Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc.h"
 
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "build/build_config.h"
 #include "net/base/cert_status_flags.h"
@@ skipping 64 matching lines @@
 
   if (IsBlacklisted(cert)) {
     verify_result->cert_status |= CERT_STATUS_REVOKED;
     return ERR_CERT_REVOKED;
   }
 
   // If EV verification was requested and no CRLSet is present, or if the
   // CRLSet has expired, then enable online revocation checks. If the online
   // check fails, EV status won't be shown.
   //
-  // A possible optimisation is to only enable online revocation checking in
-  // the event that the leaf certificate appears to include a EV policy ID.
-  // However, it's expected that having a current CRLSet will be very common.
+  // TODO(rsleevi): http://crbug.com/142974 - Allow preferences to fully
+  // disable revocation checking.
   if ((flags & X509Certificate::VERIFY_EV_CERT) &&
       (!crl_set || crl_set->IsExpired())) {
-    flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED;
+    flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY;
   }
 
   int rv = VerifyInternal(cert, hostname, flags, crl_set, verify_result);
 
   // This check is done after VerifyInternal so that VerifyInternal can fill
   // in the list of public key hashes.
   if (IsPublicKeyBlacklisted(verify_result->public_key_hashes)) {
     verify_result->cert_status |= CERT_STATUS_REVOKED;
     rv = MapCertStatusToNetError(verify_result->cert_status);
   }
@@ skipping 167 matching lines @@
          j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) {
       if (memcmp(j->data, kHashes[i], base::kSHA1Length) == 0)
         return true;
     }
   }
 
   return false;
 }
 
 }  // namespace net