WIP: NSS trust store integration for path builder.

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cert/internal/cert_issuer_source_aia.h"
 #include "net/cert/internal/cert_issuer_source_static.h"
 #include "net/cert/internal/parse_name.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/path_builder.h"
 #include "net/cert/internal/signature_policy.h"
-#include "net/cert/internal/trust_store.h"
+#include "net/cert/internal/trust_store_static.h"
 #include "net/cert_net/cert_net_fetcher_impl.h"
 #include "net/tools/cert_verify_tool/cert_verify_tool_util.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 
+// XXX should it be defined(OS_LINUX) || defined(OS_CHROMEOS) ?
+#if defined(USE_NSS_CERTS)
+#include "base/threading/thread_task_runner_handle.h"
+#include "net/cert/internal/trust_store_nss.h"
+#endif
+
 #if defined(OS_LINUX)
 #include "net/proxy/proxy_config.h"
 #include "net/proxy/proxy_config_service_fixed.h"
 #endif
 
 namespace {
 
 std::string GetUserAgent() {
   return "cert_verify_tool/0.1";
 }
@@ skipping 49 matching lines @@
 
 }  // namespace
 
 // Verifies |target_der_cert| using CertPathBuilder.
 bool VerifyUsingPathBuilder(
     const CertInput& target_der_cert,
     const std::vector<CertInput>& intermediate_der_certs,
     const std::vector<CertInput>& root_der_certs,
     const base::Time at_time,
     const base::FilePath& dump_prefix_path) {
-  std::cout << "NOTE: CertPathBuilder does not currently use OS trust settings "
-               "(--roots must be specified).\n";
   std::cerr << "WARNING: --hostname is not yet verified with CertPathBuilder\n";
 
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
-  net::TrustStore trust_store;
+#if defined(USE_NSS_CERTS)
+  net::TrustStoreNSS trust_store_nss(base::ThreadTaskRunnerHandle::Get());
+#else
+  std::cout << "NOTE: CertPathBuilder does not currently use OS trust settings "
+               "(--roots must be specified).\n";
+#endif
+  net::TrustStoreStatic trust_store_static;
   for (const auto& der_cert : root_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
     else
-      trust_store.AddTrustedCertificate(cert);
+      trust_store_static.AddTrustedCertificate(cert);
   }
 
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
     else
       intermediate_cert_issuer_source.AddCert(cert);
   }
 
   scoped_refptr<net::ParsedCertificate> target_cert =
       net::ParsedCertificate::CreateFromCertificateCopy(
           target_der_cert.der_cert, {});
   if (!target_cert) {
     PrintCertError("ERROR: ParsedCertificate failed:", target_der_cert);
     return false;
   }
 
   // Verify the chain.
   net::SimpleSignaturePolicy signature_policy(2048);
   net::CertPathBuilder::Result result;
-  net::CertPathBuilder path_builder(target_cert, &trust_store,
-                                    &signature_policy, time, &result);
+  net::CertPathBuilder path_builder(target_cert, &signature_policy, time,
+                                    &result);
+  path_builder.AddTrustStore(&trust_store_static);
+#if defined(USE_NSS_CERTS)
+  path_builder.AddTrustStore(&trust_store_nss);
+#endif
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
 
   // TODO(mattm): add command line flags to configure using CertIssuerSourceAia
   // (similar to VERIFY_CERT_IO_ENABLED flag for CertVerifyProc).
   net::URLRequestContextBuilder url_request_context_builder;
   url_request_context_builder.set_user_agent(GetUserAgent());
 #if defined(OS_LINUX)
   // On Linux, use a fixed ProxyConfigService, since the default one
   // depends on glib.
   //
@@ skipping 34 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.error() == net::OK;
 }