Certificate path builder for new certificate verification library

net/cert/internal/verify_certificate_chain.cc

Index: net/cert/internal/verify_certificate_chain.cc
diff --git a/net/cert/internal/verify_certificate_chain.cc b/net/cert/internal/verify_certificate_chain.cc
index 506fb434befec20aca8d118e49021cf624313e87..9aa1db6a6f1b9c573b4702b212090544a5c6fb06 100644
--- a/net/cert/internal/verify_certificate_chain.cc
+++ b/net/cert/internal/verify_certificate_chain.cc
@@ -7,7 +7,6 @@
 #include <memory>
 
 #include "base/logging.h"
-#include "net/cert/internal/name_constraints.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/internal/signature_policy.h"
@@ -20,14 +19,13 @@ namespace net {
 
 namespace {
 
-// Map from OID to ParsedExtension.
-using ExtensionsMap = std::map<der::Input, ParsedExtension>;
-
 // Describes all parsed properties of a certificate that are relevant for
 // certificate verification.
 struct FullyParsedCert {
-  ParsedCertificate cert;
-  ParsedTbsCertificate tbs;
+  // XXX better naming.. this results in lots of non-obvious cert.cert->foo code
+  scoped_refptr<CertThing> cert;
+
+  // XXX should some of this be moved into CertThing?
 
   std::unique_ptr<SignatureAlgorithm> signature_algorithm;
 
@@ -38,21 +36,20 @@ struct FullyParsedCert {
   bool has_key_usage = false;
   der::BitString key_usage;
 
-  std::unique_ptr<GeneralNames> subject_alt_names;
-
   bool has_name_constraints = false;
   ParsedExtension name_constraints_extension;
 
   // The remaining extensions (excludes the standard ones above).
-  ExtensionsMap unconsumed_extensions;
+  CertThing::ExtensionsMap unconsumed_extensions;
 };
 
 // Removes the extension with OID |oid| from |unconsumed_extensions| and fills
 // |extension| with the matching extension value. If there was no extension
 // matching |oid| then returns |false|.
-WARN_UNUSED_RESULT bool ConsumeExtension(const der::Input& oid,
-                                         ExtensionsMap* unconsumed_extensions,
-                                         ParsedExtension* extension) {
+WARN_UNUSED_RESULT bool ConsumeExtension(
+    const der::Input& oid,
+    CertThing::ExtensionsMap* unconsumed_extensions,
+    ParsedExtension* extension) {
   auto it = unconsumed_extensions->find(oid);
   if (it == unconsumed_extensions->end())
     return false;
@@ -79,43 +76,34 @@ WARN_UNUSED_RESULT bool GetSequenceValue(const der::Input& tlv,
   return parser.ReadTag(der::kSequence, value) && !parser.HasMore();
 }
 
+// XXX update doc
 // Parses an X.509 Certificate fully (including the TBSCertificate and
 // standard extensions), saving all the properties to |out_|.
-WARN_UNUSED_RESULT bool FullyParseCertificate(const der::Input& cert_tlv,
+WARN_UNUSED_RESULT bool FullyParseCertificate(scoped_refptr<CertThing> cert,
                                               FullyParsedCert* out) {
-  // Parse the outer Certificate.
-  if (!ParseCertificate(cert_tlv, &out->cert))
-    return false;
+  // XXX move more of this into CertThing?
+
+  out->cert = std::move(cert);
 
   // Parse the signature algorithm contained in the Certificate (there is
   // another one in the TBSCertificate, which is checked later by
   // VerifySignatureAlgorithmsMatch)
-  out->signature_algorithm =
-      SignatureAlgorithm::CreateFromDer(out->cert.signature_algorithm_tlv);
+  out->signature_algorithm = SignatureAlgorithm::CreateFromDer(
+      out->cert->parsed_cert().signature_algorithm_tlv);
   if (!out->signature_algorithm)
     return false;
 
-  // Parse the TBSCertificate.
-  if (!ParseTbsCertificate(out->cert.tbs_certificate_tlv, &out->tbs))
-    return false;
-
   // Reset state relating to extensions (which may not get overwritten). This is
   // just a precaution, since in practice |out| will already be default
   // initialize.
   out->has_basic_constraints = false;
   out->has_key_usage = false;
-  out->unconsumed_extensions.clear();
-  out->subject_alt_names.reset();
   out->has_name_constraints = false;
 
