Create stubs for system certificate validation.

net/base/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/base64.h"
 #include "base/file_path.h"
+#include "base/message_loop.h"
 #include "base/sha1.h"
 #include "base/string_piece.h"
 #include "net/base/asn1_util.h"
 #include "net/base/cert_test_util.h"
 #include "net/base/cert_verifier.h"
 #include "net/base/cert_verify_result.h"
+#include "net/base/net_errors.h"
+#include "net/base/net_log.h"
 #include "net/base/ssl_info.h"
 #include "net/base/test_root_certs.h"
+#include "net/base/test_completion_callback.h"

[wtc, 2012/03/06 23:10:14]

Nit: ordering is wrong.

 #include "net/base/x509_certificate.h"
 #include "net/http/http_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(USE_OPENSSL)
 #include "crypto/openssl_util.h"
 #else
 #include "crypto/nss_util.h"
 #endif
 
@@ skipping 250 matching lines @@
 
   // Add the root that signed the intermediate for this test.
   scoped_refptr<X509Certificate> root_cert =
       ImportCertFromFile(certs_dir, "2048-rsa-root.pem");
   ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert);
   TestRootCerts::GetInstance()->Add(root_cert.get());
 
   // Verify has the side-effect of populating public_key_hashes, which
   // ParsePinsHeader needs. (It wants to check pins against the validated
   // chain, not just the presented chain.)
+  int rv = ERR_FAILED;
   CertVerifyResult result;
-  int rv = ssl_info.cert->Verify("127.0.0.1", 0, NULL, &result);
-  ASSERT_EQ(0, rv);
+  scoped_ptr<CertVerifier> verifier(
+      CertVerifier::CreateDefaultCertVerifier());
+  TestCompletionCallback callback;
+  CertVerifier::RequestHandle handle = NULL;
+  rv = verifier->Verify(ssl_info.cert, "127.0.0.1", 0, NULL, &result,
+                        callback.callback(), &handle, BoundNetLog());
+  if (rv == ERR_IO_PENDING)
+    rv = callback.WaitForResult();

[wtc, 2012/03/06 23:10:14]

Nit: there is a method (GetResult?) that is equivalent to
these two lines.

+  ASSERT_EQ(OK, rv);
   // Normally, ssl_client_socket_nss would do this, but for a unit test we
   // fake it.
   ssl_info.public_key_hashes = result.public_key_hashes;
   std::string good_pin = GetPinFromCert(ssl_info.cert);
 
   // The backup pin is fake --- we just need an SPKI hash that does not match
   // the hash of any SPKI in the certificate chain.
   std::string backup_pin = "pin-sha1=" +
       HttpUtil::Quote("6dcfXufJLW3J6S/9rRe4vUlBj5g=");
 
@@ skipping 947 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net