pki library: Add CertIssuerSourceNSS that retrieves intermediate certs from NSS.

net/cert/internal/cert_issuer_source_nss.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_INTERNAL_CERT_ISSUER_SOURCE_NSS_H_
+#define NET_CERT_INTERNAL_CERT_ISSUER_SOURCE_NSS_H_
+
+#include "net/base/net_export.h"
+#include "net/cert/internal/cert_issuer_source.h"
+
+namespace net {
+
+// Returns issuers from NSS. Always returns results syncronously.

[eroman, 2016/11/29 20:18:27]

spelling:  synchronously

Can you also add a little bit more information to the description on what these
certificates correspond with, and how it relates to TrustStoreNss ?

In particular there may be duplication of certificates (that are also trust
anchors), and it also I believe will include explicitly distrusted certs.

We may want to re-visit the interface later to combine the trust store accesses.
But layering-wise having separate interfaces for querying trustedness of a cert,
trust anchor, and intermediates feels legit too.

[mattm, 2016/11/30 03:07:19]

Done.
Done. (Although there is still a TODO about actually handling distrusted certs.)

Note also that there is the possibility that this could hide problems in our AIA
implementation if NSS already has a cached cert from its own AIA lookup. I
discussed it a bit with Ryan and although there could be some alternatives we
decided to go with this for now. Can discuss more if you want.
Yeah, I think duplicating the lookup isn't a big burden for now, but we may want
to revisit later.

+class NET_EXPORT CertIssuerSourceNSS : public CertIssuerSource {
+ public:
+  CertIssuerSourceNSS();
+  ~CertIssuerSourceNSS() override;
+
+  // CertIssuerSource implementation:
+  void SyncGetIssuersOf(const ParsedCertificate* cert,
+                        ParsedCertificateList* issuers) override;
+  void AsyncGetIssuersOf(const ParsedCertificate* cert,

[eroman, 2016/11/29 20:18:27]

Side-note, and thinking out loud here (not related to this CL): I wonder if it
would make sense to remove the async part of this interface and make it purely
sync. The only current consumer of async is for AIA. 

Assuming we won't have need of any async certificate providers (other than AIA),
Path builder could use the CertNetFetcher directly and have a less generic async
path.

[mattm, 2016/11/30 03:07:19]

Possibly, if we find there aren't any other use cases.

+                         std::unique_ptr<Request>* out_req) override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(CertIssuerSourceNSS);
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_INTERNAL_CERT_ISSUER_SOURCE_NSS_H_