Add CertIssuerSource interface and CertIssuerSourceStatic implementation.

net/data/cert_source_static_unittest/generate-certs.py

Index: net/data/cert_source_static_unittest/generate-certs.py
diff --git a/net/data/cert_source_static_unittest/generate-certs.py b/net/data/cert_source_static_unittest/generate-certs.py
new file mode 100755
index 0000000000000000000000000000000000000000..90cb4d8b9dc1347f8e104ba8eb60a4af7fd703d4
--- /dev/null
+++ b/net/data/cert_source_static_unittest/generate-certs.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Certificates for testing issuer lookup.
+
+             Root
+            /|  |
+           / |  |
+          /  |  |
+         v   v  v
+        B1  b1  B2
+         |\/|   |
+         |/\|   |
+         v  v   v
+         C  C'  C''
+
+B1 and b1 have the same key, and their subjects are also equal (after
+normalization).
+
+C, C', and C'' all have the same subject but different keys (doesn't matter for
+this test).
+
+C and C' should chain up through both B1 and b1, since they have the same key
+and the names are equal after normalization.
+"""
+
+import os
+import sys
+sys.path += [os.path.join('..', 'verify_certificate_chain_unittest')]
+
+import common
+
+
+def write_cert_to_file(cert, filename):
+  common.write_string_to_file(__doc__ + "\n" + cert.get_cert_pem(), filename)
+
+
+# Self-signed root certificate
+root = common.create_self_signed_root_certificate('Root')
+write_cert_to_file(root, 'root.pem')
+
+
+# Intermediary certificates
+B1_1 = common.create_intermediary_certificate('B1', root)
+write_cert_to_file(B1_1, 'b1_1.pem')

[eroman, 2016/06/01 20:52:10]

I didn't find the names easy to follow between the CN/diagram, and the
filenames.

Can you use names that have a direct mapping between the diagram and file name?
(Esp B1 vs b1 where capitalization is the only difference).

Before seeing the generator script I was also confused when reading the .pem
files. A more helpful comment might be to just redirect readers in the .pem file
to the generator script, and have the description of how they interact in here.

Or alternately put all the certificates into a single PEM file, with the current
comment block at the top (but it now refers to local objects of that file).

[mattm, 2016/06/01 22:20:41]

Done.
Done.
Putting them all in a single PEM file makes it a bit more annoying in the test
code to figure out which cert is which.

+
+# same name (after normalization), different key
+B1_2 = common.create_intermediary_certificate('b1', root)
+write_cert_to_file(B1_2, 'b1_2.pem')
+
+# different name
+B2_1 = common.create_intermediary_certificate('B2', root)
+write_cert_to_file(B2_1, 'b2_1.pem')
+
+
+# target certs
+
+c1_1 = common.create_end_entity_certificate('C', B1_1)
+write_cert_to_file(c1_1, 'c1_1.pem')
+
+c1_2 = common.create_end_entity_certificate('C', B1_2)
+write_cert_to_file(c1_2, 'c1_2.pem')
+
+c2_1 = common.create_end_entity_certificate('C', B2_1)
+write_cert_to_file(c2_1, 'c2_1.pem')
+
+