Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/trust_store_nss_unittest.cc

Index: net/cert/internal/trust_store_nss_unittest.cc
diff --git a/net/cert/internal/trust_store_nss_unittest.cc b/net/cert/internal/trust_store_nss_unittest.cc
index e83ba67286501f8b350e7685dac566ea5dbbea15..4706efce06bd97c6935b1a8f3c8cd9350b7c1ea6 100644
--- a/net/cert/internal/trust_store_nss_unittest.cc
+++ b/net/cert/internal/trust_store_nss_unittest.cc
@@ -106,7 +106,8 @@ class TrustStoreNSSTest : public testing::Test {
   bool TrustStoreContains(scoped_refptr<ParsedCertificate> cert,
                           TrustAnchors expected_matches) {
     TrustAnchors matches;
-    trust_store_nss_->FindTrustAnchorsForCert(cert, &matches);
+    ParsedCertificateList intermediates;
+    trust_store_nss_->FindIssuers(cert, &matches, &intermediates);
 
     std::vector<der::Input> der_result_matches;
     for (const auto& it : matches)
@@ -199,6 +200,48 @@ TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) {
   EXPECT_TRUE(TrustStoreContains(oldroot_->cert(), {newroot_, oldroot_}));
 }
 
+// TODO(eroman): Adapt these tests before landing CL.
+#if 0
+class CertIssuerSourceNSSTestDelegate {
+ public:
+  void AddCert(scoped_refptr<ParsedCertificate> cert) {
+    ASSERT_TRUE(test_nssdb_.is_open());
+    std::string nickname = GetUniqueNickname();
+    ScopedCERTCertificate nss_cert(
+        X509Certificate::CreateOSCertHandleFromBytesWithNickname(
+            cert->der_cert().AsStringPiece().data(), cert->der_cert().Length(),
+            nickname.c_str()));
+    ASSERT_TRUE(nss_cert);
+    SECStatus srv =
+        PK11_ImportCert(test_nssdb_.slot(), nss_cert.get(), CK_INVALID_HANDLE,
+                        nickname.c_str(), PR_FALSE /* includeTrust (unused) */);
+    ASSERT_EQ(SECSuccess, srv);
+  }
+
+  CertIssuerSource& source() { return cert_issuer_source_nss_; }
+
+ protected:
+  std::string GetUniqueNickname() {
+    return "cert_issuer_source_nss_unittest" +
+           base::UintToString(nickname_counter_++);
+  }
+
+  crypto::ScopedTestNSSDB test_nssdb_;
+  CertIssuerSourceNSS cert_issuer_source_nss_;
+  unsigned int nickname_counter_ = 0;
+};
+
+INSTANTIATE_TYPED_TEST_CASE_P(CertIssuerSourceNSSTest,
+                              CertIssuerSourceSyncTest,
+                              CertIssuerSourceNSSTestDelegate);
+
+// NSS doesn't normalize UTF8String values, so use the not-normalized version of
+// those tests.
+INSTANTIATE_TYPED_TEST_CASE_P(CertIssuerSourceNSSNotNormalizedTest,
+                              CertIssuerSourceSyncNotNormalizedTest,
+                              CertIssuerSourceNSSTestDelegate);
+#endif
+
 }  // namespace
 
 }  // namespace net