Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/trust_store_nss.cc

Index: net/cert/internal/trust_store_nss.cc
diff --git a/net/cert/internal/trust_store_nss.cc b/net/cert/internal/trust_store_nss.cc
index 0a67939ce47d12d7b4b9ed5c9969fadd0845979f..6dd38d5a2de33a33f9255e415d25ead8e965d360 100644
--- a/net/cert/internal/trust_store_nss.cc
+++ b/net/cert/internal/trust_store_nss.cc
@@ -24,9 +24,9 @@ TrustStoreNSS::TrustStoreNSS(SECTrustType trust_type)
 
 TrustStoreNSS::~TrustStoreNSS() = default;
 
-void TrustStoreNSS::FindTrustAnchorsForCert(
-    const scoped_refptr<ParsedCertificate>& cert,
-    TrustAnchors* out_anchors) const {
+void TrustStoreNSS::FindIssuers(const scoped_refptr<ParsedCertificate>& cert,
+                                TrustAnchors* trust_anchors,
+                                ParsedCertificateList* intermediates) const {
   crypto::EnsureNSSInit();
 
   SECItem name;
@@ -50,27 +50,40 @@ void TrustStoreNSS::FindTrustAnchorsForCert(
     if (CERT_GetCertTrust(node->cert, &trust) != SECSuccess)
       continue;
 
-    // TODO(mattm): handle explicit distrust (blacklisting)?
     const int ca_trust = CERTDB_TRUSTED_CA;
-    if ((SEC_GET_TRUST_FLAGS(&trust, trust_type_) & ca_trust) != ca_trust)
-      continue;
+    bool is_trusted =
+        (SEC_GET_TRUST_FLAGS(&trust, trust_type_) & ca_trust) == ca_trust;
 
-    CertErrors errors;
-    scoped_refptr<ParsedCertificate> anchor_cert = ParsedCertificate::Create(
+    CertErrors parse_errors;
+    scoped_refptr<ParsedCertificate> cur_cert = ParsedCertificate::Create(
         x509_util::CreateCryptoBuffer(node->cert->derCert.data,
                                       node->cert->derCert.len),
-        {}, &errors);
-    if (!anchor_cert) {
+        {}, &parse_errors);
+
+    if (!cur_cert) {
       // TODO(crbug.com/634443): return errors better.
       LOG(ERROR) << "Error parsing issuer certificate:\n"
-                 << errors.ToDebugString();
+                 << parse_errors.ToDebugString();
       continue;
     }
 
-    out_anchors->push_back(TrustAnchor::CreateFromCertificateNoConstraints(
-        std::move(anchor_cert)));
+    if (is_trusted) {
+      trust_anchors->push_back(
+          TrustAnchor::CreateFromCertificateNoConstraints(std::move(cur_cert)));
+    } else {
+      // Note that |cur_cert| may be distrusted. That is OK, since the path
+      // builder will be checking IsBlacklisted() for each certificate in the
+      // chain.
+      intermediates->push_back(std::move(cur_cert));
+    }
   }
   CERT_DestroyCertList(found_certs);
 }
 
+bool TrustStoreNSS::IsBlacklisted(
+    const scoped_refptr<ParsedCertificate>& cert) const {
+  // TODO(eroman): Implement
+  return false;
+}
+
 }  // namespace net