NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 34 matching lines @@
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "components/policy/core/common/policy_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/cookie_store_factory.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/net_util.h"
 #include "net/base/network_time_notifier.h"
 #include "net/base/sdch_manager.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/cert_verify_proc.h"
 #include "net/cert/ct_known_logs.h"
 #include "net/cert/ct_verifier.h"
+#include "net/cert/multi_threaded_cert_verifier.h"
 #include "net/cookies/cookie_store.h"
 #include "net/dns/host_cache.h"
 #include "net/dns/host_resolver.h"
 #include "net/dns/mapped_host_resolver.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_auth_filter.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_server_properties_impl.h"
 #include "net/proxy/proxy_config_service.h"
@@ skipping 30 matching lines @@
 #endif
 
 #if !defined(OS_IOS) && !defined(OS_ANDROID)
 #include "net/proxy/proxy_resolver_v8.h"
 #endif
 
 #if defined(OS_ANDROID) || defined(OS_IOS)
 #include "chrome/browser/net/spdyproxy/data_reduction_proxy_settings.h"
 #endif
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/net/cert_verify_proc_chromeos.h"
+#endif
+
 using content::BrowserThread;
 
 class SafeBrowsingURLRequestContext;
 
 // The IOThread object must outlive any tasks posted to the IO thread before the
 // Quit task, so base::Bind() calls are not refcounted.
 
 namespace {
 
 const char kQuicFieldTrialName[] = "QUIC";
@@ skipping 421 matching lines @@
   ChromeNetworkDelegate* network_delegate =
       new ChromeNetworkDelegate(extension_event_router_forwarder_,
                                 &system_enable_referrers_);
   if (command_line.HasSwitch(switches::kEnableClientHints))
     network_delegate->SetEnableClientHints();
   if (command_line.HasSwitch(switches::kDisableExtensionsHttpThrottling))
     network_delegate->NeverThrottleRequests();
   globals_->system_network_delegate.reset(network_delegate);
   globals_->host_resolver = CreateGlobalHostResolver(net_log_);
   UpdateDnsClientEnabled();
-  globals_->cert_verifier.reset(net::CertVerifier::CreateDefault());
+#if defined(OS_CHROMEOS)
+  // Creates a CertVerifyProc that doesn't allow any profile-provided certs.
+  globals_->cert_verifier.reset(new net::MultiThreadedCertVerifier(
+      new chromeos::CertVerifyProcChromeOS()));
+#else
+  globals_->cert_verifier.reset(
+      new net::MultiThreadedCertVerifier(net::CertVerifyProc::CreateDefault()));
+#endif
   globals_->transport_security_state.reset(new net::TransportSecurityState());
 #if !defined(USE_OPENSSL)
   // For now, Certificate Transparency is only implemented for platforms
   // that use NSS.
   net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
   globals_->cert_transparency_verifier.reset(ct_verifier);
 
   // Add built-in logs
   ct_verifier->AddLog(net::ct::CreateGooglePilotLogVerifier().Pass());
   ct_verifier->AddLog(net::ct::CreateGoogleAviatorLogVerifier().Pass());
@@ skipping 632 matching lines @@
   std::string version_flag =
       command_line.GetSwitchValueASCII(switches::kQuicVersion);
   for (size_t i = 0; i < supported_versions.size(); ++i) {
     net::QuicVersion version = supported_versions[i];
     if (net::QuicVersionToString(version) == version_flag) {
       return version;
     }
   }
   return net::QUIC_VERSION_UNSUPPORTED;
 }