Don't treat trust anchors as certificates during path building.

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 31 matching lines @@
   net::der::GeneralizedTime result;
   result.year = exploded.year;
   result.month = exploded.month;
   result.day = exploded.day_of_month;
   result.hours = exploded.hour;
   result.minutes = exploded.minute;
   result.seconds = exploded.second;
   return result;
 }
 
+bool AddPemEncodedCert(const net::ParsedCertificate* cert,
+                       std::vector<std::string>* pem_encoded_chain) {
+  std::string der_cert;
+  cert->der_cert().AsStringPiece().CopyToString(&der_cert);
+  std::string pem;
+  if (!net::X509Certificate::GetPEMEncodedFromDER(der_cert, &pem)) {
+    std::cerr << "ERROR: GetPEMEncodedFromDER failed\n";
+    return false;
+  }
+  pem_encoded_chain->push_back(pem);
+  return true;
+}
+
 // Dumps a chain of ParsedCertificate objects to a PEM file.
-bool DumpParsedCertificateChain(
-    const base::FilePath& file_path,
-    const std::vector<scoped_refptr<net::ParsedCertificate>>& chain) {
+bool DumpParsedCertificateChain(const base::FilePath& file_path,
+                                const net::CertPath& chain) {
   std::vector<std::string> pem_encoded_chain;
-  for (const auto& cert : chain) {
-    std::string der_cert;
-    cert->der_cert().AsStringPiece().CopyToString(&der_cert);
-    std::string pem;
-    if (!net::X509Certificate::GetPEMEncodedFromDER(der_cert, &pem)) {
-      std::cerr << "ERROR: GetPEMEncodedFromDER failed\n";
+  for (const auto& cert : chain.certs) {
+    if (!AddPemEncodedCert(cert.get(), &pem_encoded_chain))
       return false;
-    }
-    pem_encoded_chain.push_back(pem);
   }
+
+  if (chain.trust_anchor && chain.trust_anchor->cert()) {
+    if (!AddPemEncodedCert(chain.trust_anchor->cert().get(),
+                           &pem_encoded_chain))
+      return false;
+  }
+
   return WriteToFile(file_path, base::JoinString(pem_encoded_chain, ""));
 }
 
 // Returns a hex-encoded sha256 of the DER-encoding of |cert|.
 std::string FingerPrintParsedCertificate(const net::ParsedCertificate* cert) {
   std::string hash = crypto::SHA256HashString(cert->der_cert().AsStringPiece());
   return base::HexEncode(hash.data(), hash.size());
 }
 
-// Returns a textual representation of the Subject of |cert|.
-std::string SubjectFromParsedCertificate(const net::ParsedCertificate* cert) {
+std::string SubjectToString(const net::der::Input& subject_tlv) {
   net::RDNSequence subject, issuer;
-  if (!net::ParseName(cert->tbs().subject_tlv, &subject))
+  if (!net::ParseName(subject_tlv, &subject))
     return std::string();
   std::string subject_str;
   if (!net::ConvertToRFC2253(subject, &subject_str))
     return std::string();
   return subject_str;
 }
 
+// Returns a textual representation of the Subject of |cert|.
+std::string SubjectFromParsedCertificate(const net::ParsedCertificate* cert) {
+  return SubjectToString(cert->tbs().subject_tlv);
+}
+
 }  // namespace
 
 // Verifies |target_der_cert| using CertPathBuilder.
 bool VerifyUsingPathBuilder(
     const CertInput& target_der_cert,
     const std::vector<CertInput>& intermediate_der_certs,
     const std::vector<CertInput>& root_der_certs,
     const base::Time at_time,
     const base::FilePath& dump_prefix_path) {
   std::cout << "NOTE: CertPathBuilder does not currently use OS trust settings "
                "(--roots must be specified).\n";
   std::cerr << "WARNING: --hostname is not yet verified with CertPathBuilder\n";
 
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
   net::TrustStore trust_store;
   for (const auto& der_cert : root_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
-    else
-      trust_store.AddTrustedCertificate(cert);
+    else {
+      trust_store.AddTrustAnchor(
+          net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
+    }
   }
 
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
     else
@@ skipping 42 matching lines @@
     DVLOG(1) << "async completed.";
   }
 
   std::cout << "CertPathBuilder best result: "
             << net::ErrorToShortString(result.error()) << "\n";
 
   for (size_t i = 0; i < result.paths.size(); ++i) {
     std::cout << "path " << i << " "
               << net::ErrorToShortString(result.paths[i]->error)
               << ((result.best_result_index == i) ? " (best)" : "") << "\n";
-    for (const auto& cert : result.paths[i]->path) {
+    for (const auto& cert : result.paths[i]->path.certs) {
       std::cout << " " << FingerPrintParsedCertificate(cert.get()) << " "
                 << SubjectFromParsedCertificate(cert.get()) << "\n";
     }
+
+    const auto& trust_anchor = result.paths[i]->path.trust_anchor;
+    if (trust_anchor) {
+      std::string trust_anchor_cert_fingerprint = "<no cert>";
+      if (trust_anchor->cert()) {
+        trust_anchor_cert_fingerprint =
+            FingerPrintParsedCertificate(trust_anchor->cert().get());
+      }
+      std::cout << " " << trust_anchor_cert_fingerprint << " "
+                << SubjectToString(trust_anchor->normalized_subject()) << "\n";
+    }
   }
 
   // TODO(mattm): add flag to dump all paths, not just the final one?
   if (!dump_prefix_path.empty() && result.paths.size()) {
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.error() == net::OK;
 }