Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/x509_util_mac.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_UTIL_MAC_H_
 #define NET_BASE_X509_UTIL_MAC_H_
 
 #include <CoreFoundation/CFArray.h>
 #include <Security/Security.h>
 
@@ skipping 23 matching lines @@
 // On success, stores the resultant policy in |*policy| and returns noErr.
 OSStatus NET_EXPORT CreateSSLServerPolicy(const std::string& hostname,
                                           SecPolicyRef* policy);
 
 // Creates a security policy for basic X.509 validation. If the policy is
 // successfully created, it will be stored in |*policy| and ownership
 // transferred to the caller.
 OSStatus NET_EXPORT CreateBasicX509Policy(SecPolicyRef* policy);
 
 // Creates security policies to control revocation checking (OCSP and CRL).
-// If |enable_revocation_checking| is false, the policies returned will be
-// explicitly disabled from accessing the network or the cache. This may be
-// used to override system settings regarding revocation checking.
+// If |enable_revocation_checking| is true, revocation checking will be
+// explicitly enabled.
+// If |enable_revocation_checking| is false, but |enable_ev_checking| is
+// true, then the system policies for EV checking (which include checking
+// for an online OCSP response) will be permitted. However, if the system

[wtc, 2012/08/16 23:17:39]

Nit: the system => the OS

I guess "the system" is referring to the OS.

+// does not believe the certificate is EV, no revocation checking will be
+// performed.
+// If both are false, then the policies returned will be explicitly prohibited
+// from accessing the network or the local cache, regardless of system settings.
 // If the policies are successfully created, they will be appended to
 // |policies|.
 OSStatus NET_EXPORT CreateRevocationPolicies(bool enable_revocation_checking,
+                                             bool enable_ev_checking,
                                              CFMutableArrayRef policies);
 
 // Wrapper for a CSSM_DATA_PTR that was obtained via one of the CSSM field
 // accessors (such as CSSM_CL_CertGet[First/Next]Value or
 // CSSM_CL_CertGet[First/Next]CachedValue).
 class CSSMFieldValue {
  public:
   CSSMFieldValue();
   CSSMFieldValue(CSSM_CL_HANDLE cl_handle,
                  const CSSM_OID* oid,
@@ skipping 62 matching lines @@
  private:
   CSSM_CL_HANDLE cl_handle_;
   CSSM_HANDLE cached_cert_handle_;
 };
 
 }  // namespace x509_util
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_UTIL_MAC_H_