Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/trust_store_nss_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/trust_store_nss.h"
 
 #include <cert.h>
 #include <certdb.h>
 
 #include "base/memory/ptr_util.h"
@@ skipping 88 matching lines @@
         CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA;
     SECStatus srv =
         CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust);
     ASSERT_EQ(SECSuccess, srv);
   }
 
  protected:
   bool TrustStoreContains(scoped_refptr<ParsedCertificate> cert,
                           TrustAnchors expected_matches) {
     TrustAnchors matches;
-    trust_store_nss_->FindTrustAnchorsForCert(cert, &matches);
+    ParsedCertificateList intermediates;
+    trust_store_nss_->FindIssuers(cert, &matches, &intermediates);
 
     std::vector<der::Input> der_result_matches;
     for (const auto& it : matches)
       der_result_matches.push_back(it->cert()->der_cert());
     std::sort(der_result_matches.begin(), der_result_matches.end());
 
     std::vector<der::Input> der_expected_matches;
     for (const auto& it : expected_matches)
       der_expected_matches.push_back(it->cert()->der_cert());
     std::sort(der_expected_matches.begin(), der_expected_matches.end());
@@ skipping 72 matching lines @@
 TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) {
   AddCertsToNSS();
   TrustCert(oldroot_.get());
   TrustCert(newroot_.get());
   EXPECT_TRUE(TrustStoreContains(target_, TrustAnchors()));
   EXPECT_TRUE(TrustStoreContains(newintermediate_, {newroot_, oldroot_}));
   EXPECT_TRUE(TrustStoreContains(oldintermediate_, {newroot_, oldroot_}));
   EXPECT_TRUE(TrustStoreContains(oldroot_->cert(), {newroot_, oldroot_}));
 }
 
+// TODO(eroman): Adapt these tests before landing CL.
+#if 0
+class CertIssuerSourceNSSTestDelegate {
+ public:
+  void AddCert(scoped_refptr<ParsedCertificate> cert) {
+    ASSERT_TRUE(test_nssdb_.is_open());
+    std::string nickname = GetUniqueNickname();
+    ScopedCERTCertificate nss_cert(
+        X509Certificate::CreateOSCertHandleFromBytesWithNickname(
+            cert->der_cert().AsStringPiece().data(), cert->der_cert().Length(),
+            nickname.c_str()));
+    ASSERT_TRUE(nss_cert);
+    SECStatus srv =
+        PK11_ImportCert(test_nssdb_.slot(), nss_cert.get(), CK_INVALID_HANDLE,
+                        nickname.c_str(), PR_FALSE /* includeTrust (unused) */);
+    ASSERT_EQ(SECSuccess, srv);
+  }
+
+  CertIssuerSource& source() { return cert_issuer_source_nss_; }
+
+ protected:
+  std::string GetUniqueNickname() {
+    return "cert_issuer_source_nss_unittest" +
+           base::UintToString(nickname_counter_++);
+  }
+
+  crypto::ScopedTestNSSDB test_nssdb_;
+  CertIssuerSourceNSS cert_issuer_source_nss_;
+  unsigned int nickname_counter_ = 0;
+};
+
+INSTANTIATE_TYPED_TEST_CASE_P(CertIssuerSourceNSSTest,
+                              CertIssuerSourceSyncTest,
+                              CertIssuerSourceNSSTestDelegate);
+
+// NSS doesn't normalize UTF8String values, so use the not-normalized version of
+// those tests.
+INSTANTIATE_TYPED_TEST_CASE_P(CertIssuerSourceNSSNotNormalizedTest,
+                              CertIssuerSourceSyncNotNormalizedTest,
+                              CertIssuerSourceNSSTestDelegate);
+#endif
+
 }  // namespace
 
 }  // namespace net