+  out->unconsumed_extensions = out->cert->unconsumed_extensions();
   // Parse the standard X.509 extensions and remove them from
   // |unconsumed_extensions|.
-  if (out->tbs.has_extensions) {
-    // ParseExtensions() ensures there are no duplicates, and maps the (unique)
-    // OID to the extension value.
-    if (!ParseExtensions(out->tbs.extensions_tlv, &out->unconsumed_extensions))
-      return false;
-
+  if (!out->unconsumed_extensions.empty()) {
     ParsedExtension extension;
 
     // Basic constraints.
@@ -134,28 +122,6 @@ WARN_UNUSED_RESULT bool FullyParseCertificate(const der::Input& cert_tlv,
         return false;
     }
 
-    // Subject alternative name.
-    if (ConsumeExtension(SubjectAltNameOid(), &out->unconsumed_extensions,
-                         &extension)) {
-      // RFC 5280 section 4.2.1.6:
-      // SubjectAltName ::= GeneralNames
-      out->subject_alt_names = GeneralNames::CreateFromDer(extension.value);
-      if (!out->subject_alt_names)
-        return false;
-      // RFC 5280 section 4.1.2.6:
-      // If subject naming information is present only in the subjectAltName
-      // extension (e.g., a key bound only to an email address or URI), then the
-      // subject name MUST be an empty sequence and the subjectAltName extension
-      // MUST be critical.
-      if (!extension.critical) {
-        der::Input subject_value;
-        if (!GetSequenceValue(out->tbs.subject_tlv, &subject_value))
-          return false;
-        if (subject_value.Length() == 0)
-          return false;
-      }
-    }
-
     // Name constraints.
     if (ConsumeExtension(NameConstraintsOid(), &out->unconsumed_extensions,
                          &out->name_constraints_extension)) {
@@ -166,23 +132,6 @@ WARN_UNUSED_RESULT bool FullyParseCertificate(const der::Input& cert_tlv,
   return true;
 }
 
-// Returns true if |name1_tlv| matches |name2_tlv|. The two inputs must be
-// tag-length-value for RFC 5280's Name.
-WARN_UNUSED_RESULT bool NameMatches(const der::Input& name1_tlv,
-                                    const der::Input& name2_tlv) {
-  der::Input name1_value;
-  der::Input name2_value;
-
-  // Assume that the Name is an RDNSequence. VerifyNameMatch() expects the
-  // value from a SEQUENCE, so strip off the tag.
-  if (!GetSequenceValue(name1_tlv, &name1_value) ||
-      !GetSequenceValue(name2_tlv, &name2_value)) {
-    return false;
-  }
-
-  return VerifyNameMatch(name1_value, name2_value);
-}
-
 // Returns true if |cert| was self-issued. The definition of self-issuance
 // comes from RFC 5280 section 6.1:
 //
@@ -195,7 +144,7 @@ WARN_UNUSED_RESULT bool NameMatches(const der::Input& name1_tlv,
 //    self-issued certificates are not counted when evaluating path length
 //    or name constraints.
 WARN_UNUSED_RESULT bool IsSelfIssued(const FullyParsedCert& cert) {
-  return NameMatches(cert.tbs.subject_tlv, cert.tbs.issuer_tlv);
+  return cert.cert->normalized_subject() == cert.cert->normalized_issuer();
 }
 
 // Returns true if |cert| is valid at time |time|.
@@ -207,8 +156,8 @@ WARN_UNUSED_RESULT bool IsSelfIssued(const FullyParsedCert& cert) {
 //    notBefore through notAfter, inclusive.
 WARN_UNUSED_RESULT bool VerifyTimeValidity(const FullyParsedCert& cert,
                                            const der::GeneralizedTime time) {
-  return !(time < cert.tbs.validity_not_before) &&
-         !(cert.tbs.validity_not_after < time);
+  return !(time < cert.cert->parsed_tbs().validity_not_before) &&
+         !(cert.cert->parsed_tbs().validity_not_after < time);
 }
 
