Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/trust_store_mac.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/trust_store_mac.h"
 
 #include <Security/Security.h>
 
 #include "base/logging.h"
 #include "base/mac/foundation_util.h"
@@ skipping 160 matching lines @@
         trust_settings, is_self_signed, policy_oid);
     if (trust != TrustStatus::UNSPECIFIED)
       return trust;
   }
 
   // No trust settings, or none of the settings were for the correct policy, or
   // had the correct trust result.
   return TrustStatus::UNSPECIFIED;
 }
 
-// Filters an array of SecCertificateRef by trust for |policy_oid|, returning
-// the results as TrustAnchors in |out_anchors|.
-void FilterTrustedCertificates(CFArrayRef matching_items,
-                               const CFStringRef policy_oid,
-                               TrustAnchors* out_anchors) {
+}  // namespace
+
+TrustStoreMac::TrustStoreMac(CFTypeRef policy_oid)
+    : policy_oid_(base::mac::CFCastStrict<CFStringRef>(policy_oid)) {
+  DCHECK(policy_oid_);
+}
+
+TrustStoreMac::~TrustStoreMac() = default;
+
+void TrustStoreMac::SyncGetIssuersOf(const ParsedCertificate* cert,
+                                     ParsedCertificateList* issuers) {
+  base::ScopedCFTypeRef<CFDataRef> name_data = GetMacNormalizedIssuer(cert);
+
+  base::ScopedCFTypeRef<CFArrayRef> matching_items =
+      FindMatchingCertificatesForMacNormalizedSubject(name_data);
+  if (!matching_items)
+    return;
+
+  // Convert to ParsedCertificate.
   for (CFIndex i = 0, item_count = CFArrayGetCount(matching_items);
        i < item_count; ++i) {
     SecCertificateRef match_cert_handle = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(matching_items, i)));
 
-    if (IsSecCertificateTrustedForPolicy(match_cert_handle, policy_oid) !=
-        TrustStatus::TRUSTED)
-      continue;
-
     base::ScopedCFTypeRef<CFDataRef> der_data(
         SecCertificateCopyData(match_cert_handle));
     if (!der_data) {
       LOG(ERROR) << "SecCertificateCopyData error";
       continue;
     }
 
     CertErrors errors;
     ParseCertificateOptions options;
     options.allow_invalid_serial_numbers = true;
     scoped_refptr<ParsedCertificate> anchor_cert = ParsedCertificate::Create(
         x509_util::CreateCryptoBuffer(CFDataGetBytePtr(der_data.get()),
                                       CFDataGetLength(der_data.get())),
         options, &errors);
     if (!anchor_cert) {
       // TODO(crbug.com/634443): return errors better.
       LOG(ERROR) << "Error parsing issuer certificate:\n"
                  << errors.ToDebugString();
       continue;
     }
 
-    out_anchors->push_back(TrustAnchor::CreateFromCertificateNoConstraints(
-        std::move(anchor_cert)));
+    issuers->push_back(std::move(anchor_cert));
   }
 }
 
-}  // namespace
+void TrustStoreMac::GetTrust(const scoped_refptr<ParsedCertificate>& cert,
+                             CertificateTrust* trust) const {
+  // TODO(eroman): Inefficient -- path building will convert between
+  // SecCertificateRef and ParsedCertificate representations multiple times
+  // (when getting the issuers, and again here).
+  base::ScopedCFTypeRef<SecCertificateRef> cert_handle =
+      x509_util::CreateSecCertificateFromBytes(cert->der_cert().UnsafeData(),
+                                               cert->der_cert().Length());
 
-TrustStoreMac::TrustStoreMac(CFTypeRef policy_oid)
-    : policy_oid_(base::mac::CFCastStrict<CFStringRef>(policy_oid)) {
-  DCHECK(policy_oid_);
-}
+  TrustStatus trust_status =
+      IsSecCertificateTrustedForPolicy(cert_handle, policy_oid_);
+  switch (trust_status) {
+    case TrustStatus::TRUSTED:
+      *trust = CertificateTrust::ForTrustAnchor();
+      return;
+    case TrustStatus::DISTRUSTED:
+      *trust = CertificateTrust::ForDistrusted();
+      return;
+    case TrustStatus::UNSPECIFIED:
+      *trust = CertificateTrust::ForUnspecified();
+      return;
+  }
 
-TrustStoreMac::~TrustStoreMac() = default;
-
-void TrustStoreMac::FindTrustAnchorsForCert(
-    const scoped_refptr<ParsedCertificate>& cert,
-    TrustAnchors* out_anchors) const {
-  base::ScopedCFTypeRef<CFDataRef> name_data = GetMacNormalizedIssuer(cert);
-
-  FindTrustAnchorsByMacNormalizedSubject(name_data, out_anchors);
+  *trust = CertificateTrust::ForUnspecified();
+  return;
 }
 
 // static
 base::ScopedCFTypeRef<CFArrayRef>
 TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
     CFDataRef name_data) {
   base::ScopedCFTypeRef<CFArrayRef> matching_items;
   base::ScopedCFTypeRef<CFMutableDictionaryRef> query(
       CFDictionaryCreateMutable(nullptr, 0, &kCFTypeDictionaryKeyCallBacks,
                                 &kCFTypeDictionaryValueCallBacks));
@@ skipping 62 matching lines @@
   }
   if (err) {
     OSSTATUS_LOG(ERROR, err) << "SecItemCopyMatching error";
     return matching_items;
   }
   return matching_items;
 }
 
 // static
 base::ScopedCFTypeRef<CFDataRef> TrustStoreMac::GetMacNormalizedIssuer(
-    const scoped_refptr<ParsedCertificate>& cert) {
+    const ParsedCertificate* cert) {
   base::ScopedCFTypeRef<CFDataRef> name_data;
   // There does not appear to be any public API to get the normalized version
   // of a Name without creating a SecCertificate.
   base::ScopedCFTypeRef<SecCertificateRef> cert_handle(
       x509_util::CreateSecCertificateFromBytes(cert->der_cert().UnsafeData(),
                                                cert->der_cert().Length()));
   if (!cert_handle) {
     LOG(ERROR) << "CreateOSCertHandleFromBytes";
     return name_data;
   }
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     name_data.reset(
         SecCertificateCopyNormalizedIssuerContent(cert_handle, nullptr));
   }
   if (!name_data)
     LOG(ERROR) << "SecCertificateCopyNormalizedIssuerContent";
   return name_data;
 }
 
-void TrustStoreMac::FindTrustAnchorsByMacNormalizedSubject(
-    CFDataRef name_data,
-    TrustAnchors* out_anchors) const {
-  base::ScopedCFTypeRef<CFArrayRef> scoped_matching_items =
-      FindMatchingCertificatesForMacNormalizedSubject(name_data);
-  if (!scoped_matching_items)
-    return;
-
-  FilterTrustedCertificates(scoped_matching_items.get(), policy_oid_,
-                            out_anchors);
-}
-
 }  // namespace net