Fix imported server certs being distrusted in NSS 3.13.

chrome/common/net/x509_certificate_model_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/net/x509_certificate_model.h"
 
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "net/base/cert_database.h"
@@ skipping 14 matching lines @@
   EXPECT_EQ(net::CA_CERT,
             x509_certificate_model::GetType(cert->os_cert_handle()));
 
   // Test that explicitly distrusted CA certs are still returned as CA_CERT
   // type. See http://crbug.com/96654.
   net::CertDatabase cert_db;
   // TODO(mattm): This depends on the implementation details of SetCertTrust
   // where calling with SERVER_CERT and UNTRUSTED causes a cert to be explicitly
   // distrusted (trust set to CERTDB_TERMINAL_RECORD). See
   // http://crbug.com/116411.  When I fix that bug I'll also add a way to set
   // this directly.

[wtc, 2012/05/16 23:37:12]

Should this comment be updated?

[mattm, 2012/05/18 03:40:54]

Oops, updated this test too.

   EXPECT_TRUE(cert_db.SetCertTrust(cert, net::SERVER_CERT,
                                    net::CertDatabase::UNTRUSTED));
 
   EXPECT_EQ(net::CA_CERT,
             x509_certificate_model::GetType(cert->os_cert_handle()));
 #endif
 }
 
 TEST(X509CertificateModelTest, GetTypeServer) {
   scoped_refptr<net::X509Certificate> cert(
@@ skipping 12 matching lines @@
             x509_certificate_model::GetType(cert->os_cert_handle()));
 
   net::CertDatabase cert_db;
   EXPECT_TRUE(cert_db.SetCertTrust(cert, net::SERVER_CERT,
                                    net::CertDatabase::TRUSTED_SSL));
 
   EXPECT_EQ(net::SERVER_CERT,
             x509_certificate_model::GetType(cert->os_cert_handle()));
 
   EXPECT_TRUE(cert_db.SetCertTrust(cert, net::SERVER_CERT,
-                                   net::CertDatabase::UNTRUSTED));
+                                   net::CertDatabase::EXPLICIT_DISTRUST));

[wtc, 2012/05/16 23:37:12]

Does it matter whether we pass UNTRUSTED or EXPLICIT_DISTRUST
to this SetCertTrust call?

I suspect you had to change this to EXPLICIT_DISTRUST
because the GetCertType() is determining server certs
incorrectly.

[mattm, 2012/05/18 03:40:54]

Yeah, the first test after the #else is already testing the UNTRUSTED case.

 
   EXPECT_EQ(net::SERVER_CERT,
             x509_certificate_model::GetType(cert->os_cert_handle()));
 #endif
 }