CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/cert/test_keychain_search_list_mac.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_KEYCHAIN_SEARCH_LIST_MAC_H_
+#define NET_CERT_KEYCHAIN_SEARCH_LIST_MAC_H_
+
+#include <CoreServices/CoreServices.h>
+#include <Security/Security.h>
+
+#include "base/mac/scoped_cftyperef.h"
+#include "net/base/net_export.h"
+
+namespace net {
+
+class NET_EXPORT TestKeychainSearchList {
+ public:
+  ~TestKeychainSearchList();
+
+  // Creates a TestKeychainSearchList, which will be used by HasInstance and
+  // GetInstance.
+  // Only one TestKeychainSearchList object may exist at a time, returns nullptr
+  // if one exists already.
+  static std::unique_ptr<TestKeychainSearchList> Create();

[Ryan Sleevi, 2016/09/13 22:46:54]

I'm a little curious why the pseudo-singletonness.

That is, why expose the public dtor and the Create() method, but then expose
HasInstance()/GetInstance()?

[mattm, 2016/09/14 05:52:57]

It is a little different than TestRootCerts since there can only be one search
list, whereas even though TestRootCerts is a singleton you can add multiple
certs to it. 

I kinda like this better than the TestRootCerts way, since it returns a scoped
ptr so it makes you clean up automatically rather than needing to call Clear in
a TearDown method. 

I guess TestKeychainSearchList could actually be a Singleton, I guess it could
then have some method that would return a ScopedKeychainSearchList or something.
But that just seems like adding an extra layer without a benefit.

+
+  // Returns true if a TestKeychainSearchList currently exists.
+  static bool HasInstance();
+
+  // Returns the current TestKeychainSearchList instance, if any.
+  static TestKeychainSearchList* GetInstance();
+
+  // Copies the test keychain search list into |keychain_search_list|.
+  OSStatus CopySearchList(CFArrayRef* keychain_search_list) const;
+
+  // Adds |keychain| to the end of the test keychain search list.
+  void AddKeychain(SecKeychainRef keychain);
+
+ private:
+  TestKeychainSearchList();
+
+  base::ScopedCFTypeRef<CFMutableArrayRef> scoped_keychain_search_list;
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_KEYCHAIN_SEARCH_LIST_MAC_H_