Bug 1004149 - Return mozilla::pkix::Result values in nsNSSHttpInterface functions. r=keeler

MozReview-Commit-ID: Kx1E3HLP7zC

--HG--
extra : transplant_source : %F0%068%83%E21dM-%FE%7C%EC1%1E%05h%E6%1D%271

security/certverifier/NSSCertDBTrustDomain.cpp

@@ -549,12 +549,15 @@ NSSCertDBTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
       static_cast<unsigned int>(ocspRequestLength)
     };
     // Owned by arena
-    const SECItem* responseSECItem =
+    SECItem* responseSECItem = nullptr;
+    Result tempRV =
       DoOCSPRequest(arena.get(), url, &ocspRequestItem,
                     OCSPFetchingTypeToTimeoutTime(mOCSPFetching),
-                    mOCSPGetConfig == CertVerifier::ocspGetEnabled);
-    if (!responseSECItem) {
-      rv = MapPRErrorCodeToResult(PR_GetError());
+                    mOCSPGetConfig == CertVerifier::ocspGetEnabled,
+                    responseSECItem);
+    MOZ_ASSERT((tempRV != Success) || responseSECItem);
+    if (tempRV != Success) {
+      rv = tempRV;
     } else if (response.Init(responseSECItem->data, responseSECItem->len)
                  != Success) {
       rv = Result::ERROR_OCSP_MALFORMED_RESPONSE; // too big

security/certverifier/OCSPRequestor.cpp

@@ -70,25 +70,23 @@ AppendEscapedBase64Item(const SECItem* encodedRequest, nsACString& path)
   return NS_OK;
 }
 
-SECItem*
+Result
 DoOCSPRequest(PLArenaPool* arena, const char* url,
               const SECItem* encodedRequest, PRIntervalTime timeout,
-              bool useGET)
+              bool useGET,
+      /*out*/ SECItem*& encodedResponse)
 {
   if (!arena || !url || !encodedRequest || !encodedRequest->data) {
-    PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
-    return nullptr;
+    return Result::FATAL_ERROR_INVALID_ARGS;
   }
   uint32_t urlLen = PL_strlen(url);
   if (urlLen > static_cast<uint32_t>(std::numeric_limits<int32_t>::max())) {
-    PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
-    return nullptr;
+    return Result::FATAL_ERROR_INVALID_ARGS;
   }
 
   nsCOMPtr<nsIURLParser> urlParser = do_GetService(NS_STDURLPARSER_CONTRACTID);
   if (!urlParser) {
-    PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0);
-    return nullptr;
+    return Result::FATAL_ERROR_LIBRARY_FAILURE;
   }
 
   uint32_t schemePos;
@@ -97,58 +95,52 @@ DoOCSPRequest(PLArenaPool* arena, const char* url,
   int32_t authorityLen;
   uint32_t pathPos;
   int32_t pathLen;
-  nsresult rv = urlParser->ParseURL(url, static_cast<int32_t>(urlLen),
-                                    &schemePos, &schemeLen,
-                                    &authorityPos, &authorityLen,
-                                    &pathPos, &pathLen);
-  if (NS_FAILED(rv)) {
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+  nsresult nsrv = urlParser->ParseURL(url, static_cast<int32_t>(urlLen),
+                                      &schemePos, &schemeLen,
+                                      &authorityPos, &authorityLen,
+                                      &pathPos, &pathLen);
+  if (NS_FAILED(nsrv)) {
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
   if (schemeLen < 0 || authorityLen < 0) {
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
   nsAutoCString scheme(url + schemePos,
                        static_cast<nsAutoCString::size_type>(schemeLen));
   if (!scheme.LowerCaseEqualsLiteral("http")) {
-    // We dont support https:// to avoid loops see Bug 92923
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+    // We don't support HTTPS to avoid loops. See Bug 92923.
+    // We also in general only support HTTP.
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
 
