Improvements to the net/cert/internal error handling.

net/cert/internal/verify_certificate_chain_pkits_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/signature_policy.h"
 #include "net/cert/internal/trust_store.h"
 #include "net/der/input.h"
@@ skipping 39 matching lines @@
   static bool Verify(std::vector<std::string> cert_ders,
                      std::vector<std::string> crl_ders) {
     if (cert_ders.empty()) {
       ADD_FAILURE() << "cert_ders is empty";
       return false;
     }
 
     // PKITS lists chains from trust anchor to target, VerifyCertificateChain
     // takes them starting with the target and not including the trust anchor.
     std::vector<scoped_refptr<net::ParsedCertificate>> input_chain;
-    CertErrors errors;
+    CertErrors parsing_errors;
     for (auto i = cert_ders.rbegin(); i != cert_ders.rend(); ++i) {
       if (!net::ParsedCertificate::CreateAndAddToVector(
               bssl::UniquePtr<CRYPTO_BUFFER>(
                   CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(i->data()),
                                     i->size(), nullptr)),
-              {}, &input_chain, &errors)) {
-        ADD_FAILURE() << "Cert failed to parse:\n" << errors.ToDebugString();
+              {}, &input_chain, &parsing_errors)) {
+        ADD_FAILURE() << "Cert failed to parse:\n"
+                      << parsing_errors.ToDebugString();
         return false;
       }
     }
 
     scoped_refptr<TrustAnchor> trust_anchor =
         TrustAnchor::CreateFromCertificateNoConstraints(input_chain.back());
     input_chain.pop_back();
 
     SimpleSignaturePolicy signature_policy(1024);
 
     // Run all tests at the time the PKITS was published.
     der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0};
 
+    CertPathErrors path_errors;
     bool result = VerifyCertificateChain(input_chain, trust_anchor.get(),
-                                         &signature_policy, time, &errors);
+                                         &signature_policy, time, &path_errors);
 
     //  TODO(crbug.com/634443): Test errors on failure?
-    if (!result)
-      EXPECT_FALSE(errors.empty());
-
+    EXPECT_EQ(result, !path_errors.ContainsHighSeverityErrors());
     return result;
   }
 };
 
 }  // namespace
 
 class PkitsTest01SignatureVerificationCustom
     : public PkitsTest<VerifyCertificateChainPkitsTestDelegate> {};
 
 // Modified version of 4.1.4 Valid DSA Signatures Test4
@@ skipping 116 matching lines @@
 
 // TODO(mattm): CRL support: PkitsTest04BasicCertificateRevocationTests,
 // PkitsTest05VerifyingPathswithSelfIssuedCertificates,
 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs
 
 // TODO(mattm): Certificate Policies support: PkitsTest08CertificatePolicies,
 // PkitsTest09RequireExplicitPolicy PkitsTest10PolicyMappings,
 // PkitsTest11InhibitPolicyMapping, PkitsTest12InhibitAnyPolicy
 
 }  // namespace net