Fix imported server certs being distrusted in NSS 3.13.

net/base/cert_database_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 181 matching lines @@
   X509Certificate* root = FindRootInList(certificates);
   bool success = psm::ImportCACerts(certificates, root, trust_bits,
                                     not_imported);
   if (success)
     CertDatabase::NotifyObserversOfCertTrustChanged(NULL);
 
   return success;
 }
 
 bool CertDatabase::ImportServerCert(const CertificateList& certificates,
+                                    TrustBits trust_bits,
                                     ImportCertFailureList* not_imported) {
-  return psm::ImportServerCert(certificates, not_imported);
+  return psm::ImportServerCert(certificates, trust_bits, not_imported);
 }
 
 CertDatabase::TrustBits CertDatabase::GetCertTrust(const X509Certificate* cert,
                                                    CertType type) const {
   CERTCertTrust nsstrust;
   SECStatus srv = CERT_GetCertTrust(cert->os_cert_handle(), &nsstrust);
   if (srv != SECSuccess) {
     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
     return UNTRUSTED;
   }
   psm::nsNSSCertTrust trust(&nsstrust);
   switch (type) {
     case CA_CERT:
       return trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE) * TRUSTED_SSL +
           trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE) * TRUSTED_EMAIL +
-          trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN;
+          trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN +
+          ((trust.HasTerminalRecord(PR_TRUE, PR_FALSE, PR_FALSE) |
+            trust.HasTerminalRecord(PR_FALSE, PR_TRUE, PR_FALSE) |
+            trust.HasTerminalRecord(PR_FALSE, PR_FALSE, PR_TRUE)) *
+           TRUST_TERMINAL_RECORD);
     case SERVER_CERT:
+      // Since we don't define per-type terminal-record bits, we can't precisely
+      // round-trip from NSS trust to TrustBits and back.
       return trust.HasTrustedPeer(PR_TRUE, PR_FALSE, PR_FALSE) * TRUSTED_SSL +
           trust.HasTrustedPeer(PR_FALSE, PR_TRUE, PR_FALSE) * TRUSTED_EMAIL +
-          trust.HasTrustedPeer(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN;
+          trust.HasTrustedPeer(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN +
+          ((trust.HasTerminalRecord(PR_FALSE, PR_TRUE, PR_FALSE) |
+            trust.HasTerminalRecord(PR_FALSE, PR_FALSE, PR_TRUE)) *
+           TRUST_TERMINAL_RECORD);
     default:
       return UNTRUSTED;
   }
 }
 
 bool CertDatabase::IsUntrusted(const X509Certificate* cert) const {
   CERTCertTrust nsstrust;
   SECStatus rv = CERT_GetCertTrust(cert->os_cert_handle(), &nsstrust);
   if (rv != SECSuccess) {
     LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
@@ skipping 79 matching lines @@
 
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net