   uint32_t hostnamePos;
   int32_t hostnameLen;
   int32_t port;
-  // We do not support urls with user@pass sections in the URL,
-  // In cas we find them we will ignore and try to connect with
-  rv = urlParser->ParseAuthority(url + authorityPos, authorityLen,
-                                 nullptr, nullptr, nullptr, nullptr,
-                                 &hostnamePos, &hostnameLen, &port);
-  if (NS_FAILED(rv)) {
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+  // We ignore user:password sections: if one is present, we send an OCSP
+  // request to the URL as normal without sending the username or password.
+  nsrv = urlParser->ParseAuthority(url + authorityPos, authorityLen,
+                                   nullptr, nullptr, nullptr, nullptr,
+                                   &hostnamePos, &hostnameLen, &port);
+  if (NS_FAILED(nsrv)) {
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
   if (hostnameLen < 0) {
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
   if (port == -1) {
     port = 80;
   } else if (port < 0 || port > 0xffff) {
-    PR_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION, 0);
-    return nullptr;
+    return Result::ERROR_CERT_BAD_ACCESS_LOCATION;
   }
   nsAutoCString
     hostname(url + authorityPos + hostnamePos,
              static_cast<nsACString_internal::size_type>(hostnameLen));
 
   SEC_HTTP_SERVER_SESSION serverSessionPtr = nullptr;
-  if (nsNSSHttpInterface::createSessionFcn(hostname.BeginReading(),
-                                           static_cast<uint16_t>(port),
-                                           &serverSessionPtr) != SECSuccess) {
-    PR_SetError(SEC_ERROR_NO_MEMORY, 0);
-    return nullptr;
+  Result rv = nsNSSHttpInterface::createSessionFcn(
+    hostname.BeginReading(), static_cast<uint16_t>(port), &serverSessionPtr);
+  if (rv != Success) {
+    return rv;
   }
   ScopedHTTPServerSession serverSession(
     reinterpret_cast<nsNSSHttpServerSession*>(serverSessionPtr));
@@ -168,59 +160,53 @@ DoOCSPRequest(PLArenaPool* arena, const char* url,
     if (!StringEndsWith(path, NS_LITERAL_CSTRING("/"))) {
       path.Append("/");
     }
-    nsresult rv = AppendEscapedBase64Item(encodedRequest, path);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return nullptr;
+    nsresult nsrv = AppendEscapedBase64Item(encodedRequest, path);
+    if (NS_WARN_IF(NS_FAILED(nsrv))) {
+      return Result::FATAL_ERROR_LIBRARY_FAILURE;
     }
   }
 
   SEC_HTTP_REQUEST_SESSION requestSessionPtr;
-  if (nsNSSHttpInterface::createFcn(serverSession.get(), "http",
-                                    path.get(), method.get(),
-                                    timeout, &requestSessionPtr)
-        != SECSuccess) {
-    PR_SetError(SEC_ERROR_NO_MEMORY, 0);
-    return nullptr;
+  rv = nsNSSHttpInterface::createFcn(serverSession.get(), "http", path.get(),
+                                     method.get(), timeout, &requestSessionPtr);
+  if (rv != Success) {
+    return rv;
   }
 
   ScopedHTTPRequestSession requestSession(
     reinterpret_cast<nsNSSHttpRequestSession*>(requestSessionPtr));
 
   if (!useGET) {
-    if (nsNSSHttpInterface::setPostDataFcn(requestSession.get(),
-          reinterpret_cast<char*>(encodedRequest->data), encodedRequest->len,
-          "application/ocsp-request") != SECSuccess) {
-      PR_SetError(SEC_ERROR_NO_MEMORY, 0);
-      return nullptr;
+    rv = nsNSSHttpInterface::setPostDataFcn(
+      requestSession.get(), reinterpret_cast<char*>(encodedRequest->data),
+      encodedRequest->len, "application/ocsp-request");
+    if (rv != Success) {
+      return rv;
     }
   }
 
   uint16_t httpResponseCode;
   const char* httpResponseData;
   uint32_t httpResponseDataLen = 0; // 0 means any response size is acceptable
-  if (nsNSSHttpInterface::trySendAndReceiveFcn(requestSession.get(), nullptr,
-                                               &httpResponseCode, nullptr,
-                                               nullptr, &httpResponseData,
-                                               &httpResponseDataLen)
-        != SECSuccess) {
-    PR_SetError(SEC_ERROR_OCSP_SERVER_ERROR, 0);
-    return nullptr;
+  rv = nsNSSHttpInterface::trySendAndReceiveFcn(requestSession.get(), nullptr,
+                                                &httpResponseCode, nullptr,
+                                                nullptr, &httpResponseData,
+                                                &httpResponseDataLen);
+  if (rv != Success) {
+    return rv;
   }
 
   if (httpResponseCode != 200) {
-    PR_SetError(SEC_ERROR_OCSP_SERVER_ERROR, 0);
-    return nullptr;
+    return Result::ERROR_OCSP_SERVER_ERROR;
   }
 
