NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

chrome/browser/chromeos/net/cert_verify_proc_chromeos.h

Index: chrome/browser/chromeos/net/cert_verify_proc_chromeos.h
diff --git a/chrome/browser/chromeos/net/cert_verify_proc_chromeos.h b/chrome/browser/chromeos/net/cert_verify_proc_chromeos.h
new file mode 100644
index 0000000000000000000000000000000000000000..46a14bb247890d3f9de70c66ca81ae48cb6ccfc5
--- /dev/null
+++ b/chrome/browser/chromeos/net/cert_verify_proc_chromeos.h
@@ -0,0 +1,56 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_NET_CERT_VERIFY_PROC_CHROMEOS_H_
+#define CHROME_BROWSER_CHROMEOS_NET_CERT_VERIFY_PROC_CHROMEOS_H_
+
+#include "crypto/scoped_nss_types.h"
+#include "net/base/net_export.h"
+#include "net/cert/cert_verify_proc_nss.h"
+#include "net/cert/nss_profile_filter_chromeos.h"
+
+namespace chromeos {
+
+// Wrapper around CertVerifyProcNSS which allows filtering trust decisions on a
+// per-slot basis. Unlike the other CertVerifyProc implementations, this one is
+// publicly exported, so that the non-default constructor can be used to specify
+// the slots to use.
+//
+// Note that only the simple case is currently handled (if a slot contains a new
+// trust root, that root should not be trusted by CertVerifyProcChromeOS
+// instances using other slots). More complicated cases are not handled (like
+// two slots adding the same root cert but with different trust values).
+class NET_EXPORT CertVerifyProcChromeOS : public net::CertVerifyProcNSS {

[Ryan Sleevi, 2014/01/30 05:27:40]

Update comment, remove net_export (and related include)

[mattm, 2014/02/04 05:31:21]

Done.

+ public:
+  // Creates a CertVerifyProc that doesn't allow any user-provided trust roots.
+  CertVerifyProcChromeOS();
+
+  // Creates a CertVerifyProc that doesn't allow trust roots provided by
+  // users other than the specified slot.
+  explicit CertVerifyProcChromeOS(crypto::ScopedPK11Slot public_slot);
+
+ protected:
+  virtual ~CertVerifyProcChromeOS();
+
+ private:
+  CERTChainVerifyCallback* InitializeCERTChainVerifyCallback();

[Ryan Sleevi, 2014/01/30 05:27:40]

No longer used

[mattm, 2014/02/04 05:31:21]

Done.

+
+  virtual int VerifyInternal(
+      net::X509Certificate* cert,
+      const std::string& hostname,
+      int flags,
+      net::CRLSet* crl_set,
+      const net::CertificateList& additional_trust_anchors,
+      net::CertVerifyResult* verify_result) OVERRIDE;
+
+  static SECStatus IsChainValidFunc(void* is_chain_valid_arg,
+                                    const CERTCertList* current_chain,
+                                    PRBool* chain_ok);
+
+  net::NSSProfileFilterChromeOS profile_filter_;
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_NET_CERT_VERIFY_PROC_CHROMEOS_H_