Remove the fingerprint and ca_fingerprint from X509Certificate

chromeos/network/onc/onc_certificate_importer_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_certificate_importer_impl.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <string>
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/values.h"
 #include "chromeos/network/onc/onc_test_utils.h"
 #include "components/onc/onc_constants.h"
 #include "crypto/scoped_test_nss_db.h"
 #include "net/base/crypto_module.h"
+#include "net/base/hash_value.h"
 #include "net/cert/cert_type.h"
 #include "net/cert/nss_cert_database_chromeos.h"
 #include "net/cert/x509_certificate.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace chromeos {
 namespace onc {
 
 namespace {
 
@@ skipping 142 matching lines @@
     net::CertificateList result;
     CERTCertList* cert_list = PK11_ListCertsInSlot(slot);
     for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
          !CERT_LIST_END(node, cert_list);
          node = CERT_LIST_NEXT(node)) {
       result.push_back(net::X509Certificate::CreateFromHandle(
           node->cert, net::X509Certificate::OSCertHandles()));
     }
     CERT_DestroyCertList(cert_list);
 
-    // Sort the result so that test comparisons can be deterministic.
-    std::sort(result.begin(), result.end(), net::X509Certificate::LessThan());
+    std::sort(result.begin(), result.end(),
+              [](const scoped_refptr<net::X509Certificate>& lhs,
+                 const scoped_refptr<net::X509Certificate>& rhs) {
+                return net::SHA256HashValueLessThan()(
+                    net::X509Certificate::CalculateFingerprint256(
+                        lhs->os_cert_handle()),
+                    net::X509Certificate::CalculateFingerprint256(
+                        rhs->os_cert_handle()));
+              });

[stevenjb, 2016/06/16 16:39:23]

This seems potentially expensive since we recalculate the fingerprint with each
compare, but for a unit test I guess that's fine. It does seem like something
where an efficient helper function would be useful if we do this more than once
or twice or outside of tests.

[Ryan Sleevi, 2016/06/16 21:16:45]

Right. If it was outside unittests, memoizing the hash. I intentionally did not
want that memoization to be a generic utility, though, because we want to make
sure we're carefully considering the security implications. Something like an
unordered_map is one way (with the std::hash taking the string of the
GerDEREncoded), which is effectively the same, or the solutions like in the cert
store.

     return result;
   }
 };
 
 TEST_F(ONCCertificateImporterImplTest, MultipleCertificates) {
   AddCertificatesFromFile("managed_toplevel2.onc", true);
   EXPECT_EQ(onc_certificates_->GetSize(), public_list_.size());
   EXPECT_TRUE(private_list_.empty());
   EXPECT_EQ(2ul, public_list_.size());
 }
@@ skipping 145 matching lines @@
                   "certificate-client-update.onc"),
         CertParam(net::SERVER_CERT,
                   "certificate-server.onc",
                   "certificate-server-update.onc"),
         CertParam(net::CA_CERT,
                   "certificate-web-authority.onc",
                   "certificate-web-authority-update.onc")));
 
 }  // namespace onc
 }  // namespace chromeos