-  SECItem* encodedResponse = SECITEM_AllocItem(arena, nullptr,
-                                               httpResponseDataLen);
+  encodedResponse = SECITEM_AllocItem(arena, nullptr, httpResponseDataLen);
   if (!encodedResponse) {
-    PR_SetError(SEC_ERROR_NO_MEMORY, 0);
-    return nullptr;
+    return Result::FATAL_ERROR_NO_MEMORY;
   }
 
   memcpy(encodedResponse->data, httpResponseData, httpResponseDataLen);
-  return encodedResponse;
+  return Success;
 }
 
 } } // namespace mozilla::psm

security/certverifier/OCSPRequestor.h

@@ -12,10 +12,11 @@
 
 namespace mozilla { namespace psm {
 
-// The memory returned is owned by the given arena.
-SECItem* DoOCSPRequest(PLArenaPool* arena, const char* url,
-                       const SECItem* encodedRequest, PRIntervalTime timeout,
-                       bool useGET);
+// The memory returned via |encodedResponse| is owned by the given arena.
+Result DoOCSPRequest(PLArenaPool* arena, const char* url,
+                     const SECItem* encodedRequest, PRIntervalTime timeout,
+                     bool useGET,
+             /*out*/ SECItem*& encodedResponse);
 
 } } // namespace mozilla::psm
 

security/manager/ssl/nsNSSCallbacks.cpp

@@ -98,8 +98,7 @@ nsHTTPDownloadEvent::Run()
   NS_ENSURE_STATE(chan);
 
   // Security operations scheduled through normal HTTP channels are given
-  // high priority to accommodate real time OCSP transactions. Background CRL
-  // fetches happen through a different path (CRLDownloadEvent).
+  // high priority to accommodate real time OCSP transactions.
   nsCOMPtr<nsISupportsPriority> priorityChannel = do_QueryInterface(chan);
   if (priorityChannel)
     priorityChannel->AdjustPriority(nsISupportsPriority::PRIORITY_HIGHEST);
@@ -131,7 +130,7 @@ nsHTTPDownloadEvent::Run()
 
   // Do not use SPDY for internal security operations. It could result
   // in the silent upgrade to ssl, which in turn could require an SSL
-  // operation to fufill something like a CRL fetch, which is an
+  // operation to fulfill something like an OCSP fetch, which is an
   // endless loop.
   nsCOMPtr<nsIHttpChannelInternal> internalChannel = do_QueryInterface(chan);
   if (internalChannel) {
@@ -185,42 +184,49 @@ struct nsCancelHTTPDownloadEvent : nsRunnable {
   }
 };
 
-SECStatus nsNSSHttpServerSession::createSessionFcn(const char *host,
-                                                   uint16_t portnum,
-                                                   SEC_HTTP_SERVER_SESSION *pSession)
+Result
+nsNSSHttpServerSession::createSessionFcn(const char* host,
+                                         uint16_t portnum,
+                                         SEC_HTTP_SERVER_SESSION* pSession)
 {
-  if (!host || !pSession)
-    return SECFailure;
+  if (!host || !pSession) {
+    return Result::FATAL_ERROR_INVALID_ARGS;
+  }
 
-  nsNSSHttpServerSession *hss = new nsNSSHttpServerSession;
-  if (!hss)
-    return SECFailure;
+  nsNSSHttpServerSession* hss = new nsNSSHttpServerSession;
+  if (!hss) {
+    return Result::FATAL_ERROR_NO_MEMORY;
+  }
 
   hss->mHost = host;
   hss->mPort = portnum;
 
