NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/cert_verify_proc_chromeos.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/cert_verify_proc_chromeos.h"
+
+namespace net {
+
+CertVerifyProcChromeOS::CertVerifyProcChromeOS()
+    : CertVerifyProcNSS(InitializeCERTChainVerifyCallback()) {}
+
+CertVerifyProcChromeOS::CertVerifyProcChromeOS(
+    crypto::ScopedPK11Slot public_slot,
+    crypto::ScopedPK11Slot private_slot)
+    : CertVerifyProcNSS(InitializeCERTChainVerifyCallback()) {
+  profile_filter_.Init(public_slot.Pass(), private_slot.Pass());
+}
+
+CertVerifyProcChromeOS::~CertVerifyProcChromeOS() {}
+
+CERTChainVerifyCallback*
+CertVerifyProcChromeOS::InitializeCERTChainVerifyCallback() {
+  chain_verify_callback_.isChainValid =
+      &CertVerifyProcChromeOS::IsChainValidFunc;
+  chain_verify_callback_.isChainValidArg = static_cast<void*>(this);
+  return &chain_verify_callback_;
+}
+
+// static
+SECStatus CertVerifyProcChromeOS::IsChainValidFunc(
+    void* is_chain_valid_arg,
+    const CERTCertList* current_chain,
+    PRBool* chain_ok) {
+  CertVerifyProcChromeOS* that =
+      static_cast<CertVerifyProcChromeOS*>(is_chain_valid_arg);
+  // NSS doesn't define a CERT_LIST_TAIL macro, but this is what it would look
+  // like.
+  CERTCertificate* cert = reinterpret_cast<CERTCertListNode*>(
+                              PR_LIST_TAIL(&current_chain->list))->cert;

[Ryan Sleevi, 2014/01/22 00:43:48]

NACK on using PR_LIST_TAIL for this type.

1) File a bug in NSS to add CERT_LIST_TAIL
2) Add an #ifdef guard ~line 6 to handle when this is being added

#ifndef CERT_LIST_TAIL
#define CERT_LIST_TAIL(l) ((CERTCertListNode *)PR_LIST_TAIL(&l->list))
#endif

[mattm, 2014/01/24 04:47:31]

Done.

https://bugzilla.mozilla.org/show_bug.cgi?id=962413

+  // TODO(mattm): If crbug.com/334384 is fixed to allow setting trust
+  // properly when the same cert is in multiple slots, this would also need
+  // updating to check the per-slot trust values.
+  *chain_ok = that->profile_filter_.IsCertAllowed(cert) ? PR_TRUE : PR_FALSE;
+  return SECSuccess;
+}
+
+}  // namespace net