NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 85 matching lines @@
 #endif
 
 #if !defined(OS_IOS) && !defined(OS_ANDROID)
 #include "net/proxy/proxy_resolver_v8.h"
 #endif
 
 #if defined(OS_ANDROID) || defined(OS_IOS)
 #include "chrome/browser/net/spdyproxy/data_reduction_proxy_settings.h"
 #endif
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/net/cert_verify_proc_chromeos.h"
+#include "net/cert/multi_threaded_cert_verifier.h"
+#endif
+
 using content::BrowserThread;
 
 class SafeBrowsingURLRequestContext;
 
 // The IOThread object must outlive any tasks posted to the IO thread before the
 // Quit task, so base::Bind() calls are not refcounted.
 
 namespace {
 
 const char kQuicFieldTrialName[] = "QUIC";
@@ skipping 421 matching lines @@
   ChromeNetworkDelegate* network_delegate =
       new ChromeNetworkDelegate(extension_event_router_forwarder_,
                                 &system_enable_referrers_);
   if (command_line.HasSwitch(switches::kEnableClientHints))
     network_delegate->SetEnableClientHints();
   if (command_line.HasSwitch(switches::kDisableExtensionsHttpThrottling))
     network_delegate->NeverThrottleRequests();
   globals_->system_network_delegate.reset(network_delegate);
   globals_->host_resolver = CreateGlobalHostResolver(net_log_);
   UpdateDnsClientEnabled();
+#if defined(OS_CHROMEOS)
+  // Creates a CertVerifyProc that doesn't allow any profile-provided certs.
+  globals_->cert_verifier.reset(new net::MultiThreadedCertVerifier(
+      new chromeos::CertVerifyProcChromeOS()));
+#else
   globals_->cert_verifier.reset(net::CertVerifier::CreateDefault());

[Ryan Sleevi, 2014/01/30 05:27:40]

I think you should update this to use MultiThreadedCertVerifier as well,
otherwise you're coupling lines 554/555 to the implementation details of
CreateDefault, which is non-ideal.

[mattm, 2014/02/04 05:31:21]

Done.

+#endif
   globals_->transport_security_state.reset(new net::TransportSecurityState());
 #if !defined(USE_OPENSSL)
   // For now, Certificate Transparency is only implemented for platforms
   // that use NSS.
   net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
   globals_->cert_transparency_verifier.reset(ct_verifier);
 
   // Add built-in logs
   ct_verifier->AddLog(net::ct::CreateGooglePilotLogVerifier().Pass());
   ct_verifier->AddLog(net::ct::CreateGoogleAviatorLogVerifier().Pass());
@@ skipping 593 matching lines @@
   std::string version_flag =
       command_line.GetSwitchValueASCII(switches::kQuicVersion);
   for (size_t i = 0; i < supported_versions.size(); ++i) {
     net::QuicVersion version = supported_versions[i];
     if (net::QuicVersionToString(version) == version_flag) {
       return version;
     }
   }
   return net::QUIC_VERSION_UNSUPPORTED;
 }