Add errors per ResultPath for CertPathBuilder.

net/cert/internal/path_builder.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PATH_BUILDER_H_
 #define NET_CERT_INTERNAL_PATH_BUILDER_H_
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/callback.h"
 #include "net/base/completion_callback.h"
-#include "net/base/net_errors.h"
 #include "net/base/net_export.h"
+#include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/completion_status.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/trust_store.h"
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
 
 namespace net {
 
 namespace der {
 struct GeneralizedTime;
@@ skipping 31 matching lines @@
 //
 // WARNING: This implementation is currently experimental.  Consult an OWNER
 // before using it.
 class NET_EXPORT CertPathBuilder {
  public:
   // Represents a single candidate path that was built.
   struct NET_EXPORT ResultPath {
     ResultPath();
     ~ResultPath();
 
-    // Returns true if this path was successfully verified.
-    bool is_success() const { return error == OK; }
-
-    // The (possibly partial) certificate path. In the case of an
-    // error path.trust_anchor may be nullptr.
+    // The (possibly partial) certificate path. Consumers must always test
+    // |valid| before using |path|. When |!valid| path.trust_anchor may be
+    // nullptr, and the path may be otherwise incomplete/invalid.
     CertPath path;
 
-    // A net error code result of attempting to verify this path.
-    // TODO(mattm): may want to have an independent result enum, which caller
-    // can map to a net error if they want.
-    int error = ERR_UNEXPECTED;
+    // The errors/warnings from this path. Note that the list of errors is
+    // independent of whether the path was |valid| (a valid path may
+    // contain errors/warnings, and vice versa an invalid path may not have
+    // logged any errors).
+    CertErrors errors;
+
+    // True if |path| is a correct verified certificate chain.
+    bool valid = false;
   };
 
   // Provides the overall result of path building. This includes the paths that
   // were attempted.
   struct NET_EXPORT Result {
     Result();
     ~Result();
 
     // Returns true if there was a valid path.
-    bool is_success() const { return error() == OK; }
+    bool HasValidPath() const;
 
-    // Returns the net error code of the overall best result.
-    int error() const {
-      if (paths.empty())
-        return ERR_CERT_AUTHORITY_INVALID;
-      return paths[best_result_index]->error;
-    }
+    // Returns the ResultPath for the best valid path, or nullptr if there
+    // was none.
+    const ResultPath* GetBestValidPath() const;
 
     // List of paths that were attempted and the result for each.
     std::vector<std::unique_ptr<ResultPath>> paths;
 
     // Index into |paths|. Before use, |paths.empty()| must be checked.
-    // NOTE: currently the definition of "best" is fairly limited. Successful is
-    // better than unsuccessful, but otherwise nothing is guaranteed.
+    // NOTE: currently the definition of "best" is fairly limited. Valid is
+    // better than invalid, but otherwise nothing is guaranteed.
     size_t best_result_index = 0;
 
    private:
     DISALLOW_COPY_AND_ASSIGN(Result);
   };
 
   // TODO(mattm): allow caller specified hook/callback to extend path
   // verification.
   //
   // Creates a CertPathBuilder that attempts to find a path from |cert| to a
@@ skipping 43 matching lines @@
     STATE_GET_NEXT_PATH,
     STATE_GET_NEXT_PATH_COMPLETE,
   };
 
   CompletionStatus DoLoop(bool allow_async);
 
   CompletionStatus DoGetNextPath(bool allow_async);
   void HandleGotNextPath();
   CompletionStatus DoGetNextPathComplete();
 
-  void AddResultPath(const CertPath& path, bool is_success);
+  void AddResultPath(std::unique_ptr<ResultPath> result_path);
 
   base::Closure callback_;
 
   std::unique_ptr<CertPathIter> cert_path_iter_;
   const SignaturePolicy* signature_policy_;
   const der::GeneralizedTime time_;
 
   // Stores the next complete path to attempt verification on. This is filled in
   // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should
   // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step.
   // (Will be empty if all paths have been tried, otherwise will be a candidate
   // path starting with the target cert and ending with a
   // certificate issued by trust anchor.)
   CertPath next_path_;
   State next_state_;
 
   Result* out_result_;
 
   DISALLOW_COPY_AND_ASSIGN(CertPathBuilder);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PATH_BUILDER_H_