Create stubs for system certificate validation.

net/base/cert_database_nss_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/lazy_instance.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
 #include "base/string16.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/base/cert_database.h"
 #include "net/base/cert_status_flags.h"
+#include "net/base/cert_verify_proc_nss.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertTrust.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace psm = mozilla_security_manager;
 
@@ skipping 510 matching lines @@
   scoped_refptr<X509Certificate> goog_cert(cert_list[0]);
   scoped_refptr<X509Certificate> thawte_cert(cert_list[1]);
   EXPECT_EQ("www.google.com", goog_cert->subject().common_name);
   EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name);
 
   EXPECT_EQ(CertDatabase::UNTRUSTED,
             cert_db_.GetCertTrust(goog_cert.get(), SERVER_CERT));
   psm::nsNSSCertTrust goog_trust(goog_cert->os_cert_handle()->trust);
   EXPECT_TRUE(goog_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE));
 
+  scoped_refptr<CertVerifyProcNSS> nss_verify_proc(new CertVerifyProcNSS());

[Ryan Sleevi, 2012/03/12 23:07:51]

This code directly uses CertVerifyProcNSS as it's directly tied to NSS
verification. Hence why it's not using CreateDefault or equivalent.

   int flags = 0;
   CertVerifyResult verify_result;
-  int error = goog_cert->Verify("www.google.com", flags, NULL, &verify_result);
+  int error = nss_verify_proc->Verify(goog_cert, "www.google.com", flags,
+                                      NULL, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) {
   CertificateList certs;
   ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs));
 
   CertDatabase::ImportCertFailureList failed;
   EXPECT_TRUE(cert_db_.ImportServerCert(certs, &failed));
 
   EXPECT_EQ(0U, failed.size());
 
   CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> puny_cert(cert_list[0]);
 
   EXPECT_EQ(CertDatabase::UNTRUSTED,
             cert_db_.GetCertTrust(puny_cert.get(), SERVER_CERT));
   psm::nsNSSCertTrust puny_trust(puny_cert->os_cert_handle()->trust);
   EXPECT_TRUE(puny_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE));
 
+  scoped_refptr<CertVerifyProcNSS> nss_verify_proc(new CertVerifyProcNSS());
   int flags = 0;
   CertVerifyResult verify_result;
-  int error = puny_cert->Verify("xn--wgv71a119e.com", flags, NULL,
-                                &verify_result);
+  int error = nss_verify_proc->Verify(puny_cert, "xn--wgv71a119e.com", flags,
+                                      NULL, &verify_result);
   EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error);
   EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
 
   // TODO(mattm): this should be SERVER_CERT, not CA_CERT, but that does not
   // work due to NSS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=531160
   EXPECT_TRUE(cert_db_.SetCertTrust(
       puny_cert.get(), CA_CERT,
       CertDatabase::TRUSTED_SSL | CertDatabase::TRUSTED_EMAIL));
 
   verify_result.Reset();
-  error = puny_cert->Verify("xn--wgv71a119e.com", flags, NULL, &verify_result);
+  error = nss_verify_proc->Verify(puny_cert, "xn--wgv71a119e.com", flags,
+                                  NULL, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
 }
 
 }  // namespace net