NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/cert_verify_proc_chromeos.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/cert_verify_proc_chromeos.h"
+
+// NSS doesn't currently define CERT_LIST_TAIL.
+// See https://bugzilla.mozilla.org/show_bug.cgi?id=962413
+#ifndef CERT_LIST_TAIL
+#define CERT_LIST_TAIL(l) ((CERTCertListNode *)PR_LIST_TAIL(&l->list))
+#endif
+
+namespace net {
+
+CertVerifyProcChromeOS::CertVerifyProcChromeOS()
+    : CertVerifyProcNSS(InitializeCERTChainVerifyCallback()) {}
+
+CertVerifyProcChromeOS::CertVerifyProcChromeOS(
+    crypto::ScopedPK11Slot public_slot,
+    crypto::ScopedPK11Slot private_slot)
+    : CertVerifyProcNSS(InitializeCERTChainVerifyCallback()) {
+  profile_filter_.Init(public_slot.Pass(), private_slot.Pass());
+}
+
+CertVerifyProcChromeOS::~CertVerifyProcChromeOS() {}
+
+CERTChainVerifyCallback*
+CertVerifyProcChromeOS::InitializeCERTChainVerifyCallback() {
+  chain_verify_callback_.isChainValid =
+      &CertVerifyProcChromeOS::IsChainValidFunc;
+  chain_verify_callback_.isChainValidArg = static_cast<void*>(this);
+  return &chain_verify_callback_;
+}
+
+// static
+SECStatus CertVerifyProcChromeOS::IsChainValidFunc(
+    void* is_chain_valid_arg,
+    const CERTCertList* current_chain,
+    PRBool* chain_ok) {
+  CertVerifyProcChromeOS* that =
+      static_cast<CertVerifyProcChromeOS*>(is_chain_valid_arg);
+  CERTCertificate* cert = CERT_LIST_TAIL(current_chain)->cert;
+  // TODO(mattm): If crbug.com/334384 is fixed to allow setting trust
+  // properly when the same cert is in multiple slots, this would also need
+  // updating to check the per-slot trust values.
+  *chain_ok = that->profile_filter_.IsCertAllowed(cert) ? PR_TRUE : PR_FALSE;
+  return SECSuccess;
+}
+
+}  // namespace net