   *pSession = hss;
-  return SECSuccess;
+  return Success;
 }
 
-SECStatus nsNSSHttpRequestSession::createFcn(SEC_HTTP_SERVER_SESSION session,
-                                             const char *http_protocol_variant,
-                                             const char *path_and_query_string,
-                                             const char *http_request_method, 
-                                             const PRIntervalTime timeout, 
-                                             SEC_HTTP_REQUEST_SESSION *pRequest)
+Result
+nsNSSHttpRequestSession::createFcn(SEC_HTTP_SERVER_SESSION session,
+                                   const char* http_protocol_variant,
+                                   const char* path_and_query_string,
+                                   const char* http_request_method,
+                                   const PRIntervalTime timeout,
+                                   SEC_HTTP_REQUEST_SESSION* pRequest)
 {
-  if (!session || !http_protocol_variant || !path_and_query_string || 
-      !http_request_method || !pRequest)
-    return SECFailure;
+  if (!session || !http_protocol_variant || !path_and_query_string ||
+      !http_request_method || !pRequest) {
+    return Result::FATAL_ERROR_INVALID_ARGS;
+  }
 
   nsNSSHttpServerSession* hss = static_cast<nsNSSHttpServerSession*>(session);
-  if (!hss)
-    return SECFailure;
+  if (!hss) {
+    return Result::FATAL_ERROR_INVALID_ARGS;
+  }
 
-  nsNSSHttpRequestSession *rs = new nsNSSHttpRequestSession;
-  if (!rs)
-    return SECFailure;
+  nsNSSHttpRequestSession* rs = new nsNSSHttpRequestSession;
+  if (!rs) {
+    return Result::FATAL_ERROR_NO_MEMORY;
+  }
 
   rs->mTimeoutInterval = timeout;
 
@@ -241,26 +247,28 @@ SECStatus nsNSSHttpRequestSession::createFcn(SEC_HTTP_SERVER_SESSION session,
   rs->mRequestMethod = http_request_method;
 
   *pRequest = (void*)rs;
-  return SECSuccess;
+  return Success;
 }
 
-SECStatus nsNSSHttpRequestSession::setPostDataFcn(const char *http_data, 
-                                                  const uint32_t http_data_len,
-                                                  const char *http_content_type)
+Result
+nsNSSHttpRequestSession::setPostDataFcn(const char* http_data,
+                                        const uint32_t http_data_len,
+                                        const char* http_content_type)
 {
   mHasPostData = true;
   mPostData.Assign(http_data, http_data_len);
   mPostContentType.Assign(http_content_type);
 
-  return SECSuccess;
+  return Success;
 }
 
-SECStatus nsNSSHttpRequestSession::trySendAndReceiveFcn(PRPollDesc **pPollDesc,
-                                                        uint16_t *http_response_code, 
-                                                        const char **http_response_content_type, 
-                                                        const char **http_response_headers, 
-                                                        const char **http_response_data, 
-                                                        uint32_t *http_response_data_len)
+Result
+nsNSSHttpRequestSession::trySendAndReceiveFcn(PRPollDesc** pPollDesc,
+                                              uint16_t* http_response_code,
+                                              const char** http_response_content_type,
+                                              const char** http_response_headers,
+                                              const char** http_response_data,
+                                              uint32_t* http_response_data_len)
 {
   MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
          ("nsNSSHttpRequestSession::trySendAndReceiveFcn to %s\n", mURL.get()));
@@ -271,28 +279,25 @@ SECStatus nsNSSHttpRequestSession::trySendAndReceiveFcn(PRPollDesc **pPollDesc,
     = do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID, &nrv);
   if (NS_FAILED(nrv)) {
     NS_ERROR("Could not get STS service");
-    PR_SetError(PR_INVALID_STATE_ERROR, 0);
-    return SECFailure;
+    return Result::FATAL_ERROR_INVALID_STATE;
   }
 
   nrv = sts->IsOnCurrentThread(&onSTSThread);
   if (NS_FAILED(nrv)) {
     NS_ERROR("IsOnCurrentThread failed");
-    PR_SetError(PR_INVALID_STATE_ERROR, 0);
-    return SECFailure;
+    return Result::FATAL_ERROR_INVALID_STATE;
   }
 
   if (onSTSThread) {
     NS_ERROR("nsNSSHttpRequestSession::trySendAndReceiveFcn called on socket "
              "thread; this will not work.");
-    PR_SetError(PR_INVALID_STATE_ERROR, 0);
-    return SECFailure;
+    return Result::FATAL_ERROR_INVALID_STATE;
   }
 
   const int max_retries = 2;
   int retry_count = 0;
   bool retryable_error = false;
-  SECStatus result_sec_status = SECFailure;
+  Result rv = Result::ERROR_UNKNOWN_ERROR;
 
   do
   {
@@ -311,7 +316,7 @@ SECStatus nsNSSHttpRequestSession::trySendAndReceiveFcn(PRPollDesc **pPollDesc,
     ++retry_count;
     retryable_error = false;
 
