Extract IsKnownRoot() functionality for testing if a certificate is a

net/cert/cert_verify_proc_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_win.h"
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/memory/free_deleter.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sha1.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_local.h"
 #include "crypto/capi_util.h"
 #include "crypto/scoped_capi_types.h"
 #include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
 #include "net/cert/ev_root_ca_metadata.h"
+#include "net/cert/known_roots_win.h"
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_certificate.h"
-#include "net/cert/x509_certificate_known_roots_win.h"
 
 #if !defined(CERT_TRUST_HAS_WEAK_SIGNATURE)
 // This was introduced in Windows 8 / Windows Server 2012, but retroactively
 // ported as far back as Windows XP via system update.
 #define CERT_TRUST_HAS_WEAK_SIGNATURE 0x00100000
 #endif
 
 namespace net {
 
 namespace {
@@ skipping 237 matching lines @@
 // IsIssuedByKnownRoot returns true if the given chain is rooted at a root CA
 // which we recognise as a standard root.
 // static
 bool IsIssuedByKnownRoot(PCCERT_CHAIN_CONTEXT chain_context) {
   PCERT_SIMPLE_CHAIN first_chain = chain_context->rgpChain[0];
   int num_elements = first_chain->cElement;
   if (num_elements < 1)
     return false;
   PCERT_CHAIN_ELEMENT* element = first_chain->rgpElement;
   PCCERT_CONTEXT cert = element[num_elements - 1]->pCertContext;
-
-  SHA256HashValue hash = X509Certificate::CalculateFingerprint256(cert);
-  bool is_builtin =
-      IsSHA256HashInSortedArray(hash, &kKnownRootCertSHA256Hashes[0][0],
-                                sizeof(kKnownRootCertSHA256Hashes));
-
-  // Test to see if the use of a built-in set of known roots on Windows can be
-  // replaced with using AuthRoot's SHA-256 property. On any system other than
-  // a fresh RTM with no AuthRoot updates, this property should always exist for
-  // roots delivered via AuthRoot.stl, but should not exist on any manually or
-  // administratively deployed roots.
-  BYTE hash_prop[32] = {0};
-  DWORD size = sizeof(hash_prop);
-  bool found_property =
-      CertGetCertificateContextProperty(
-          cert, CERT_AUTH_ROOT_SHA256_HASH_PROP_ID, &hash_prop, &size) &&
-      size == sizeof(hash_prop);
-
-  enum BuiltinStatus {
-    BUILT_IN_PROPERTY_NOT_FOUND_BUILTIN_NOT_SET = 0,
-    BUILT_IN_PROPERTY_NOT_FOUND_BUILTIN_SET = 1,
-    BUILT_IN_PROPERTY_FOUND_BUILTIN_NOT_SET = 2,
-    BUILT_IN_PROPERTY_FOUND_BUILTIN_SET = 3,
-    BUILT_IN_MAX_VALUE,
-  } status;
-  if (!found_property && !is_builtin) {
-    status = BUILT_IN_PROPERTY_NOT_FOUND_BUILTIN_NOT_SET;
-  } else if (!found_property && is_builtin) {
-    status = BUILT_IN_PROPERTY_NOT_FOUND_BUILTIN_SET;
-  } else if (found_property && !is_builtin) {
-    status = BUILT_IN_PROPERTY_FOUND_BUILTIN_NOT_SET;
-  } else if (found_property && is_builtin) {
-    status = BUILT_IN_PROPERTY_FOUND_BUILTIN_SET;
-  } else {
-    status = BUILT_IN_MAX_VALUE;
-  }
-  UMA_HISTOGRAM_ENUMERATION("Net.SSL_AuthRootConsistency", status,
-                            BUILT_IN_MAX_VALUE);
-
-  return is_builtin;
+  return IsKnownRoot(cert);
 }
 
 // Saves some information about the certificate chain |chain_context| in
 // |*verify_result|. The caller MUST initialize |*verify_result| before
 // calling this function.
 void GetCertChainInfo(PCCERT_CHAIN_CONTEXT chain_context,
                       CertVerifyResult* verify_result) {
   if (chain_context->cChain == 0)
     return;
 
@@ skipping 879 matching lines @@
     return MapCertStatusToNetError(verify_result->cert_status);
 
   if (ev_policy_oid &&
       CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) {
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
   return OK;
 }
 
 }  // namespace net