Merge NSS_3_14_2_RTM.

mozilla/security/nss/lib/libpkix/pkix/top/pkix_build.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_build.c
  *
  * Top level buildChain function
  *
  */
 
@@ skipping 245 matching lines @@
                 state->buildConstants.anchors =
                         parentState->buildConstants.anchors;
                 state->buildConstants.userCheckers =
                         parentState->buildConstants.userCheckers;
                 state->buildConstants.hintCerts =
                         parentState->buildConstants.hintCerts;
                 state->buildConstants.revChecker =
                         parentState->buildConstants.revChecker;
                 state->buildConstants.aiaMgr =
                         parentState->buildConstants.aiaMgr;
+                state->buildConstants.trustOnlyUserAnchors =
+                        parentState->buildConstants.trustOnlyUserAnchors;
         }
 
         *pState = state;
         state = NULL;
 cleanup:
         
         PKIX_DECREF(state);
 
         PKIX_RETURN(FORWARDBUILDERSTATE);
 }
@@ skipping 564 matching lines @@
         PKIX_ENTER(BUILD, "pkix_Build_VerifyCertificate");
         PKIX_NULLCHECK_THREE(state, pTrusted, pNeedsCRLChecking);
         PKIX_NULLCHECK_THREE
                 (state->candidateCerts, state->prevCert, state->trustChain);
 
         *pNeedsCRLChecking = PKIX_FALSE;
 
         PKIX_INCREF(state->candidateCert);
         candidateCert = state->candidateCert;
 
-        /* If user defined trust anchor list is not empty, do not
-         * trust any certs except to the ones that are in the list */
         if (state->buildConstants.numAnchors) {
-            trustOnlyUserAnchors = PKIX_TRUE;
+            trustOnlyUserAnchors = state->buildConstants.trustOnlyUserAnchors;
         }
 
         PKIX_CHECK(
             PKIX_PL_Cert_IsCertTrusted(candidateCert,
                                        trustOnlyUserAnchors,
                                        &trusted, plContext),
             PKIX_CERTISCERTTRUSTEDFAILED);
 
         *pTrusted = trusted;
 
@@ skipping 2606 matching lines @@
             buildConstants.testDate = testDate;
             buildConstants.timeLimit = NULL;
             buildConstants.targetCert = targetCert;
             buildConstants.targetPubKey = targetPubKey;
             buildConstants.certStores = certStores;
             buildConstants.anchors = anchors;
             buildConstants.userCheckers = userCheckers;
             buildConstants.hintCerts = hintCerts;
             buildConstants.revChecker = revChecker;
             buildConstants.aiaMgr = aiaMgr;
-                
+            buildConstants.trustOnlyUserAnchors =
+                    procParams->useOnlyTrustAnchors;
+
             PKIX_CHECK(pkix_Build_GetResourceLimits(&buildConstants, plContext),
                     PKIX_BUILDGETRESOURCELIMITSFAILED);
     
             PKIX_CHECK(pkix_ForwardBuilderState_Create
                     (0,              /* PKIX_UInt32 traversedCACerts */
                     buildConstants.maxFanout,
                     buildConstants.maxDepth,
                     PKIX_FALSE,      /* PKIX_Boolean revCheckDelayed */
                     PKIX_TRUE,       /* PKIX_Boolean canBeCached */
                     NULL,            /* PKIX_Date *validityDate */
@@ skipping 26 matching lines @@
             state->buildConstants.anchors = buildConstants.anchors;
             PKIX_INCREF(buildConstants.userCheckers);
             state->buildConstants.userCheckers =
                     buildConstants.userCheckers;
             PKIX_INCREF(buildConstants.hintCerts);
             state->buildConstants.hintCerts = buildConstants.hintCerts;
             PKIX_INCREF(buildConstants.revChecker);
             state->buildConstants.revChecker = buildConstants.revChecker;
             state->buildConstants.aiaMgr = buildConstants.aiaMgr;
             aiaMgr = NULL;
+            state->buildConstants.trustOnlyUserAnchors =
+                    buildConstants.trustOnlyUserAnchors;
 
             if (buildConstants.maxTime != 0) {
                     PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds
                             (buildConstants.maxTime,
                             &state->buildConstants.timeLimit,
                             plContext),
                             PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);
             }
 
             if (pVerifyNode != NULL) {
@@ skipping 271 matching lines @@
                 *pBuildResult = buildResult;
                 buildResult = NULL;
         }
 
 cleanup:
         PKIX_DECREF(buildResult);
         PKIX_DECREF(state);
 
         PKIX_RETURN(BUILD);
 }