Add production Cast CRL certificate.

components/cast_certificate/cast_cert_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 233 matching lines @@
   // INTEGER (non-minimal encoding).
   //
   // Allow these sorts of serial numbers.
   //
   // TODO(eroman): At some point in the future this workaround will no longer be
   // necessary. Should revisit this for removal in 2017 if not earlier.
   options.allow_invalid_serial_numbers = true;
   return options;
 }
 
-}  // namespace
-
+// Verifies a cast device certficate given a chain of DER-encoded certificates.
 bool VerifyDeviceCert(const std::vector<std::string>& certs,
                       const base::Time& time,
                       std::unique_ptr<CertVerificationContext>* context,
                       CastDeviceCertPolicy* policy,
                       const CastCRL* crl,
-                      CRLPolicy crl_policy) {
+                      CRLPolicy crl_policy,
+                      net::TrustStore* trust_store) {
   if (certs.empty())
     return false;
 
   // No reference to these ParsedCertificates is kept past the end of this
   // function, so using EXTERNAL_REFERENCE here is safe.
   scoped_refptr<net::ParsedCertificate> target_cert;
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (size_t i = 0; i < certs.size(); ++i) {
     scoped_refptr<net::ParsedCertificate> cert(
         net::ParsedCertificate::CreateFromCertificateData(
@@ skipping 11 matching lines @@
 
   // Use a signature policy compatible with Cast's PKI.
   auto signature_policy = CreateCastSignaturePolicy();
 
   // Do path building and RFC 5280 compatible certificate verification using the
   // two Cast trust anchors and Cast signature policy.
   net::der::GeneralizedTime verification_time;
   if (!net::der::EncodeTimeAsGeneralizedTime(time, &verification_time))
     return false;
   net::CertPathBuilder::Result result;
-  net::CertPathBuilder path_builder(target_cert.get(), &CastTrustStore::Get(),
+  net::CertPathBuilder path_builder(target_cert.get(), trust_store,
                                     signature_policy.get(), verification_time,
                                     &result);
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
   net::CompletionStatus rv = path_builder.Run(base::Closure());
   DCHECK_EQ(rv, net::CompletionStatus::SYNC);
   if (!result.is_success())
     return false;
 
   // Check properties of the leaf certificate (key usage, policy), and construct
   // a CertVerificationContext that uses its public key.
@@ skipping 11 matching lines @@
       return false;
 
     if (!crl->CheckRevocation(result.paths[result.best_result_index]->path,
                               time)) {
       return false;
     }
   }
   return true;
 }
 
+}  // namespace
+
+bool VerifyDeviceCert(const std::vector<std::string>& certs,
+                      const base::Time& time,
+                      std::unique_ptr<CertVerificationContext>* context,
+                      CastDeviceCertPolicy* policy,
+                      const CastCRL* crl,
+                      CRLPolicy crl_policy) {
+  return VerifyDeviceCert(certs, time, context, policy, crl, crl_policy,
+                          &CastTrustStore::Get());
+}
+
+bool VerifyDeviceCertForTest(const std::vector<std::string>& certs,
+                             const base::Time& time,
+                             std::unique_ptr<CertVerificationContext>* context,
+                             CastDeviceCertPolicy* policy,
+                             const CastCRL* crl,
+                             CRLPolicy crl_policy,
+                             net::TrustStore* trust_store) {
+  return VerifyDeviceCert(certs, time, context, policy, crl, crl_policy,
+                          trust_store);
+}
+
 std::unique_ptr<CertVerificationContext> CertVerificationContextImplForTest(
     const base::StringPiece& spki) {
   // Use a bogus CommonName, since this is just exposed for testing signature
   // verification by unittests.
   return base::WrapUnique(
       new CertVerificationContextImpl(net::der::Input(spki), "CommonName"));
 }
 
-bool SetTrustAnchorForTest(const std::string& cert) {
-  scoped_refptr<net::ParsedCertificate> anchor(
-      net::ParsedCertificate::CreateFromCertificateCopy(
-          cert, GetCertParsingOptions()));
-  if (!anchor)
-    return false;
-  CastTrustStore::Get().Clear();
-  CastTrustStore::Get().AddTrustedCertificate(std::move(anchor));
-  return true;
-}
-
 }  // namespace cast_certificate