 // Returns true if |signature_algorithm_tlv| is a valid algorithm encoding for
@@ -244,8 +193,8 @@ WARN_UNUSED_RESULT bool IsRsaWithSha1SignatureAlgorithm(
 // compatibility sake.
 WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch(
     const FullyParsedCert& cert) {
-  const der::Input& alg1_tlv = cert.cert.signature_algorithm_tlv;
-  const der::Input& alg2_tlv = cert.tbs.signature_algorithm_tlv;
+  const der::Input& alg1_tlv = cert.cert->parsed_cert().signature_algorithm_tlv;
+  const der::Input& alg2_tlv = cert.cert->parsed_tbs().signature_algorithm_tlv;
 
   // Ensure that the two DER-encoded signature algorithms are byte-for-byte
   // equal, but make a compatibility concession for RSA with SHA1.
@@ -258,7 +207,7 @@ WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch(
 //
 // |skip_issuer_checks| controls whether the function will skip:
 //   - Checking that |cert|'s signature using |working_spki|
-//   - Checkinging that |cert|'s issuer matches |working_issuer_name|
+//   - Checkinging that |cert|'s issuer matches |working_normalized_issuer_name|
 // This should be set to true only when verifying a trusted root certificate.
 WARN_UNUSED_RESULT bool BasicCertificateProcessing(
     const FullyParsedCert& cert,
@@ -267,7 +216,7 @@ WARN_UNUSED_RESULT bool BasicCertificateProcessing(
     const SignaturePolicy* signature_policy,
     const der::GeneralizedTime& time,
     const der::Input& working_spki,
-    const der::Input& working_issuer_name,
+    const der::Input& working_normalized_issuer_name,
     const std::vector<std::unique_ptr<NameConstraints>>&
         name_constraints_list) {
   // Check that the signature algorithms in Certificate vs TBSCertificate
@@ -279,9 +228,10 @@ WARN_UNUSED_RESULT bool BasicCertificateProcessing(
   // Verify the digital signature using the previous certificate's key (RFC
   // 5280 section 6.1.3 step a.1).
   if (!skip_issuer_checks) {
-    if (!VerifySignedData(
-            *cert.signature_algorithm, cert.cert.tbs_certificate_tlv,
-            cert.cert.signature_value, working_spki, signature_policy)) {
+    if (!VerifySignedData(*cert.signature_algorithm,
+                          cert.cert->parsed_cert().tbs_certificate_tlv,
+                          cert.cert->parsed_cert().signature_value,
+                          working_spki, signature_policy)) {
       return false;
     }
   }
@@ -297,7 +247,8 @@ WARN_UNUSED_RESULT bool BasicCertificateProcessing(
   // Verify the certificate's issuer name matches the issuing certificate's
   // subject name. (RFC 5280 section 6.1.3 step a.4)
   if (!skip_issuer_checks) {
-    if (!NameMatches(cert.tbs.issuer_tlv, working_issuer_name))
+    if (der::Input(&cert.cert->normalized_issuer()) !=
+        working_normalized_issuer_name)
       return false;
   }
 
@@ -306,11 +257,12 @@ WARN_UNUSED_RESULT bool BasicCertificateProcessing(
   // path, skip this step for certificate i.
   if (!name_constraints_list.empty() &&
       (!IsSelfIssued(cert) || is_target_cert)) {
+    // XXX used normalized_subject here
     der::Input subject_value;
-    if (!GetSequenceValue(cert.tbs.subject_tlv, &subject_value))
+    if (!GetSequenceValue(cert.cert->parsed_tbs().subject_tlv, &subject_value))
       return false;
     for (const auto& nc : name_constraints_list) {
-      if (!nc->IsPermittedCert(subject_value, cert.subject_alt_names.get()))
+      if (!nc->IsPermittedCert(subject_value, cert.cert->subject_alt_names()))
         return false;
     }
   }
@@ -327,20 +279,21 @@ WARN_UNUSED_RESULT bool PrepareForNextCertificate(
     const FullyParsedCert& cert,
     size_t* max_path_length_ptr,
     der::Input* working_spki,
-    der::Input* working_issuer_name,
+    der::Input* working_normalized_issuer_name,
     std::vector<std::unique_ptr<NameConstraints>>* name_constraints_list) {
   // TODO(eroman): Steps a-b are omitted, as policy constraints are not yet
   // implemented.
 
