Fix imported server certs being distrusted in NSS 3.13.

net/base/cert_database.h

Index: net/base/cert_database.h
diff --git a/net/base/cert_database.h b/net/base/cert_database.h
index 2e95624c911c1d070f6d4d1df65a6d93fbdc9e13..326501194478a9a0076dd5cd6fea4319257a0a5f 100644
--- a/net/base/cert_database.h
+++ b/net/base/cert_database.h
@@ -80,14 +80,17 @@ class NET_EXPORT CertDatabase {
   // trusted as a server.
   // For EMAIL_CERT, only TRUSTED_EMAIL makes sense, and specifies the cert is
   // trusted for email.
+  // EXPLICIT_DISTRUST specifies that the cert should not be trusted, regardless
+  // of whether it would otherwise inherit trust from the issuer chain.

[wtc, 2012/05/16 23:37:12]

The difference between UNTRUSTED and EXPLICIT_DISTRUST
should be clarified.

UNTRUSTED probably should be renamed to something like
TRUST_NORMAL or TRUST_DEFAULT.

We probably should replace EXPLICIT_DISTRUST with three
separate flags: DISTRUSTED_SSL, DISTRUSTED_EMAIL, and
DISTRUSTED_OBJ_SIGN.

[mattm, 2012/05/18 03:40:54]

Done.

   // NOTE: The actual constants are defined using an enum instead of static
   // consts due to compilation/linkage constraints with template functions.
   typedef uint32 TrustBits;
   enum {
-    UNTRUSTED        =      0,
-    TRUSTED_SSL      = 1 << 0,
-    TRUSTED_EMAIL    = 1 << 1,
-    TRUSTED_OBJ_SIGN = 1 << 2,
+    UNTRUSTED             =      0,
+    TRUSTED_SSL           = 1 << 0,
+    TRUSTED_EMAIL         = 1 << 1,
+    TRUSTED_OBJ_SIGN      = 1 << 2,
+    EXPLICIT_DISTRUST     = 1 << 3,
   };
 
   CertDatabase();
@@ -101,7 +104,7 @@ class NET_EXPORT CertDatabase {
   // the platform cert database, or possibly other network error codes.
   int AddUserCert(X509Certificate* cert);
 
-#if defined(USE_NSS) || defined(USE_OPENSSL)
+#if defined(USE_NSS)
   // Get a list of unique certificates in the certificate database (one
   // instance of all certificates).
   void ListCerts(CertificateList* certs);
@@ -162,6 +165,7 @@ class NET_EXPORT CertDatabase {
   // |not_imported| should be checked for any certificates that were not
   // imported.
   bool ImportServerCert(const CertificateList& certificates,
+                        TrustBits trust_bits,
                         ImportCertFailureList* not_imported);
 
   // Get trust bits for certificate.