-    result_sec_status =
+    rv =
       internal_send_receive_attempt(retryable_error, pPollDesc, http_response_code,
                                     http_response_content_type, http_response_headers,
                                     http_response_data, http_response_data_len);
@@ -330,7 +335,7 @@ SECStatus nsNSSHttpRequestSession::trySendAndReceiveFcn(PRPollDesc **pPollDesc,
               retry_count));
   }
 
-  return result_sec_status;
+  return rv;
 }
 
 void
@@ -348,7 +353,7 @@ nsNSSHttpRequestSession::Release()
   }
 }
 
-SECStatus
+Result
 nsNSSHttpRequestSession::internal_send_receive_attempt(bool &retryable_error,
                                                        PRPollDesc **pPollDesc,
                                                        uint16_t *http_response_code,
@@ -370,9 +375,10 @@ nsNSSHttpRequestSession::internal_send_receive_attempt(bool &retryable_error,
     acceptableResultSize = *http_response_data_len;
     *http_response_data_len = 0;
   }
-  
-  if (!mListener)
-    return SECFailure;
+
+  if (!mListener) {
+    return Result::FATAL_ERROR_INVALID_STATE;
+  }
 
   Mutex& waitLock = mListener->mLock;
   CondVar& waitCondition = mListener->mCondition;
@@ -380,18 +386,18 @@ nsNSSHttpRequestSession::internal_send_receive_attempt(bool &retryable_error,
   waitFlag = true;
 
   RefPtr<nsHTTPDownloadEvent> event(new nsHTTPDownloadEvent);
-  if (!event)
-    return SECFailure;
+  if (!event) {
+    return Result::FATAL_ERROR_NO_MEMORY;
+  }
 
   event->mListener = mListener;
   this->AddRef();
   event->mRequestSession = this;
 
   nsresult rv = NS_DispatchToMainThread(event);
-  if (NS_FAILED(rv))
-  {
+  if (NS_FAILED(rv)) {
     event->mResponsibleForDoneSignal = false;
-    return SECFailure;
+    return Result::FATAL_ERROR_LIBRARY_FAILURE;
   }
 
   bool request_canceled = false;
@@ -488,37 +494,33 @@ nsNSSHttpRequestSession::internal_send_receive_attempt(bool &retryable_error,
     Telemetry::Accumulate(Telemetry::CERT_VALIDATION_HTTP_REQUEST_RESULT, 3);
   }
 
-  if (request_canceled)
-    return SECFailure;
+  if (request_canceled) {
+    return Result::ERROR_OCSP_SERVER_ERROR;
+  }
 
-  if (NS_FAILED(mListener->mResultCode))
-  {
-    if (mListener->mResultCode == NS_ERROR_CONNECTION_REFUSED
-        ||
-        mListener->mResultCode == NS_ERROR_NET_RESET)
-    {
+  if (NS_FAILED(mListener->mResultCode)) {
+    if (mListener->mResultCode == NS_ERROR_CONNECTION_REFUSED ||
+        mListener->mResultCode == NS_ERROR_NET_RESET) {
       retryable_error = true;
     }
-    return SECFailure;
+    return Result::ERROR_OCSP_SERVER_ERROR;
   }
 
   if (http_response_code)
     *http_response_code = mListener->mHttpResponseCode;
 