   // From RFC 5280 section 6.1.4 step c:
   //
-  //    Assign the certificate subject name to working_issuer_name.
-  *working_issuer_name = cert.tbs.subject_tlv;
+  //    Assign the certificate subject name to working_normalized_issuer_name.
+  *working_normalized_issuer_name =
+      der::Input(&cert.cert->normalized_subject());
 
   // From RFC 5280 section 6.1.4 step d:
   //
   //    Assign the certificate subjectPublicKey to working_public_key.
-  *working_spki = cert.tbs.spki_tlv;
+  *working_spki = cert.cert->parsed_tbs().spki_tlv;
 
   // Note that steps e and f are omitted as they are handled by
   // the assignment to |working_spki| above. See the definition
@@ -494,14 +447,14 @@ WARN_UNUSED_RESULT bool WrapUp(const FullyParsedCert& cert) {
 
 }  // namespace
 
-TrustAnchor::TrustAnchor() {}
-TrustAnchor::~TrustAnchor() {}
+CertThing::CertThing() {}
+CertThing::~CertThing() {}
 
-std::unique_ptr<TrustAnchor> TrustAnchor::CreateFromCertificateData(
+scoped_refptr<CertThing> CertThing::CreateFromCertificateData(
     const uint8_t* data,
     size_t length,
     DataSource source) {
-  std::unique_ptr<TrustAnchor> result(new TrustAnchor);
+  scoped_refptr<CertThing> result(new CertThing);
 
   switch (source) {
     case DataSource::INTERNAL_COPY:
@@ -515,25 +468,64 @@ std::unique_ptr<TrustAnchor> TrustAnchor::CreateFromCertificateData(
   }
 
   // Parse the certificate to get its name.
-  ParsedCertificate cert;
-  if (!ParseCertificate(result->cert(), &cert))
+  if (!ParseCertificate(result->cert_, &result->parsed_cert_))
     return nullptr;
 
-  ParsedTbsCertificate tbs;
-  if (!ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs))
+  if (!ParseTbsCertificate(result->parsed_cert_.tbs_certificate_tlv,
+                           &result->parsed_tbs_))
     return nullptr;
 
-  result->name_ = tbs.subject_tlv;
+  der::Input subject_value;
+  if (!GetSequenceValue(result->parsed_tbs_.subject_tlv, &subject_value) ||
+      !NormalizeName(subject_value, &result->normalized_subject_))
+    return nullptr;
+  der::Input issuer_value;
+  if (!GetSequenceValue(result->parsed_tbs_.issuer_tlv, &issuer_value) ||
+      !NormalizeName(issuer_value, &result->normalized_issuer_))
+    return nullptr;
 
-  // TODO(eroman): If adding a self-signed certificate, check that its
-  // signature is correct? This check will not otherwise be done during
-  // verification.
+  // Parse the standard X.509 extensions and remove them from
+  // |unconsumed_extensions|.
+  if (result->parsed_tbs_.has_extensions) {
+    // ParseExtensions() ensures there are no duplicates, and maps the (unique)
+    // OID to the extension value.
+    if (!ParseExtensions(result->parsed_tbs_.extensions_tlv,
+                         &result->unconsumed_extensions_))
+      return nullptr;
+
+    // Subject alternative name.
+    if (ConsumeExtension(SubjectAltNameOid(), &result->unconsumed_extensions_,
+                         &result->subject_alt_names_extension_)) {
+      // RFC 5280 section 4.2.1.6:
+      // SubjectAltName ::= GeneralNames
+      result->subject_alt_names_ = GeneralNames::CreateFromDer(
+          result->subject_alt_names_extension_.value);
+      if (!result->subject_alt_names_)
+        return nullptr;
+      // RFC 5280 section 4.1.2.6:
+      // If subject naming information is present only in the subjectAltName
+      // extension (e.g., a key bound only to an email address or URI), then the
+      // subject name MUST be an empty sequence and the subjectAltName extension
+      // MUST be critical.
+      if (!result->subject_alt_names_extension_.critical) {
+        der::Input subject_value;
+        // XXX can we use normalized_subject_ here?
+        if (!GetSequenceValue(result->parsed_tbs().subject_tlv, &subject_value))
+          return nullptr;
+        if (subject_value.Length() == 0)
+          return nullptr;
+      }
+    }
+  }
 
