Certificate path builder for new certificate verification library

components/cast_certificate/cast_cert_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/singleton.h"
+#include "net/cert/internal/cert_issuer_source_static.h"
 #include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/extended_key_usage.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/parse_name.h"
 #include "net/cert/internal/parsed_certificate.h"
+#include "net/cert/internal/path_builder.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/internal/signature_policy.h"
 #include "net/cert/internal/trust_store.h"
-#include "net/cert/internal/verify_certificate_chain.h"
 #include "net/cert/internal/verify_signed_data.h"
 #include "net/der/input.h"
 
 namespace cast_certificate {
 namespace {
 
 // -------------------------------------------------------------------------
 // Cast trust anchors.
 // -------------------------------------------------------------------------
 
@@ skipping 240 matching lines @@
     // No reference to the ParsedCertificate is kept past the end of this
     // function, so using EXTERNAL_REFERENCE here is safe.
     if (!net::ParsedCertificate::CreateAndAddToVector(
             reinterpret_cast<const uint8_t*>(cert_der.data()), cert_der.size(),
             net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE,
             &input_chain)) {
       return false;
     }
   }
 
+  net::CertIssuerSourceStatic intermediate_cert_issuer_source;
+  for (size_t i = 1; i < input_chain.size(); ++i)

[eroman, 2016/06/17 01:03:22]

Given how this works now, I think we should probably just retire |input_chain|
and |ref_checker| and simplify things a bit.

[mattm, 2016/06/18 04:28:55]

Done.

+    intermediate_cert_issuer_source.AddCert(input_chain[i]);
+
   // Use a signature policy compatible with Cast's PKI.
   auto signature_policy = CreateCastSignaturePolicy();
 
   // Do RFC 5280 compatible certificate verification using the two Cast
   // trust anchors and Cast signature policy.
-  if (!net::VerifyCertificateChain(input_chain, CastTrustStore::Get(),
-                                   signature_policy.get(),
-                                   ConvertExplodedTime(time))) {
+  net::CertPathBuilder::Result result;
+  net::CertPathBuilder path_builder(input_chain.front(), &CastTrustStore::Get(),

[eroman, 2016/06/17 01:03:21]

There needs to also ensure somewhere that !input_chain.empty() -- before this
was being done internal to VerifyCertificateChain().

[mattm, 2016/06/18 04:28:55]

Done.

+                                    signature_policy.get(),
+                                    ConvertExplodedTime(time), &result);
+  path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
+  net::CompletionStatus rv = path_builder.Run(base::Closure());
+  DCHECK(rv == net::CompletionStatus::SYNC);

[eroman, 2016/06/17 01:03:21]

nit: DCHECK_EQ()

[mattm, 2016/06/18 04:28:55]

Done.

+  if (result.result() != net::OK)

[eroman, 2016/06/17 01:03:22]

How about abstracting this with result.IsSuccess() or some such thing?

[mattm, 2016/06/18 04:28:55]

Done.

     return false;
-  }
 
   // Check properties of the leaf certificate (key usage, policy), and construct
   // a CertVerificationContext that uses its public key.
   return CheckTargetCertificate(input_chain[0].get(), context, policy);
 }
 
 std::unique_ptr<CertVerificationContext> CertVerificationContextImplForTest(
     const base::StringPiece& spki) {
   // Use a bogus CommonName, since this is just exposed for testing signature
   // verification by unittests.
   return base::WrapUnique(
       new CertVerificationContextImpl(net::der::Input(spki), "CommonName"));
 }
 
 bool AddTrustAnchorForTest(const uint8_t* data, size_t length) {
   scoped_refptr<net::ParsedCertificate> anchor(
       net::ParsedCertificate::CreateFromCertificateData(
           data, length,
           net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE));
   if (!anchor)
     return false;
   CastTrustStore::Get().AddTrustedCertificate(std::move(anchor));
   return true;
 }
 
 }  // namespace cast_certificate