Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 139 matching lines @@
   if (status)
     return status;
   CFArrayAppendValue(local_policies, ssl_policy);
   CFRelease(ssl_policy);
 
   // Explicitly add revocation policies, in order to override system
   // revocation checking policies and instead respect the application-level
   // revocation preference.
   status = x509_util::CreateRevocationPolicies(
       (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED),
+      (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY),

[wtc, 2012/08/16 23:28:03]

We pass
  (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
as this argument, but this argument is named enable_ev_checking
as opposed to enable_revocation_checking_ev_only. This is a little
confusing.

I think the enable_ev_checking argument does mean "enable EV checking". Perhaps
a comment here would be useful.
(We only set VERIFY_REV_CHECKING_ENABLED_EV_ONLY if VERIFY_EV_CERT is true.)

[Ryan Sleevi, 2012/08/16 23:55:30]

Just to make sure - you're asking for a comment here in addition to the comment
at the CreateRevocationPolicies?

I would rather refine the comment there if you think this is confusing.

[wtc, 2012/08/17 00:34:44]

Yes, I was asking for an extra comment here, at the call
site, to explain the seemingly mismatch between
  (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
and
  enable_ev_checking

But it is fine to not add more comments.

       local_policies);
   if (status)
     return status;
 
   policies->reset(local_policies.release());
   return noErr;
 }
 
 // Saves some information about the certificate chain |cert_chain| in
 // |*verify_result|. The caller MUST initialize |*verify_result| before
@@ skipping 203 matching lines @@
   }
 
   CSSM_APPLE_TP_ACTION_DATA tp_action_data;
   memset(&tp_action_data, 0, sizeof(tp_action_data));
   tp_action_data.Version = CSSM_APPLE_TP_ACTION_VERSION;
   // Allow CSSM to download any missing intermediate certificates if an
   // authorityInfoAccess extension or issuerAltName extension is present.
   tp_action_data.ActionFlags = CSSM_TP_ACTION_FETCH_CERT_FROM_NET |
                                CSSM_TP_ACTION_TRUST_SETTINGS;
 
+  // Note: For EV certificates, the Apple TP will handle setting these flags
+  // as part of EV evaluation.
   if (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED) {
     // Require a positive result from an OCSP responder or a CRL (or both)
     // for every certificate in the chain. The Apple TP automatically
     // excludes the self-signed root from this requirement. If a certificate
     // is missing both a crlDistributionPoints extension and an
     // authorityInfoAccess extension with an OCSP responder URL, then we
     // will get a kSecTrustResultRecoverableTrustFailure back from
     // SecTrustEvaluate(), with a
     // CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK error code. In that case,
     // we'll set our own result to include
@@ skipping 164 matching lines @@
           // releases, SecTrustCopyExtendedResult would only return noErr and
           // populate ev_dict for EV certificates, but would always include
           // kSecEVOrganizationName in that case, so checking for this key is
           // appropriate for all known versions of SecTrustCopyExtendedResult.
           // The actual organization name is unneeded here and can be accessed
           // through other means. All that matters here is the OS' conception
           // of whether or not the certificate is EV.
           if (CFDictionaryContainsKey(ev_dict,
                                       kSecEVOrganizationName)) {
             verify_result->cert_status |= CERT_STATUS_IS_EV;
+            if (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
+              verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
           }
         }
       }
     }
   }
 
   AppendPublicKeyHashes(completed_chain, &verify_result->public_key_hashes);
   verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(completed_chain);
 
   return OK;
 }
 
 }  // namespace net