-  if (mListener->mHttpRequestSucceeded && http_response_data && http_response_data_len) {
-
+  if (mListener->mHttpRequestSucceeded && http_response_data &&
+      http_response_data_len) {
     *http_response_data_len = mListener->mResultLen;
-  
+
     // acceptableResultSize == 0 means: any size is acceptable
-    if (acceptableResultSize != 0
-        &&
-        acceptableResultSize < mListener->mResultLen)
-    {
-      return SECFailure;
+    if (acceptableResultSize != 0 &&
+        acceptableResultSize < mListener->mResultLen) {
+      return Result::ERROR_OCSP_SERVER_ERROR;
     }
 
-    // return data by reference, result data will be valid 
-    // until "this" gets destroyed by NSS
+    // Return data by reference, result data will be valid until "this" gets
+    // destroyed.
     *http_response_data = (const char*)mListener->mResultData;
   }
 
@@ -528,7 +530,7 @@ nsNSSHttpRequestSession::internal_send_receive_attempt(bool &retryable_error,
     }
   }
 
-  return SECSuccess;
+  return Success;
 }
 
 nsNSSHttpRequestSession::nsNSSHttpRequestSession()

security/manager/ssl/nsNSSCallbacks.h

@@ -16,6 +16,7 @@
 #include "nspr.h"
 #include "nsString.h"
 #include "pk11func.h"
+#include "pkix/pkixtypes.h"
 
 #include "ocspt.h" // Must be included after pk11func.h.
 
@@ -56,11 +57,11 @@ public:
 
   const uint8_t* mResultData; // allocated in loader, but owned by listener
   uint32_t mResultLen;
-  
+
   mozilla::Mutex mLock;
   mozilla::CondVar mCondition;
   volatile bool mWaitFlag;
-  
+
   bool mResponsibleForDoneSignal;
   void send_done_signal();
 
@@ -76,12 +77,14 @@ public:
 class nsNSSHttpServerSession
 {
 public:
-  nsCString mHost;
-  uint16_t mPort;  
+  typedef mozilla::pkix::Result Result;
 
-  static SECStatus createSessionFcn(const char *host,
-                                    uint16_t portnum,
-                                    SEC_HTTP_SERVER_SESSION *pSession);
+  nsCString mHost;
+  uint16_t mPort;
+
+  static Result createSessionFcn(const char* host,
+                                 uint16_t portnum,
+                                 SEC_HTTP_SERVER_SESSION* pSession);
 };
 
 class nsNSSHttpRequestSession
@@ -90,93 +93,99 @@ protected:
   mozilla::ThreadSafeAutoRefCnt mRefCount;
 
 public:
-  static SECStatus createFcn(SEC_HTTP_SERVER_SESSION session,
-                             const char *http_protocol_variant,
-                             const char *path_and_query_string,
-                             const char *http_request_method, 
-                             const PRIntervalTime timeout, 
-                             SEC_HTTP_REQUEST_SESSION *pRequest);
+  typedef mozilla::pkix::Result Result;
 
-  SECStatus setPostDataFcn(const char *http_data, 
-                           const uint32_t http_data_len,
-                           const char *http_content_type);
+  static Result createFcn(SEC_HTTP_SERVER_SESSION session,
+                          const char* httpProtocolVariant,
+                          const char* pathAndQueryString,
+                          const char* httpRequestMethod,
+                          const PRIntervalTime timeout,
+                          SEC_HTTP_REQUEST_SESSION* pRequest);
 
-  SECStatus trySendAndReceiveFcn(PRPollDesc **pPollDesc,
-                                 uint16_t *http_response_code, 
-                                 const char **http_response_content_type, 
-                                 const char **http_response_headers, 
-                                 const char **http_response_data, 
-                                 uint32_t *http_response_data_len);
+  Result setPostDataFcn(const char* httpData,
+                        const uint32_t httpDataLen,
+                        const char* httpContentType);
+
+  Result trySendAndReceiveFcn(PRPollDesc** pPollDesc,
+                              uint16_t* httpResponseCode,
+                              const char** httpResponseContentType,
+                              const char** httpResponseHeaders,
+                              const char** httpResponseData,
+                              uint32_t* httpResponseDataLen);
 
   void AddRef();
   void Release();
 
   nsCString mURL;
   nsCString mRequestMethod;
-  
+
   bool mHasPostData;
   nsCString mPostData;
   nsCString mPostContentType;
-  
+
   PRIntervalTime mTimeoutInterval;
-  
+
   RefPtr<nsHTTPListener> mListener;
-  
+
 protected:
   nsNSSHttpRequestSession();
   ~nsNSSHttpRequestSession();
 