   return result;
 }
 
-bool TrustAnchor::MatchesName(const der::Input& name) const {
-  return NameMatches(name, name_);
+scoped_refptr<CertThing> CertThing::CreateFromCertificateCopy(
+    const base::StringPiece& data) {
+  return CertThing::CreateFromCertificateData(
+      reinterpret_cast<const uint8_t*>(data.data()), data.size(),
+      DataSource::INTERNAL_COPY);
 }
 
 TrustStore::TrustStore() {}
@@ -543,53 +535,29 @@ void TrustStore::Clear() {
   anchors_.clear();
 }
 
-bool TrustStore::AddTrustedCertificate(const uint8_t* data, size_t length) {
-  return AddTrustedCertificate(data, length,
-                               TrustAnchor::DataSource::INTERNAL_COPY);
+void TrustStore::AddTrustedCertificate(scoped_refptr<CertThing> anchor) {
+  // XXX should this check for duplicate certs?
+  anchors_.insert(
+      std::make_pair(anchor->normalized_subject(), std::move(anchor)));
 }
 
-bool TrustStore::AddTrustedCertificate(const base::StringPiece& data) {
-  return AddTrustedCertificate(reinterpret_cast<const uint8_t*>(data.data()),
-                               data.size());
+void TrustStore::FindTrustAnchorsByNormalizedName(
+    const std::string& normalized_name,
+    CertVector* matches) const {
+  auto range = anchors_.equal_range(normalized_name);
+  for (auto it = range.first; it != range.second; ++it)
+    matches->push_back(it->second);
 }
 
-bool TrustStore::AddTrustedCertificateWithoutCopying(const uint8_t* data,
-                                                     size_t length) {
-  return AddTrustedCertificate(data, length,
-                               TrustAnchor::DataSource::EXTERNAL_REFERENCE);
-}
-
-const TrustAnchor* TrustStore::FindTrustAnchorByName(
-    const der::Input& name) const {
-  for (const auto& anchor : anchors_) {
-    if (anchor->MatchesName(name)) {
-      return anchor.get();
-    }
-  }
-  return nullptr;
-}
-
-bool TrustStore::IsTrustedCertificate(const der::Input& cert_der) const {
-  for (const auto& anchor : anchors_) {
-    if (anchor->cert() == cert_der)
+bool TrustStore::IsTrustedCertificate(const CertThing* cert) const {
+  auto range = anchors_.equal_range(cert->normalized_subject());
+  for (auto it = range.first; it != range.second; ++it) {
+    if (it->second == cert || it->second->der_cert() == cert->der_cert())
       return true;
   }
   return false;
 }
 
-bool TrustStore::AddTrustedCertificate(const uint8_t* data,
-                                       size_t length,
-                                       TrustAnchor::DataSource source) {
-  auto anchor = TrustAnchor::CreateFromCertificateData(data, length, source);
-  if (!anchor)
-    return false;
-  anchors_.push_back(std::move(anchor));
-  return true;
-}
-
-// TODO(eroman): Move this into existing anonymous namespace.
-namespace {
-
 // This implementation is structured to mimic the description of certificate
 // path verification given by RFC 5280 section 6.1.
 //
@@ -597,19 +565,19 @@ namespace {
 // the chain. This root certificate is assumed to be trusted, and neither its
 // signature nor issuer name are verified. (It needn't be self-signed).
 bool VerifyCertificateChainAssumingTrustedRoot(
-    const std::vector<der::Input>& certs_der,
+    const std::vector<scoped_refptr<CertThing>>& certs,
     // The trust store is only used for assertions.
     const TrustStore& trust_store,
     const SignaturePolicy* signature_policy,
     const der::GeneralizedTime& time) {
   // An empty chain is necessarily invalid.
-  if (certs_der.empty())
+  if (certs.empty())
     return false;
 
