[refactor] Extract the platform-specific TrustStore instantiations and

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
 #include "crypto/sha2.h"
 #include "net/cert/cert_net_fetcher.h"
 #include "net/cert/internal/cert_issuer_source_aia.h"
 #include "net/cert/internal/cert_issuer_source_static.h"
 #include "net/cert/internal/parse_name.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/path_builder.h"
 #include "net/cert/internal/signature_policy.h"
-#include "net/cert/internal/trust_store_collection.h"
-#include "net/cert/internal/trust_store_in_memory.h"
+#include "net/cert/internal/system_trust_store.h"
 #include "net/cert/x509_util.h"
 #include "net/cert_net/cert_net_fetcher_impl.h"
 #include "net/tools/cert_verify_tool/cert_verify_tool_util.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_context_getter.h"
 
-#if defined(USE_NSS_CERTS)
-#include "base/threading/thread_task_runner_handle.h"
-#include "net/cert/internal/cert_issuer_source_nss.h"
-#include "net/cert/internal/trust_store_nss.h"
-#endif
-
 #if defined(OS_LINUX)
 #include "net/proxy/proxy_config.h"
 #include "net/proxy/proxy_config_service_fixed.h"
 #endif
 
-#if defined(OS_MACOSX) && !defined(OS_IOS)
-#include <Security/Security.h>
-#include "net/cert/internal/trust_store_mac.h"
-#endif
-
 namespace {
 
 std::string GetUserAgent() {
   return "cert_verify_tool/0.1";
 }
 
 // Converts a base::Time::Exploded to a net::der::GeneralizedTime.
 // TODO(mattm): This function exists in cast_cert_validator.cc also. Dedupe it?
 net::der::GeneralizedTime ConvertExplodedTime(
     const base::Time::Exploded& exploded) {
@@ skipping 157 matching lines @@
 bool VerifyUsingPathBuilder(
     const CertInput& target_der_cert,
     const std::vector<CertInput>& intermediate_der_certs,
     const std::vector<CertInput>& root_der_certs,
     const base::Time at_time,
     const base::FilePath& dump_prefix_path) {
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
-  net::TrustStoreCollection trust_store;
+  std::unique_ptr<net::SystemTrustStore> ssl_trust_store =
+      net::CreateSslSystemTrustStore();
 
-  net::TrustStoreInMemory trust_store_in_memory;
-  trust_store.AddTrustStore(&trust_store_in_memory);
   for (const auto& der_cert : root_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
     if (cert) {
-      trust_store_in_memory.AddTrustAnchor(
+      ssl_trust_store->AddTrustAnchor(
           net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
     }
   }
 
-#if defined(USE_NSS_CERTS)
-  net::TrustStoreNSS trust_store_nss(trustSSL);
-  trust_store.AddTrustStore(&trust_store_nss);
-#elif defined(OS_MACOSX) && !defined(OS_IOS)
-  net::TrustStoreMac trust_store_mac(kSecPolicyAppleSSL);
-  trust_store.AddTrustStore(&trust_store_mac);
-#else
-  if (root_der_certs.empty()) {
+  if (!ssl_trust_store->UsesSystemTrustStore() && root_der_certs.empty()) {
     std::cerr << "NOTE: CertPathBuilder does not currently use OS trust "
                  "settings (--roots must be specified).\n";
   }
-#endif
-
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
     if (cert)
       intermediate_cert_issuer_source.AddCert(cert);
   }
 
   scoped_refptr<net::ParsedCertificate> target_cert =
       ParseCertificate(target_der_cert);
   if (!target_cert)
     return false;
 
   // Verify the chain.
   net::SimpleSignaturePolicy signature_policy(2048);
   net::CertPathBuilder::Result result;
-  net::CertPathBuilder path_builder(target_cert, &trust_store,
-                                    &signature_policy, time,
-                                    net::KeyPurpose::SERVER_AUTH, &result);
+  net::CertPathBuilder path_builder(
+      target_cert, ssl_trust_store->GetTrustStore(), &signature_policy, time,
+      net::KeyPurpose::SERVER_AUTH, &result);
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
-#if defined(USE_NSS_CERTS)
-  net::CertIssuerSourceNSS cert_issuer_source_nss;
-  path_builder.AddCertIssuerSource(&cert_issuer_source_nss);
-#endif
+
+  if (ssl_trust_store->GetCertIssuerSource())
+    path_builder.AddCertIssuerSource(ssl_trust_store->GetCertIssuerSource());
 
   // Create a network thread to be used for AIA fetches, and wait for a
   // CertNetFetcher to be constructed on that thread.
   base::Thread::Options options(base::MessageLoop::TYPE_IO, 0);
   base::Thread thread("network_thread");
   CHECK(thread.StartWithOptions(options));
   // Owned by this thread, but initialized, used, and shutdown on the network
   // thread.
   std::unique_ptr<net::URLRequestContext> context;
   scoped_refptr<net::CertNetFetcher> cert_net_fetcher;
@@ skipping 35 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.HasValidPath();
 }