Remove obsolete NSS version checks.

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <string>
 #include <vector>
 
 #include <cert.h>
@@ skipping 15 matching lines @@
 #include "net/cert/crl_set.h"
 #include "net/cert/ev_root_ca_metadata.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util_nss.h"
 
 #if defined(OS_IOS)
 #include <CommonCrypto/CommonDigest.h>
 #include "net/cert/x509_util_ios.h"
 #endif  // defined(OS_IOS)
 
-#define NSS_VERSION_NUM (NSS_VMAJOR * 10000 + NSS_VMINOR * 100 + NSS_VPATCH)
-#if NSS_VERSION_NUM < 31305
-// Added in NSS 3.13.5.
-#define SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED -8016
-#endif
-
-#if NSS_VERSION_NUM < 31402
-// Added in NSS 3.14.2.
-#define cert_pi_useOnlyTrustAnchors static_cast<CERTValParamInType>(14)
-#endif
-
 namespace net {
 
 namespace {
 
 typedef scoped_ptr_malloc<
     CERTCertificatePolicies,
     crypto::NSSDestroyer<CERTCertificatePolicies,
                          CERT_DestroyCertificatePoliciesExtension> >
     ScopedCERTCertificatePolicies;
 
@@ skipping 680 matching lines @@
   return result;
 }
 
 }  // namespace
 
 CertVerifyProcNSS::CertVerifyProcNSS() {}
 
 CertVerifyProcNSS::~CertVerifyProcNSS() {}
 
 bool CertVerifyProcNSS::SupportsAdditionalTrustAnchors() const {
-  // This requires APIs introduced in 3.14.2.
-  return NSS_VersionCheck("3.14.2");
+  return true;

[Joao da Silva, 2014/01/17 09:04:53]

Why not remove this function altogether?

[Joao da Silva, 2014/01/17 13:22:21]

Meh, ignore this comment. Other implementations return false.

 }
 
 int CertVerifyProcNSS::VerifyInternal(
     X509Certificate* cert,
     const std::string& hostname,
     int flags,
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
 #if defined(OS_IOS)
@@ skipping 35 matching lines @@
       (flags & CertVerifier::VERIFY_EV_CERT) &&
       IsEVCandidate(metadata, cert_handle, &ev_policy_oid);
   bool cert_io_enabled = flags & CertVerifier::VERIFY_CERT_IO_ENABLED;
   bool check_revocation =
       cert_io_enabled &&
       (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED);
   if (check_revocation)
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
   ScopedCERTCertList trust_anchors;
-  if (SupportsAdditionalTrustAnchors() && !additional_trust_anchors.empty()) {
+  if (!additional_trust_anchors.empty()) {
     trust_anchors.reset(
         CertificateListToCERTCertList(additional_trust_anchors));
   }
 
   SECStatus status = PKIXVerifyCert(cert_handle, check_revocation, false,
                                     cert_io_enabled, NULL, 0,
                                     trust_anchors.get(), cvout);
 
   if (status == SECSuccess &&
       (flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) &&
@@ skipping 69 matching lines @@
     if (VerifyEV(cert_handle, flags, crl_set, check_revocation, metadata,
                  ev_policy_oid, trust_anchors.get())) {
       verify_result->cert_status |= CERT_STATUS_IS_EV;
     }
   }
 
   return OK;
 }
 
 }  // namespace net