Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 56 matching lines @@
 
 // Dumps a chain of ParsedCertificate objects to a PEM file.
 bool DumpParsedCertificateChain(const base::FilePath& file_path,
                                 const net::CertPath& chain) {
   std::vector<std::string> pem_encoded_chain;
   for (const auto& cert : chain.certs) {
     if (!AddPemEncodedCert(cert.get(), &pem_encoded_chain))
       return false;
   }
 
-  if (chain.trust_anchor && chain.trust_anchor->cert()) {
-    if (!AddPemEncodedCert(chain.trust_anchor->cert().get(),
-                           &pem_encoded_chain))
-      return false;
-  }
-
   return WriteToFile(file_path, base::JoinString(pem_encoded_chain, ""));
 }
 
 // Returns a hex-encoded sha256 of the DER-encoding of |cert|.
 std::string FingerPrintParsedCertificate(const net::ParsedCertificate* cert) {
   std::string hash = crypto::SHA256HashString(cert->der_cert().AsStringPiece());
   return base::HexEncode(hash.data(), hash.size());
 }
 
 std::string SubjectToString(const net::RDNSequence& parsed_subject) {
   std::string subject_str;
   if (!net::ConvertToRFC2253(parsed_subject, &subject_str))
     return std::string();
   return subject_str;
 }
 
 // Returns a textual representation of the Subject of |cert|.
 std::string SubjectFromParsedCertificate(const net::ParsedCertificate* cert) {
   net::RDNSequence parsed_subject;
   if (!net::ParseName(cert->tbs().subject_tlv, &parsed_subject))
     return std::string();
   return SubjectToString(parsed_subject);
 }
 
-// Returns a textual representation of the Subject of |trust_anchor|.
-std::string SubjectFromTrustAnchor(const net::TrustAnchor* trust_anchor) {
-  // If the cert is present, display the original subject from that rather than
-  // the normalized subject.
-  if (trust_anchor->cert())
-    return SubjectFromParsedCertificate(trust_anchor->cert().get());
-
-  net::RDNSequence parsed_subject;
-  if (!net::ParseNameValue(trust_anchor->normalized_subject(), &parsed_subject))
-    return std::string();
-  return SubjectToString(parsed_subject);
-}
-
 // Dumps a ResultPath to std::cout.
 void PrintResultPath(const net::CertPathBuilder::ResultPath* result_path,
                      size_t index,
                      bool is_best) {
   std::cout << "path " << index << " "
             << (result_path->IsValid() ? "valid" : "invalid")
             << (is_best ? " (best)" : "") << "\n";
 
   // Print the certificate chain.
   for (const auto& cert : result_path->path.certs) {
     std::cout << " " << FingerPrintParsedCertificate(cert.get()) << " "
               << SubjectFromParsedCertificate(cert.get()) << "\n";
   }
 
-  // Print the trust anchor (if there was one).
-  const auto& trust_anchor = result_path->path.trust_anchor;
-  if (trust_anchor) {
-    std::string trust_anchor_cert_fingerprint = "<no cert>";
-    if (trust_anchor->cert()) {
-      trust_anchor_cert_fingerprint =
-          FingerPrintParsedCertificate(trust_anchor->cert().get());
-    }
-    std::cout << " " << trust_anchor_cert_fingerprint << " "
-              << SubjectFromTrustAnchor(trust_anchor.get()) << "\n";
-  }
-
   // Print the errors/warnings if there were any.
   std::string errors_str =
       result_path->errors.ToDebugString(result_path->path.certs);
   if (!errors_str.empty()) {
     std::cout << "Errors:\n";
     std::cout << errors_str << "\n";
   }
 }
 
 scoped_refptr<net::ParsedCertificate> ParseCertificate(const CertInput& input) {
@@ skipping 52 matching lines @@
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
   std::unique_ptr<net::SystemTrustStore> ssl_trust_store =
       net::CreateSslSystemTrustStore();
 
   for (const auto& der_cert : root_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
     if (cert) {
-      ssl_trust_store->AddTrustAnchor(
-          net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
+      ssl_trust_store->AddTrustAnchor(cert);
     }
   }
 
   if (!ssl_trust_store->UsesSystemTrustStore() && root_der_certs.empty()) {
     std::cerr << "NOTE: CertPathBuilder does not currently use OS trust "
                  "settings (--roots must be specified).\n";
   }
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
     if (cert)
       intermediate_cert_issuer_source.AddCert(cert);
   }
 
   scoped_refptr<net::ParsedCertificate> target_cert =
       ParseCertificate(target_der_cert);
   if (!target_cert)
     return false;
 
   // Verify the chain.
   net::SimpleSignaturePolicy signature_policy(2048);
   net::CertPathBuilder::Result result;
   net::CertPathBuilder path_builder(
       target_cert, ssl_trust_store->GetTrustStore(), &signature_policy, time,
       net::KeyPurpose::SERVER_AUTH, &result);
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
 
-  if (ssl_trust_store->GetCertIssuerSource())
-    path_builder.AddCertIssuerSource(ssl_trust_store->GetCertIssuerSource());
-
   // Create a network thread to be used for AIA fetches, and wait for a
   // CertNetFetcher to be constructed on that thread.
   base::Thread::Options options(base::MessageLoop::TYPE_IO, 0);
   base::Thread thread("network_thread");
   CHECK(thread.StartWithOptions(options));
   // Owned by this thread, but initialized, used, and shutdown on the network
   // thread.
   std::unique_ptr<net::URLRequestContext> context;
   scoped_refptr<net::CertNetFetcher> cert_net_fetcher;
   base::WaitableEvent initialization_complete_event(
@@ skipping 34 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.HasValidPath();
 }