}
+
+const PPB_TCPSocket_Private_0_4* GetPPB_TCPSocket_Private_0_4_Thunk() {
+  return &g_ppb_tcp_socket_thunk_0_4;
 }
 
 }  // namespace thunk