Add TrustStoreNSS and TrustStoreCollection

net/cert/internal/trust_store_nss.h

Index: net/cert/internal/trust_store_nss.h
diff --git a/net/cert/internal/trust_store_nss.h b/net/cert/internal/trust_store_nss.h
new file mode 100644
index 0000000000000000000000000000000000000000..75fdda83ab0af385aa54c0b0c2abf0c8abe7caf2
--- /dev/null
+++ b/net/cert/internal/trust_store_nss.h
@@ -0,0 +1,45 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_INTERNAL_TRUST_STORE_NSS_H_
+#define NET_CERT_INTERNAL_TRUST_STORE_NSS_H_
+
+#include "base/memory/ref_counted.h"
+#include "net/base/net_export.h"
+#include "net/cert/internal/trust_store.h"
+
+namespace base {
+class TaskRunner;
+}
+
+namespace net {
+
+// TrustStoreNSS is an implementation of TrustStore which uses NSS to find trust
+// anchors for path building.

[Ryan Sleevi, 2016/08/31 20:50:39]

Maybe worth highlighting this is only suitable for SSL. Or should you do what
libpkix and Mozilla do, which is take a SECTrustType to indicate what sort of
trust(s) you're evaluating against?

(I imagine the same for OS X, where we need to indicate an SSL trust policy and
not just an X.509 TP)

[mattm, 2016/09/01 00:59:02]

Changed to take a SECTrustType.

+// TODO(mattm): also implement CertIssuerSource to return intermediates in NSS
+// DB? Or have a separate CertIssuerSourceNSS for that?  (implementing both in
+// the same class could be more efficient with some caching/etc. Need to be
+// careful about caching between different pathbuilder instances though.)
+class NET_EXPORT TrustStoreNSS : public TrustStore {
+ public:
+  // Creates a TrustStoreNSS. All NSS calls will be done on |nss_task_runner|.
+  explicit TrustStoreNSS(scoped_refptr<base::TaskRunner> nss_task_runner);
+  ~TrustStoreNSS() override;
+
+  // TrustStore implementation:
+  void FindTrustAnchorsForCert(
+      const scoped_refptr<ParsedCertificate>& cert,
+      const TrustAnchorsCallback& callback,
+      TrustAnchors* synchronous_matches,
+      std::unique_ptr<Request>* out_req) const override;
+
+ private:
+  scoped_refptr<base::TaskRunner> nss_task_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(TrustStoreNSS);
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_INTERNAL_TRUST_STORE_NSS_H_