   // IMPORTANT: the assumption being made is that the root certificate in
   // the given path is the trust anchor (and has already been verified as
   // such).
-  DCHECK(trust_store.IsTrustedCertificate(certs_der.back()));
+  DCHECK(trust_store.IsTrustedCertificate(certs.back().get()));
 
   // Will contain a NameConstraints for each previous cert in the chain which
   // had nameConstraints. This corresponds to the permitted_subtrees and
@@ -632,12 +600,12 @@ bool VerifyCertificateChainAssumingTrustedRoot(
   //    signature of a certificate.
   der::Input working_spki;
 
-  // |working_issuer_name| corresponds with the same named variable in RFC 5280
-  // section 6.1.2:
+  // |working_normalized_issuer_name| is the normalized value of the
+  // working_issuer_name variable in RFC 5280 section 6.1.2:
   //
   //    working_issuer_name:  the issuer distinguished name expected
   //    in the next certificate in the chain.
-  der::Input working_issuer_name;
+  der::Input working_normalized_issuer_name;
 
   // |max_path_length| corresponds with the same named variable in RFC 5280
   // section 6.1.2:
@@ -647,7 +615,7 @@ bool VerifyCertificateChainAssumingTrustedRoot(
   //    and may be reduced to the value in the path length constraint
   //    field within the basic constraints extension of a CA
   //    certificate.
-  size_t max_path_length = certs_der.size();
+  size_t max_path_length = certs.size();
 
   // Iterate over all the certificates in the reverse direction: starting from
   // the trust anchor and progressing towards the target certificate.
@@ -656,13 +624,13 @@ bool VerifyCertificateChainAssumingTrustedRoot(
   //
   //   * i=0    :  Trust anchor.
   //   * i=N-1  :  Target certificate.
-  for (size_t i = 0; i < certs_der.size(); ++i) {
-    const size_t index_into_certs_der = certs_der.size() - i - 1;
+  for (size_t i = 0; i < certs.size(); ++i) {
+    const size_t index_into_certs = certs.size() - i - 1;
 
     // |is_target_cert| is true if the current certificate is the target
     // certificate being verified. The target certificate isn't necessarily an
     // end-entity certificate.
-    const bool is_target_cert = index_into_certs_der == 0;
+    const bool is_target_cert = index_into_certs == 0;
 
     // |is_trust_anchor| is true if the current certificate is the trust
     // anchor. This certificate is implicitly trusted.
@@ -670,8 +638,7 @@ bool VerifyCertificateChainAssumingTrustedRoot(
 
     // Parse the current certificate into |cert|.
     FullyParsedCert cert;
-    const der::Input& cert_der = certs_der[index_into_certs_der];
-    if (!FullyParseCertificate(cert_der, &cert))
+    if (!FullyParseCertificate(certs[index_into_certs], &cert))
       return false;
 
     // Per RFC 5280 section 6.1:
@@ -679,14 +646,15 @@ bool VerifyCertificateChainAssumingTrustedRoot(
     //  * If it is the last certificate in the path (target certificate)
     //     - Then run "Wrap up"
     //     - Otherwise run "Prepare for Next cert"
-    if (!BasicCertificateProcessing(
-            cert, is_target_cert, is_trust_anchor, signature_policy, time,
-            working_spki, working_issuer_name, name_constraints_list)) {
+    if (!BasicCertificateProcessing(cert, is_target_cert, is_trust_anchor,
+                                    signature_policy, time, working_spki,
+                                    working_normalized_issuer_name,
+                                    name_constraints_list)) {
       return false;
     }
     if (!is_target_cert) {
       if (!PrepareForNextCertificate(cert, &max_path_length, &working_spki,
-                                     &working_issuer_name,
+                                     &working_normalized_issuer_name,
                                      &name_constraints_list)) {
         return false;
       }
@@ -704,60 +672,56 @@ bool VerifyCertificateChainAssumingTrustedRoot(
   return true;
 }
 
