WIP: NSS trust store integration for path builder.

components/cast_certificate/cast_cert_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/singleton.h"
 #include "net/cert/internal/cert_issuer_source_static.h"
 #include "components/cast_certificate/cast_crl.h"
 #include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/extended_key_usage.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/parse_name.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/path_builder.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/internal/signature_policy.h"
-#include "net/cert/internal/trust_store.h"
+#include "net/cert/internal/trust_store_static.h"
 #include "net/cert/internal/verify_signed_data.h"
 #include "net/der/encode_values.h"
 #include "net/der/input.h"
 
 namespace cast_certificate {
 namespace {
 
 // -------------------------------------------------------------------------
 // Cast trust anchors.
 // -------------------------------------------------------------------------
 
 // There are two trusted roots for Cast certificate chains:
 //
 //   (1) CN=Cast Root CA    (kCastRootCaDer)
 //   (2) CN=Eureka Root CA  (kEurekaRootCaDer)
 //
 // These constants are defined by the files included next:
 
 #include "components/cast_certificate/cast_root_ca_cert_der-inc.h"
 #include "components/cast_certificate/eureka_root_ca_der-inc.h"
 
 // Singleton for the Cast trust store.
 class CastTrustStore {
  public:
   static CastTrustStore* GetInstance() {
     return base::Singleton<CastTrustStore,
                            base::LeakySingletonTraits<CastTrustStore>>::get();
   }
 
-  static net::TrustStore& Get() { return GetInstance()->store_; }
+  static net::TrustStoreStatic& Get() { return GetInstance()->trust_store_; }
 
  private:
   friend struct base::DefaultSingletonTraits<CastTrustStore>;
 
   CastTrustStore() {
     AddAnchor(kCastRootCaDer);
     AddAnchor(kEurekaRootCaDer);
   }
 
   // Adds a trust anchor given a DER-encoded certificate from static
   // storage.
   template <size_t N>
   void AddAnchor(const uint8_t (&data)[N]) {
     scoped_refptr<net::ParsedCertificate> root =
         net::ParsedCertificate::CreateFromCertificateData(
             data, N, net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE,
             {});
     CHECK(root);
-    store_.AddTrustedCertificate(std::move(root));
+    trust_store_.AddTrustedCertificate(std::move(root));
   }
 
-  net::TrustStore store_;
+  net::TrustStoreStatic trust_store_;
   DISALLOW_COPY_AND_ASSIGN(CastTrustStore);
 };
 
 using ExtensionsMap = std::map<net::der::Input, net::ParsedExtension>;
 
 // Helper that looks up an extension by OID given a map of extensions.
 bool GetExtensionValue(const ExtensionsMap& extensions,
                        const net::der::Input& oid,
                        net::der::Input* value) {
   auto it = extensions.find(oid);
@@ skipping 194 matching lines @@
 
   // Use a signature policy compatible with Cast's PKI.
   auto signature_policy = CreateCastSignaturePolicy();
 
   // Do path building and RFC 5280 compatible certificate verification using the
   // two Cast trust anchors and Cast signature policy.
   net::der::GeneralizedTime verification_time;
   if (!net::der::EncodeTimeAsGeneralizedTime(time, &verification_time))
     return false;
   net::CertPathBuilder::Result result;
-  net::CertPathBuilder path_builder(target_cert.get(), &CastTrustStore::Get(),
-                                    signature_policy.get(), verification_time,
-                                    &result);
+  net::CertPathBuilder path_builder(target_cert.get(), signature_policy.get(),
+                                    verification_time, &result);
+  path_builder.AddTrustStore(&CastTrustStore::Get());
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
   net::CompletionStatus rv = path_builder.Run(base::Closure());
   DCHECK_EQ(rv, net::CompletionStatus::SYNC);
   if (!result.is_success())
     return false;
 
   // Check properties of the leaf certificate (key usage, policy), and construct
   // a CertVerificationContext that uses its public key.
   if (!CheckTargetCertificate(target_cert.get(), context, policy))
     return false;
@@ skipping 29 matching lines @@
       net::ParsedCertificate::CreateFromCertificateCopy(
           cert, GetCertParsingOptions()));
   if (!anchor)
     return false;
   CastTrustStore::Get().Clear();
   CastTrustStore::Get().AddTrustedCertificate(std::move(anchor));
   return true;
 }
 
 }  // namespace cast_certificate