NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

net/cert/cert_verify_proc_chromeos.h

Index: net/cert/cert_verify_proc_chromeos.h
diff --git a/net/cert/cert_verify_proc_chromeos.h b/net/cert/cert_verify_proc_chromeos.h
new file mode 100644
index 0000000000000000000000000000000000000000..e7527fed522d2e3f7b897250e023c71ec89f6fa4
--- /dev/null
+++ b/net/cert/cert_verify_proc_chromeos.h
@@ -0,0 +1,53 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_CERT_VERIFY_PROC_CHROMEOS_H_
+#define NET_CERT_CERT_VERIFY_PROC_CHROMEOS_H_
+
+#include "crypto/scoped_nss_types.h"
+#include "net/base/net_export.h"
+#include "net/cert/cert_verify_proc_nss.h"
+#include "net/cert/nss_profile_filter_chromeos.h"
+
+namespace net {
+
+// Wrapper around CertVerifyProcNSS which allows filtering trust decisions on a
+// per-slot basis. Unlike the other CertVerifyProc implementations, this one is
+// publicly exported, so that the non-default constructor can be used to specify
+// the slots to use.
+//
+// Note that only the simple case is currently handled (if a slot contains a new
+// trust root, that root should not be trusted by CertVerifyProcChromeOS
+// instances using other slots). More complicated cases are not handled (like
+// two slots adding the same root cert but with different trust values).
+class NET_EXPORT CertVerifyProcChromeOS : public CertVerifyProcNSS {
+ public:
+  // Creates a CertVerifyProc that doesn't allow any user-provided trust roots.
+  CertVerifyProcChromeOS();
+
+  // Creates a CertVerifyProc that doesn't allow trust roots provided by
+  // users other than the specified slot.
+  CertVerifyProcChromeOS(crypto::ScopedPK11Slot public_slot,
+                         crypto::ScopedPK11Slot private_slot);

[Ryan Sleevi, 2014/01/25 01:50:17]

Why take a private slot? This doesn't make sense for the CrOS case, does it?

Also, the comment isn't clear, in that it refers to slot singular.

[mattm, 2014/01/28 04:36:44]

Oops, yeah. Didn't finish an earlier change to only pass the public_slot.

+
+ protected:
+  virtual ~CertVerifyProcChromeOS();
+
+ private:
+  CERTChainVerifyCallback* InitializeCERTChainVerifyCallback();
+
+  static SECStatus IsChainValidFunc(void* is_chain_valid_arg,
+                                    const CERTCertList* current_chain,
+                                    PRBool* chain_ok);
+
+  // A pointer to this object is passed to CertVerifyProcNSS.
+  CERTChainVerifyCallback chain_verify_callback_;
+
+  NSSProfileFilterChromeOS profile_filter_;
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_CERT_VERIFY_PROC_CHROMEOS_H_
+