Add new ParsedCertificate class, move TrustStore to own file.

net/cert/internal/trust_store.cc

Index: net/cert/internal/trust_store.cc
diff --git a/net/cert/internal/trust_store.cc b/net/cert/internal/trust_store.cc
new file mode 100644
index 0000000000000000000000000000000000000000..892698ba5f6928fd3a64929a739c630bf64dac25
--- /dev/null
+++ b/net/cert/internal/trust_store.cc
@@ -0,0 +1,44 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/internal/trust_store.h"
+
+#include "net/cert/internal/parsed_certificate.h"
+
+namespace net {
+
+TrustStore::TrustStore() {}
+TrustStore::~TrustStore() {}
+
+void TrustStore::Clear() {
+  anchors_.clear();
+}
+
+void TrustStore::AddTrustedCertificate(
+    scoped_refptr<ParsedCertificate> anchor) {
+  // TODO(mattm): should this check for duplicate certs?
+  anchors_.insert(std::make_pair(anchor->normalized_subject().AsStringPiece(),
+                                 std::move(anchor)));
+}
+
+void TrustStore::FindTrustAnchorsByNormalizedName(
+    const der::Input& normalized_name,
+    std::vector<scoped_refptr<ParsedCertificate>>* matches) const {
+  auto range = anchors_.equal_range(normalized_name.AsStringPiece());
+  for (auto it = range.first; it != range.second; ++it)

[eroman, 2016/05/31 18:28:57]

Does this work?

matches->insert(matches->end(), range.first, range.second);

[mattm, 2016/05/31 19:48:10]

That tries to insert a std::pair<StringPiece, scoped_refptr<ParsedCertificate>>
into matches.. probably could be done with some <functional> magic, but doubt it
would be clearer that the for loop.

+    matches->push_back(it->second);
+}
+
+bool TrustStore::IsTrustedCertificate(const ParsedCertificate* cert) const {
+  auto range = anchors_.equal_range(cert->normalized_subject().AsStringPiece());
+  for (auto it = range.first; it != range.second; ++it) {
+    // First compare the ParsedCertificate pointers as an optimization, fall
+    // back to comparing full DER encoding.
+    if (it->second == cert || it->second->der_cert() == cert->der_cert())
+      return true;
+  }
+  return false;
+}
+
+}  // namespace net