Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/path_builder.h"
 
 #include <set>
 #include <unordered_set>
 
 #include "base/logging.h"
@@ skipping 118 matching lines @@
                                  const TrustStore* trust_store)
     : cert_(in_cert),
       cert_issuer_sources_(cert_issuer_sources),
       trust_store_(trust_store) {
   DVLOG(1) << "CertIssuersIter(" << CertDebugString(cert()) << ") created";
 }
 
 void CertIssuersIter::GetNextIssuer(CertificateOrTrustAnchor* out) {
   if (!did_initial_query_) {
     did_initial_query_ = true;
-    trust_store_->FindTrustAnchorsForCert(cert_, &anchors_);
+    ParsedCertificateList issuers_from_trust_store;
+    trust_store_->FindIssuers(cert_, &anchors_, &issuers_from_trust_store);
+    AddIssuers(std::move(issuers_from_trust_store));
 
     for (auto* cert_issuer_source : *cert_issuer_sources_) {
       ParsedCertificateList new_issuers;
       cert_issuer_source->SyncGetIssuersOf(cert(), &new_issuers);
       AddIssuers(std::move(new_issuers));
     }
     DVLOG(1) << anchors_.size() << " sync anchors, " << issuers_.size()
              << " sync issuers";
     // TODO(mattm): sort by notbefore, etc (eg if cert issuer matches a trust
     // anchor subject (or is a trust anchor), that should be sorted higher too.
@@ skipping 393 matching lines @@
 
   // Verify the entire certificate chain.
   auto result_path = base::MakeUnique<ResultPath>();
   bool verify_result = VerifyCertificateChain(
       next_path_.certs, next_path_.trust_anchor.get(), signature_policy_, time_,
       key_purpose_, &result_path->errors);
   DVLOG(1) << "CertPathBuilder VerifyCertificateChain result = "
            << verify_result;
   result_path->path = next_path_;
   DCHECK_EQ(verify_result, !result_path->errors.ContainsHighSeverityErrors());
+
+  // TODO(eroman): Check that none of the certificates are blacklisted.
+
   AddResultPath(std::move(result_path));
 
   if (verify_result) {
     // Found a valid path, return immediately.
     // TODO(mattm): add debug/test mode that tries all possible paths.
     next_state_ = STATE_NONE;
     return;
   }
 
   // Path did not verify. Try more paths. If there are no more paths, the result
   // will be returned next time DoGetNextPathComplete is called with next_path_
   // empty.
   next_state_ = STATE_GET_NEXT_PATH;
 }
 
 void CertPathBuilder::AddResultPath(std::unique_ptr<ResultPath> result_path) {
   // TODO(mattm): set best_result_index based on number or severity of errors.
   if (result_path->IsValid())
     out_result_->best_result_index = out_result_->paths.size();
   // TODO(mattm): add flag to only return a single path or all attempted paths?
   out_result_->paths.push_back(std::move(result_path));
 }
 
 }  // namespace net