-// TODO(eroman): This function is a temporary hack in the absence of full
-// path building. It may insert 1 certificate at the root of the
-// chain to ensure that the path's root certificate is a trust anchor.
-//
-// Beyond this no other verification is done on the chain. The caller is
-// responsible for verifying the subsequent chain's correctness.
-WARN_UNUSED_RESULT bool BuildSimplePathToTrustAnchor(
-    const std::vector<der::Input>& certs_der,
-    const TrustStore& trust_store,
-    std::vector<der::Input>* certs_der_trusted_root) {
-  // Copy the input chain.
-  *certs_der_trusted_root = certs_der;
-
-  if (certs_der.empty())
-    return false;
+}  // namespace net
 
-  // Check if the current root certificate is trusted. If it is then no
-  // extra work is needed.
-  if (trust_store.IsTrustedCertificate(certs_der_trusted_root->back()))
-    return true;
-
-  // Otherwise if it is not trusted, check whether its issuer is trusted. If
-  // so, make *that* trusted certificate the root. If the issuer is not in
-  // the trust store then give up and fail (this is not full path building).
-  ParsedCertificate cert;
-  ParsedTbsCertificate tbs;
-  if (!ParseCertificate(certs_der.back(), &cert) ||
-      !ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs)) {
-    return false;
-  }
+// XXX this is ick that verify_certificate_chain.cc uses path_builder.h
+// and path_builder.cc uses verify_certificate_chain.h. Reorganize some things
+// or remove this entirely.
+#include "base/memory/ptr_util.h"
+#include "path_builder.h"
 
-  auto trust_anchor = trust_store.FindTrustAnchorByName(tbs.issuer_tlv);
-  if (!trust_anchor)
-    return false;
-  certs_der_trusted_root->push_back(trust_anchor->cert());
-  return true;
-}
-
-}  // namespace
+namespace net {
 
 bool VerifyCertificateChain(const std::vector<der::Input>& certs_der,
                             const TrustStore& trust_store,
                             const SignaturePolicy* signature_policy,
                             const der::GeneralizedTime& time) {
-  // Modify the certificate chain so that its root is a trusted certificate.
-  std::vector<der::Input> certs_der_trusted_root;
-  if (!BuildSimplePathToTrustAnchor(certs_der, trust_store,
-                                    &certs_der_trusted_root)) {
+  if (certs_der.empty())
     return false;
+
+  scoped_refptr<CertThing> target_cert(CertThing::CreateFromCertificateData(
+      certs_der.front().UnsafeData(), certs_der.front().Length(),
+      CertThing::DataSource::EXTERNAL_REFERENCE));
+  if (!target_cert)
+    return false;
+
+  CertPathBuilder::CertSources cert_sources;
+  std::unique_ptr<StaticCertSource> intermediate_cert_source;
+  std::vector<scoped_refptr<CertThing>> intermediates;
+  for (size_t i = 1; i < certs_der.size(); ++i) {
+    const auto& cert_der = certs_der[i];
+    scoped_refptr<CertThing> cert(CertThing::CreateFromCertificateData(
+        cert_der.UnsafeData(), cert_der.Length(),
+        CertThing::DataSource::EXTERNAL_REFERENCE));
+    if (!cert)
+      return false;
+    intermediates.push_back(std::move(cert));
+  }
+  if (!intermediates.empty()) {
+    intermediate_cert_source =
+        base::WrapUnique(new StaticCertSource(intermediates));
+    cert_sources.push_back(intermediate_cert_source.get());
   }
 
   // Verify the chain.
-  return VerifyCertificateChainAssumingTrustedRoot(
-      certs_der_trusted_root, trust_store, signature_policy, time);
+  CertPathBuilder::Result result;
+  CertPathBuilder path_builder(target_cert, cert_sources, trust_store,
+                               signature_policy, time, &result);
+  int rv = path_builder.Run(CompletionCallback());
+  // Assume that CertPathBuilder will complete synchronously since only a
+  // StaticCertSource was passed in. If it did return ERR_IO_PENDING, just
+  // return failure here.
+  return rv == OK;
 }
 
 }  // namespace net