Extract IsKnownRoot() functionality for testing if a certificate is a

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <cert.h>
 #include <nss.h>
 #include <prerror.h>
 #include <secerr.h>
@@ skipping 11 matching lines @@
 #include "crypto/nss_util.h"
 #include "crypto/scoped_nss_types.h"
 #include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
 #include "net/cert/ev_root_ca_metadata.h"
+#include "net/cert/known_roots_nss.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util_nss.h"
 
 #include <dlfcn.h>
 
 namespace net {
 
 namespace {
 
 typedef std::unique_ptr<
@@ skipping 155 matching lines @@
     verified_chain.push_back(root_cert);
 
   scoped_refptr<X509Certificate> verified_cert_with_chain =
       X509Certificate::CreateFromHandle(verified_cert, verified_chain);
   if (verified_cert_with_chain)
     verify_result->verified_cert = std::move(verified_cert_with_chain);
   else
     verify_result->cert_status |= CERT_STATUS_INVALID;
 }
 
-// IsKnownRoot returns true if the given certificate is one that we believe
-// is a standard (as opposed to user-installed) root.
-bool IsKnownRoot(CERTCertificate* root) {
-  if (!root || !root->slot)
-    return false;
-
-  // This magic name is taken from
-  // http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ckfw/builtins/constants.c&rev=1.13&mark=86,89#79
-  return 0 == strcmp(PK11_GetSlotName(root->slot),
-                     "NSS Builtin Objects");
-}
-
 // Returns true if the given certificate is one of the additional trust anchors.
 bool IsAdditionalTrustAnchor(CERTCertList* additional_trust_anchors,
                              CERTCertificate* root) {
   if (!additional_trust_anchors || !root)
     return false;
   for (CERTCertListNode* node = CERT_LIST_HEAD(additional_trust_anchors);
        !CERT_LIST_END(node, additional_trust_anchors);
        node = CERT_LIST_NEXT(node)) {
     if (CERT_CompareCerts(node->cert, root))
       return true;
@@ skipping 735 matching lines @@
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
   return VerifyInternalImpl(cert, hostname, ocsp_response, flags, crl_set,
                             additional_trust_anchors,
                             NULL,  // chain_verify_callback
                             verify_result);
 }
 
 }  // namespace net