-  SECStatus internal_send_receive_attempt(bool &retryable_error,
-                                          PRPollDesc **pPollDesc,
-                                          uint16_t *http_response_code,
-                                          const char **http_response_content_type,
-                                          const char **http_response_headers,
-                                          const char **http_response_data,
-                                          uint32_t *http_response_data_len);
+  Result internal_send_receive_attempt(bool& retryableError,
+                                       PRPollDesc** pPollDesc,
+                                       uint16_t* httpResponseCode,
+                                       const char** httpResponseContentType,
+                                       const char** httpResponseHeaders,
+                                       const char** httpResponseData,
+                                       uint32_t* httpResponseDataLen);
 };
 
 class nsNSSHttpInterface
 {
 public:
-  static SECStatus createSessionFcn(const char *host,
-                                    uint16_t portnum,
-                                    SEC_HTTP_SERVER_SESSION *pSession)
+  typedef mozilla::pkix::Result Result;
+
+  static Result createSessionFcn(const char* host,
+                                 uint16_t portnum,
+                                 SEC_HTTP_SERVER_SESSION* pSession)
   {
     return nsNSSHttpServerSession::createSessionFcn(host, portnum, pSession);
   }
 
-  static SECStatus createFcn(SEC_HTTP_SERVER_SESSION session,
-                             const char *http_protocol_variant,
-                             const char *path_and_query_string,
-                             const char *http_request_method, 
-                             const PRIntervalTime timeout, 
-                             SEC_HTTP_REQUEST_SESSION *pRequest)
+  static Result createFcn(SEC_HTTP_SERVER_SESSION session,
+                          const char* httpProtocolVariant,
+                          const char* pathAndQueryString,
+                          const char* httpRequestMethod,
+                          const PRIntervalTime timeout,
+                          SEC_HTTP_REQUEST_SESSION* pRequest)
   {
-    return nsNSSHttpRequestSession::createFcn(session, http_protocol_variant,
-                                     path_and_query_string, http_request_method, 
-                                     timeout, pRequest);
+    return nsNSSHttpRequestSession::createFcn(session, httpProtocolVariant,
+                                              pathAndQueryString,
+                                              httpRequestMethod, timeout,
+                                              pRequest);
   }
 
-  static SECStatus setPostDataFcn(SEC_HTTP_REQUEST_SESSION request, 
-                                  const char *http_data, 
-                                  const uint32_t http_data_len,
-                                  const char *http_content_type)
+  static Result setPostDataFcn(SEC_HTTP_REQUEST_SESSION request,
+                               const char* httpData,
+                               const uint32_t httpDataLen,
+                               const char* httpContentType)
   {
     return static_cast<nsNSSHttpRequestSession*>(request)
-            ->setPostDataFcn(http_data, http_data_len, http_content_type);
+      ->setPostDataFcn(httpData, httpDataLen, httpContentType);
   }
 
-  static SECStatus trySendAndReceiveFcn(SEC_HTTP_REQUEST_SESSION request, 
-                                        PRPollDesc **pPollDesc,
-                                        uint16_t *http_response_code, 
-                                        const char **http_response_content_type, 
-                                        const char **http_response_headers, 
-                                        const char **http_response_data, 
-                                        uint32_t *http_response_data_len)
+  static Result trySendAndReceiveFcn(SEC_HTTP_REQUEST_SESSION request,
+                                     PRPollDesc** pPollDesc,
+                                     uint16_t* httpResponseCode,
+                                     const char** httpResponseContentType,
+                                     const char** httpResponseHeaders,
+                                     const char** httpResponseData,
+                                     uint32_t* httpResponseDataLen)
   {
     return static_cast<nsNSSHttpRequestSession*>(request)
-            ->trySendAndReceiveFcn(pPollDesc, http_response_code, http_response_content_type, 
-                     http_response_headers, http_response_data, http_response_data_len);
+      ->trySendAndReceiveFcn(pPollDesc, httpResponseCode,
+                             httpResponseContentType, httpResponseHeaders,
+                             httpResponseData, httpResponseDataLen);
   }
 };